Connect with us

Tech

Microsoft patched over 1,100 CVEs in 2025 | Computer Weekly

Published

on

Microsoft patched over 1,100 CVEs in 2025 | Computer Weekly


Microsoft has addressed a little shy of 60 newly-designated common vulnerabilities and exposures (CVEs) in the final Patch Tuesday update of a challenging year for defenders, bringing the total volume of flaws fixed this year to over 1,100.

Out of this month’s flaws, three are rated as critical in their severity, one is known to be actively exploited in the wild, and two more are known to have public proofs of concept available, but are not yet being exploited.

The exploited vulnerability, tracked as CVE-2025-62221, affects Windows Cloud Files Mini Filter Driver. It arises as the result a use after free (UAF) condition in which the program references memory after it has been freed up, leading to unpredictable and sometimes dangerous conditions. In this instance, a threat actor can use it to escalate their privilege levels on the victim system.

“While there is no confirmed public PoC for CVE-2025-62221, past research and PoCs for related Cloud Files mini-filter issues suggest attackers already understand the underlying techniques,” said Mike Walters, co-founder and CEO of patch management specialist Action1.

“The real impact of this vulnerability emerges when attackers chain it with other weaknesses. After gaining low-privileged access through phishing, a browser exploit, or an application RCE, they can use CVE-2025-62221 to escalate to SYSTEM and take full control of the host.”

Walters warned that with Cloud Files pretty much ubiquitous, and exploitation confirmed, the risk for defenders was how quickly the flaw will become part of threat actor attack chains. He said that since it only requires low privileges to exploit, users with weak least-privilege practices, or heavily-shared endpoints, may be heading for trouble.

Meanwhile, the two publicly-disclosed vulnerabilities this month are both remote code execution (RCE) issues, one affecting PowerShell – CVE-2025-54100 – and the other affecting GitHub Copilot for Jetbrains – CVE-2205-64671.

The PowerShell vulnerability stems from a command injection flaw that exists in how Windows PowerShell process web content, which an unauthenticated attacker could sue to execute arbitrary code as a user who is allowed to run crafted PowerShell commands. Given PowerShell’s significance and role in offensive tooling, exploitation is likely to be straightforward, and it likely becomes more dangerous as part of a social engineering attack chain against privileged users.

The GitHub Copilot vulnerability, meanwhile, stands out as one of the more interesting flaws being patched this month, according to Immersive senior director of cyber threat research Kev Breen.

“Copilot is the GenAI coding assistant that is used by Microsoft and GitHub [and] this vulnerability specifically refers to the JetBrains extensions,” explained Breen. “The vulnerability states that it’s possible to gain code execution on affected hosts by tricking the LLM [large language model] into running commands that bypass the guardrails and appending instructions in the user’s ‘auto-approve’ settings.

“This can be achieved through ‘Cross Prompt Injection,’ which is where the prompt is modified not by the user but by the LLM agents as they craft their own prompts based on the content of files or data retrieved from a Model Context Protocol (MCP) server that has risen in popularity with agent-based LLMs.”

Breen said that although Microsoft has marked this vulnerability as less-likely-to-be-exploited, if adopting a risk-based approach to patching, the developers whom it targets typically have more privileged access to API keys or other secrets. Therefore, he added, anybody running GitHub Copilot for JetBrains should patch promptly.

Finally, this month’s three critical flaws are all RCE vulnerabilities. Two of them, CVE-2025-62554 and CVE-2025-63557, affect Microsoft Office, and the third, CVE-2025-65272 is to be found in Outlook.

Do you want to be a record breaker?

Looking back on the year gone by in his monthly Patch Tuesday roundup, Dustin Childs of Trend Micro’s Zero Day Initiative said Microsoft had patched a total of 1,139 CVEs during the past 12 months, making 2025 the second-largest year ever in terms of volume, just 111 CVEs shy of 2020.

Childs wrote that as Microsoft’s portfolio diversifies and grows in scale, and vulnerabilities originating through artificial intelligence (AI) increase in prevalence, 2026 looks set to be a record-breaking year.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Silicon Valley Is All About the Hard Sell These Days

Published

on

Silicon Valley Is All About the Hard Sell These Days


OpenAI CEO Sam Altman was at the center of Silicon Valley’s most visible publicity push in recent memory Monday night when he appeared on The Tonight Show. In a predictably softball interview with host Jimmy Fallon, Altman explained how ChatGPT has helped him alleviate the anxiety that comes with being a new parent.

It was a distinctly clever, if somewhat surprising, choice from Altman who has mostly kept his personal life out of the media spotlight. But Altman is a salesman, and a good salesman understands the optics of good television. So he talked about being a dad and being worried that his son—who wasn’t crawling at six months—was developing slower than other children (spoiler: he’s not). “I cannot imagine having gone through, figuring out how to raise a newborn without ChatGPT,” Altman told Fallon. “People did it for a long time, no problem. So clearly it was possible, but I have relied on it so much.”

