Threat Source newsletter (Dec. 8, 2022): Your uncle clicked every link
Summary: SafeBreach researcher Or Yair disclosed at Black Hat Europe on Dec. 7 a vulnerability class in endpoint detection and response tools that, because those products hold super-user rights, could let an attacker wipe almost any file on a system, including system files. Vendors were notified between July and August, and affected products included Microsoft Windows Defender, Windows Defender for Endpoint, TrendMicro ApexOne, Avast Antivirus, AVG Antivirus, and SentinelOne.
What you should know: The security product you trust with super-user rights on every endpoint is itself a potential wiper in the hands of an attacker - and the fix depends on vendors that were notified months before the public disclosure.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026