John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
Your Antivirus Is Harvesting Passwords Now: BlueHammer Hits CISA KEV
The BlueHammer flaw has moved from a research curiosity to an active threat. This Windows Defender zero-day turns your security software into a password harvester by exploiting a race condition to steal credentials. CISA says patch now.
Read More
Antivirus as a Weapon: The Defender Trilogy No One Can Patch
A single researcher has spent April taking Windows Defender apart. The results are a set of three zero-days that turn your antivirus into a malware delivery system and then blind it so it can't see the damage.
Read More
165 CVEs in One Day. Two Zero-Days. One Kerberos Bug That Should Have Your Full Attention.
Microsoft dropped 165 CVEs today including two zero-days, a critical Kerberos credential relay vulnerability, and a FortiClient EMS flaw with a 48-hour CISA deadline. Here's how to prioritize.
Read More
Microsoft's Security Theater, Two Acts
FedRAMP reviewers called Microsoft's government cloud documentation 'a pile of shit' and authorized it anyway. Same week, Microsoft silently locked out the developers of WireGuard and VeraCrypt. Two stories, same company, same problem.
Read More
A Disgruntled Researcher Just Handed Every Attacker a Free Windows Privilege Escalation Exploit
A frustrated researcher publicly released BlueHammer, a working Windows privilege escalation zero-day, after clashing with Microsoft's disclosure process.
Read More
AI-Written Phishing Emails Get Clicked 450% More Often. The Data Is In.
Microsoft telemetry shows AI-assisted phishing lures hit a 54% click-through rate versus 12% for traditional campaigns, a 450% increase that breaks conventional security awareness training.
Read More
CrowdStrike and Microsoft Are Sharing Data Now. Yes, Really.
CrowdStrike's Falcon SIEM can now ingest Microsoft Defender telemetry, and Formula 1 is somehow responsible.
Read More
LinkedIn's Been Scanning Your Chrome Extensions. All 6,000 of Them.
Research confirmed LinkedIn scans for 6,236 Chrome extensions and fingerprints your browser without telling you. Microsoft says it's for your protection. The extension list says otherwise.
Read More
RSAC 2026 Day One: Every Vendor Went Agentic, the Government Went Missing
RSAC 2026 opened with a wave of autonomous AI security launches from Google, Microsoft, CrowdStrike, and Wiz. Reportedly absent from the program: CISA, the FBI, and the NSA.
Read More
RSAC 2026 Opens Monday: Here's What the Cybersecurity Industry Will Be Talking About All Week
RSAC 2026 opens Monday at Moscone Center. Agentic AI, human manipulation, and post-breach resilience are the dominant themes -- here's what to watch and why this year feels different.
Read More
Patch Cycles Are Now Running Behind the Exploit Curve
A GNU telnetd PoC is already circulating. CISA added another KEV entry. Rapid7 says exploited high/critical vulns surged 105% and attack timelines collapsed. Meanwhile teams are still digesting Microsoft's 83-vulnerability March dump.
Read More
Two Vulnerabilities, Two Patches, One Message: Critical Enterprise Flaws Need Immediate Attention
Microsoft shipped an emergency out-of-band RRAS patch days after Patch Tuesday. HPE has a switch vulnerability that lets attackers reset admin passwords with zero credentials. Both need patching now.
Read More
March Patch Tuesday: Two Zero-Days Already Public, Plus a SolarWinds Deadline That's Right Now
Microsoft patched 79+ flaws including two publicly disclosed zero-days. No confirmed active exploitation yet, which is rare. But the SolarWinds Web Help Desk CISA deadline is today, and 'publicly disclosed' means attackers already have the blueprints.
Read More
Patch Week From Hell: Microsoft, Adobe, SAP, and HPE All Drop Critical Fixes at Once
March 2026 might be the worst coordinated patching week in years. Microsoft, Adobe, SAP, and HPE all dropped critical fixes in the same 48-hour window. Here's what to patch first.
Read More