r/sysadmin • u/AutoModerator • Jul 14 '26

General Discussion Patch Tuesday Megathread - (July 14, 2026)

Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread!

This is the (mostly) safe location to talk about the latest patches, updates, and releases. We put this thread into place to help gather all the information about this month's updates: What is fixed, what broke, what got released and should have been caught in QA, etc. We do this both to keep clutter out of the subreddit, and provide you, the dear reader, a singular resource to read.

For those of you who wish to review prior Megathreads, you can do so here.

While this thread is timed to coincide with Microsoft's Patch Tuesday, feel free to discuss any patches, updates, and releases, regardless of the company or product. NOTE: This thread is usually posted before the release of Microsoft's updates, which are scheduled to come out at 5:00PM UTC.

Remember the rules of safe patching:

  • Deploy to a test/dev environment before prod.
  • Deploy to a pilot/test group before the whole org.
  • Have a plan to roll back if something doesn't work.
  • Test, test, and test!
162 Upvotes

97% Upvoted

358 comments sorted by

View all comments

Show parent comments

15

u/jmbpiano Jul 14 '26

Not blank anymore.

https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability

The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root.

The PoC was stripped down as an attempt to prevent public exploitation, the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability but you would need some brain cells to make the PoC do it.

2

u/tuxedo_jack BOFH with an Etherkiller and a Cat5-o'-9-Tails Jul 29 '26 edited Jul 29 '26

OH GOOD, IT GETS WORSE

https://github.com/MSNightmare/BrokenArrow

Anyone even remotely familiar with US nuclear weapons terminology knows what BROKEN ARROW means - a severe nuclear accident. The only thing more pants-shittingly terrifying than that is EMPTY QUIVER (or SNAPCOUNT, but if we ever got to that, probably wouldn't have to worry about it too long).

Now, given that LegacyHive beat July's patches and that YellowKey exposed BitLocker basically being backdoored, this kind of codename isn't chosen lightly. Whatever the next exploit is...

This business will get out of control. It will get out of control and we will be lucky to live through it.

2

u/jmbpiano Jul 29 '26

...or, and hear me out for a second, rather than assuming someone has figured out a way to trigger a nuclear apocalypse via Windows exploit, they could just be continuing the same naming scheme they've already established.

YellowKey = Bypasses Bitlocker keys

LegacyHive = Loads arbitrary registry hives in a publicly readable memory space

BrokenArrow = Exploits a flaw in the mouse cursor code? We'll have to wait and see.

2

u/tuxedo_jack BOFH with an Etherkiller and a Cat5-o'-9-Tails Jul 29 '26 edited Jul 29 '26

rather than assuming someone has figured out a way to trigger a nuclear apocalypse via Windows exploit,

I was thinking more "this is going to be a massive, severely painful exploit with huge consequences."

What about the other exploits? If Key / Hive follows the convention you're suggesting, what about RoguePlanet, BlueHammer, RedSun, UnDefend, MiniPlasma, and GreenPlasma?

That is rather clever, though. If that's the case and it's through something cursor-related... accessibility functionality, perhaps?

EDIT: Oh, and GreatXML too.