Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Windows Plug and Play auto-install abuse reaches SYSTEM code execution on Windows 11

Technical Analysis
First reported
Last updated
Happening score
H score 26
1 unique sources, 1 articles

Summary

Hide ▲

Researchers showed that Windows Plug and Play auto-install can be abused to reach SYSTEM code execution on Windows 11, turning a privileged device-install path into a local takeover vector under specific redirection conditions.

Related Happenings

XMRig cryptominer delivered via Steam ClickFix PowerShell

Malware Activity
H score21 First: 26.07.2026 01:37 Last: 26.07.2026 01:37 Sources 1

About this happening: A ClickFix lure on Steam discussion forums now turns fake troubleshooting replies into XMRig infections on Windows computers. Victims are told to run an administra...

Open Happening

Veil#Drop PureLog Stealer in-memory delivery operation

Malware Activity
H score30 First: 01.07.2026 17:30 Last: 01.07.2026 17:30 Sources 1

About this happening: Veil#Drop is delivering PureLog Stealer through a fileless chain that keeps payloads entirely in memory, reducing disk artifacts and raising the chance of evading...

Open Happening

GitHub npm v12 hardens install-time dependency execution and source resolution

Security Tool/Service
H score11 First: 10.06.2026 22:41 Last: 10.06.2026 22:41 Sources 1

About this happening: GitHub is tightening npm v12 next month by blocking automatic dependency install scripts and non-registry sources, reducing supply-chain attack paths triggered by npm in...

Open Happening

Windows 11 cumulative updates KB5094126 and KB5093998 (June 2026 Patch Tuesday)

Security Patch Release
H score29 First: 09.06.2026 20:32 Last: 09.06.2026 20:32 Sources 1

About this happening: Microsoft released Windows 11 KB5094126 and KB5093998 mandatory cumulative updates to patch security vulnerabilities across 25H2/24H2 and 23H2 during June 2026 P...

Open Happening

JustAskJacky fake AI assistant malware campaign

Campaign
H score33 First: 04.06.2026 17:00 Last: 04.06.2026 17:00 Sources 1

About this happening: The JustAskJacky campaign is distributing a fake AI assistant that installs a backdoor, turning trusted-looking software into a malware delivery path. The operation us...

Open Happening

Timeline

  1. 11.08.2026 13:48 2 articles · 1h ago

    Researchers show USB auto-install can reach SYSTEM code execution on Windows 11

    Initial Disclosure

    Alejandro Hernando and Borja Martinez describe Plug And Pwn, a DEF CON 34 research technique that abuses Windows Plug and Play to fetch signed vendor software for an emulated USB device and chain privileged installation components into SYSTEM code execution on a fully updated Windows 11 machine. The same device-install path can also be triggered over Remote Desktop when supported Plug and Play or low-level USB redirection is enabled, with the physical chain using a Sierra Wireless device to install SwiService.exe and the remote chain forging an Intel RealSense device before a CRYPTBASE.dll search-order hijack yields SYSTEM.

    Show sources
    Open in new tab