As the fears around the future of AI continue to mount, the subtext was patently obvious: Technology can help people better understand their kids. We should welcome it. The timing of that particular message was not by mistake.

Of late, the tech establishment has gone on a charm offensive as age-verification laws sweep the US and the world, and the public backlash to AI intensifies.

Altman acknowledged as much but didn’t get into specifics during the interview. “One of the things that I’m worried about is just the rate of change that’s happening in the world right now. This is a three-year-old technology. No other technology has ever been adopted by the world this fast,” Altman said. “Making sure that we introduce this to the world in a responsible way, where people have time to adapt, to give input, to figure out how to do this—you could imagine us getting that wrong.”

Those concerns have only accelerated a concentrated campaign out of the Valley to better control the narrative, which has included everything from TV ads to pop-ups to create better brand awareness, and explain why the virtues of AI and social media, and all that it can do for people, outweigh the harms. If Silicon Valley is in its “hard tech era,” it is making an even harder sell.

The ads are everywhere you are: streaming, cable, social media. TikTok is great for dad advice. ChatGPT can teach you how to properly exercise, cook memorable dishes, or can curate an unforgettable road trip. Google wants you to “ask more of your phone” with its AI features. Anthropic—which, in a September ad spot, claimed “there’s never been a better time” for AI—is even hosting pop-ups and selling merch. Meta promises to be your personal AI for, well, everything.



Source link

Continue Reading

Tech

Get (or Gift) 2 Years of Spectacular Shaves for $80 Right Now

Published

on

Get (or Gift) 2 Years of Spectacular Shaves for  Right Now


Razors are one of the most heavily and competitively marketed products in American capitalism. Made with steel and plastic that costs a few pennies, but sold for a thousand percent profit, the razor market is the subject of vigorous academic study and debate.

The founder of Gillette famously came up with a model of basically giving away the razor handle so he could sell the blades. Canadian startup Henson has the opposite model, charging $79 for a razor that can give you an excellent shave with dirt-cheap disposable blades that cost about 15 cents each.

I’ve been using the Henson razor for the past three months, and it offers the best shave I’ve had up to this point in my life. Right now, Walmart is selling the device with enough blades to last you two years for just $80. Razors are always a popular Christmas gift for fathers, and this deal would fit nicely under your tree.

Photograph: Martin Cizmar

Henson

AL13 Safety Razor Shave Set (2 Year)

Henson is a Canadian company with roots in aerospace, having contributed components to the Mars rover. The AL13 Safety Razor is made from aluminum machined at their shop in Ontario. It comes in a half-dozen colors, including the classic copper I’ve tested.

The razor’s head is two parts that dovetail together and are then compressed using the screw-on handle. The handle holds the blade in place with extreme rigidity at a precise angle so the blade doesn’t chatter around, which can cause skin irritation. The blade barely sticks out from the head, with an edge only about half the width of a hair exposed—you’ll have to look very closely to see it.

The Henson razor is manufactured with exacting tolerances of 0.00025 of an inch, or about one-twelfth the thickness of a human hair. There are no plastic parts, just aluminum with stainless steel bushings. Henson specifically designed its device to work with cheap, generic double-edged blades that sell for ten or 15 cents each—the difference here is how firmly and precisely those blades are held in place.

I’ve been using the Henson for about two months now and have never had better shaves. I shave about every other day, and each blade lasts me about a week, meaning the 100-pack included here will last you two years. The shave is very close but smooth, and I’ve only barely nicked myself a few times in that span. (The company has paid for medical imaging that shows its razors cause one-third the skin irritation you get from multi-blade razors.) The company sent me its proprietary $20 shaving cream, which I somehow misplaced before ever using, but I have had extremely crisp and clean shaves with a $4 can of regular Gillette foam.

The one tip I have is that you get the best results if you unscrew the handle a bit when rinsing the blades between uses, as shaved hairs otherwise tend to get stuck in the space between components and don’t easily rinse out.

Did I mention it’s a very handsome razor? It is, with a machined handle that has a texture that looks good and also provides a nice, gritty grip when wet. If you’re looking to gift a grooming device—or just want to treat yourself—the Henson at this price is a great buy.



Source link

Continue Reading

Tech

Jennifer Lewis ScD ’91: “Can we make tissues that are made from you, for you?”

Published

on

Jennifer Lewis ScD ’91: “Can we make tissues that are made from you, for you?”



“Can we make tissues that are made from you, for you?” asked Jennifer Lewis ScD ’91 at the 2025 Mildred S. Dresselhaus Lecture, organized by MIT.nano, on Nov. 3. “The grand challenge goal is to create these tissues for therapeutic use and, ultimately, at the whole organ scale.”

Lewis, the Hansjörg Wyss Professor of Biologically Inspired Engineering at Harvard University, is pursuing that challenge through advances in 3D printing. In her talk presented to a combined in-person and virtual audience of over 500 attendees, Lewis shared work from her lab that focuses on enhanced function in 3D printed components for use in soft electronics, robotics, and life sciences.

“How you make a material affects its structure, and it affects its properties,” said Lewis. “This perspective was a light bulb moment for me, to think about 3D printing beyond just prototyping and making shapes, but really being able to control local composition, structure, and properties across multiple scales.”

A trained materials scientist, Lewis reflected on learning to speak the language of biologists when she joined Harvard to start her own lab focused on bioprinting and biological engineering. How does one compare particles and polymers to stem cells and extracellular matrices? A key commonality, she explained, is the need for a material that can be embedded and then erased, leaving behind open channels. To meet this need, Lewis’ lab developed new 3D printing methods, sophisticated printhead designs, and viscoelastic inks — meaning the ink can go back and forth between liquid and solid form.

Displaying a video of a moving robot octopus named Octobot, Lewis showed how her group engineered two sacrificial inks that change from fluid to solid upon either warming or cooling. The concept draws inspiration from nature — plants that dynamically change in response to touch, light, heat, and hydration. For Octobot, Lewis’ team used sacrificial ink and an embedded printing process that enables free-form printing in three dimensions, rather than layer-by-layer, to create a fully soft autonomous robot. An oscillating circuit in the center guides the fuel (hydrogen peroxide), making the arms move up and down as they inflate and deflate.

From robots to whole organ engineering

“How can we leverage shape morphing in tissue engineering?” asked Lewis. “Just like our blood continuously flows through our body, we could have continuous supply of healing.”

Lewis’ lab is now working on building human tissues, primarily cardiac, kidney, and cerebral tissue, using patient-specific cells. The motivation, Lewis explained, is not only the need for human organs for people with diseases, but the fact that receiving a donated organ means taking immunosuppressants the rest of your life. If, instead, the tissue could be made from your own cells, it would be a stronger match to your own body.

“Just like we did to engineer viscoelastic matrices for embedded printing of functional and structural materials,” said Lewis, “we can take stem cells and then use our sacrificial writing method to write in perfusable vasculature.” The process uses a technique Lewis calls SWIFT — sacrificial writing into functional tissue. Sharing lab results, Lewis showed how the stem cells, differentiated into cardiac building blocks, are initially beating individually, but after being packed into a tighter space that will support SWIFT, these building blocks fuse together and become one tissue that beats synchronously. Then, her team uses a gelatin ink that solidifies or liquefies with temperature changes to print the complex design of human vessels, flushing away the ink to leave behind open lumens. The channel remains open, mimicking a blood vessel network that could have fluid actively, continuously flowing through it. “Where we’re going is to expand this not only to different tissue types, but also building in mechanisms by which we can build multi-scale vasculature,” said Lewis.

Honoring Mildred S. Dresselhaus

In closing, Lewis reflected on Dresselhaus’ positive impact on her own career. “I want to dedicate this [talk] to Millie Dresselhaus,” said Lewis. She pointed to a quote by Millie: “The best thing about having a lady professor on campus is that it tells women students that they can do it, too.” Lewis, who arrived at MIT as a materials science and engineering graduate student in the late 1980s, a time when there were very few women with engineering doctorates, noted that “just seeing someone of her stature was really an inspiration for me. I thank her very much for all that she’s done, for her amazing inspiration both as a student, as a faculty member, and even now, today.”

After the lecture, Lewis was joined by Ritu Raman, the Eugene Bell Career Development Assistant Professor of Tissue Engineering in the MIT Department of Mechanical Engineering, for a question-and-answer session. Their discussion included ideas on 3D printing hardware and software, tissue repair and regeneration, and bioprinting in space. 

“Both Mildred Dresselhaus and Jennifer Lewis have made incredible contributions to science and served as inspiring role models to many in the MIT community and beyond, including myself,” said Raman. “In my own career as a tissue engineer, the tools and techniques developed by Professor Lewis and her team have critically informed and enabled the research my lab is pursuing.”

This was the seventh Dresselhaus Lecture, named in honor of the late MIT Institute Professor Mildred Dresselhaus, known to many as the “Queen of Carbon Science.” The annual event honors a significant figure in science and engineering from anywhere in the world whose leadership and impact echo Dresselhaus’ life, accomplishments, and values. 

“Professor Lewis exemplifies, in so many ways, the spirit of Millie Dresselhaus,” said MIT.nano Director Vladimir Bulović. “Millie’s groundbreaking work, indeed, is well known; and the groundbreaking work of Professor Lewis in 3D printing and bio-inspired materials continues that legacy.”



Source link

Continue Reading

Trending