Tech
Microsoft patches 112 CVEs on first Patch Tuesday of 2026 | Computer Weekly
Microsoft has pushed fixes for 112 common vulnerabilities and exposures (CVEs) on the first Patch Tuesday of 2026, among them a number of zero-day flaws that were either publicly disclosed or actively exploited prior to patching, and no fewer than eight critical bugs.
Although this is a sharp increase in comparison to recent Patch Tuesdays – December 2025 saw Microsoft patch just 56 flaws – it is important to note that the festive season is frequently a quieter time for patches, sometimes by design, and January often brings an uptick in disclosures. Nevertheless, observed Jack Bicer, director of vulnerability research at patch management firm Action1, the volume of fixes in the latest update underscores “growing pressure” on security teams.
“This comes against a broader trend: in 2025, reported vulnerabilities increased by 12% over 2024, continuing the upward trajectory of disclosed security flaws,” said Bicer.
Paramount among these flaws is CVE-2026-20805, an information disclosure vulnerability in Desktop Window Manager, discovered by Microsoft’s own Threat Intelligence and Security Response Centers.
Although it bears a relatively low Common Vulnerability Scoring System (CVSS) score of just 5.5, active exploitation of CVE-2026-20805 has been observed in the wild, Microsoft said
“The flaw leaks a memory address from a remote ALPC [Asynchronous Local Procedure Call] port. This type of information disclosure vulnerability is often used to defeat Address Space Layout Randomisation (ASLR) – a security feature in modern operating systems designed to protect against buffer overflows and other exploits that rely on manipulating the memory of a running application,” explained Immersive senior director of cyber threat research, Kev Breen.
“Once they know where code resides in memory, they can chain this with a separate code execution bug to turn a difficult exploit into a reliable one,” he said. “Microsoft doesn’t provide any information on what other components that chain could involve – making it harder for defenders to threat hunt for potential exploitation attempts, meaning patching quickly is the only mitigation for now.”
Ivanti vice president of security product management, Chris Goettl, agreed with this assessment. “The vulnerability affects all currently supported and extended security update supported versions of the Windows OS,” he said, “[so] a risk-based prioritisation methodology warrants treating this vulnerability as a higher severity than the vendor rating or CVSS score assigned.”
Next up is a security feature bypass (SFB) flaw in Secure Boot Certificate Expiration, tracked as CVE-2026-21265. It, too, carries a comparatively low CVSS score and Microsoft only rates it as Important. However, said Goettl, it has been publicly disclosed and security teams would be wise to look into it.
“The fix provides a warning regarding certificates that will be expiring in 2026 and details on actions that are required to up renew certificates prior to their expiration in addition to the update,” he said.
“It is recommended to start investigating what actions your organisation may need to take to prevent potential serviceability and security as certificates expire.”
The remaining items on the zero-day list – again both publicly disclosed but not known to be exploited, date back three and four years respectively. Both are elevation of privilege (EoP) flaws affecting soft modem drivers that ship natively with supported Windows operating systems.
The older of the two, CVE-2023-31096, is to be found in Agere Soft Modem Driver, and the more recent one, CVE-2024-55414 in Windows Motorola Soft Modem Driver. Microsoft’s solution is to remove the affected drivers, agrsm64.sys and arsm.sys in the first instances and smserl64.sys and smserial.sys in the second, as part of the January cumulative update.
This means soft modem hardware that depends on them will now cease to work on Windows. Microsoft said admins should act quickly to remove any existing dependencies on the affected hardware.
Critical flaws
The critically-rated flaws in the January 2026 Patch Tuesday drop comprise six remote code execution (RCE) issues and two EoP issues.
The RCE flaws affect Microsoft Excel, Microsoft Office and Windows Local Security Authority Subsystem Service (LSASS). They have been assigned designations CVE-2026-20854, CVE-2026-20944, CVE-2026-20952, CVE-2026-20953, CVE-2026-20955 and CVE-2026-20957.
The EoP flaws are CVE-2026-20822, which impacts the Windows Graphics Component, and CVE-2026-20876, which impacts Windows Virtualization-Based Security (VBS) Enclave.
Mike Walters, president and co-founder at Action1, said the VBS flaw was worth particular attention because “it breaks the security boundary designed to protect Windows itself, allowing attackers to climb into the one of the most trusted execution layers of the system”.
Walters warned of a serious risk to organisations that lean on VBS in order to protect credentials and other secrets, or sensitive workloads, because if exploited successfully, an attacker might be able to bypass security controls, achieve persistence, evade detection, and hit systems that security teams believe to be strongly isolated.
“Although exploitation requires high privileges, the impact is severe because it compromises virtualisation-based security itself. Attackers who already have a foothold could use this flaw to defeat advanced defenses, making prompt patching essential to maintain trust in Windows security boundaries,” he said.
“If the patch cannot be applied immediately, restrict administrative access, enforce strong privilege management, and monitor for abnormal activity involving VBS or enclave-related processes.”
Tech
‘The Last Airbender’ Leaked Online. Some Fans Say Paramount Deserves the Fallout
The online leak of a full version of Avatar: Aang, The Last Airbender—a highly anticipated animated film in a multimedia fantasy franchise—has divided passionate fans while upsetting those who spent years working on the film.
The leaks began on X late on Saturday night, about six months before Aang was scheduled to premiere on Paramount+. User @ImStillDissin posted two short clips from the film. “Nickelodeon accidentally emailed me the entire Avatar aang movie,” he claimed. He also threatened to stream the entire movie if Paramount didn’t release an official trailer, and he posted a still from the movie’s end credits, revealing previously undisclosed voice-over cast and roles. The media from @ImStillDissin’s posts were later hit with copyright strikes and removed.
But within 48 hours, links to download the full movie appeared on 4chan and X, where some users also directly streamed the film. Across the web, fans said they had successfully pirated and watched what appeared to be a nearly finished and “beautiful” animated film.
While some argued that Paramount deserved to be punished because of certain creative and marketing decisions around the movie, others noted what a blow the leak was to the animators and production crew. A number of those team members took to social media to convey their sadness and frustration.
“We worked on the aang movie for years with the expectation that’d [sic] we’d get to celebrate all of our hard work in theaters. Just to see people unceremoniously leak the film and pass our shots around on twitter like candy,” animator Julia Schoel wrote Tuesday on X.
The user behind @ImStillDissin, who would not reveal his real name due to fear of legal repercussions, tells WIRED that he obtained the movie almost by chance and did not expect his posts to set off such a crisis in the entertainment world. “When I posted those clips I was purely trolling,” he says. “I was expecting a day of clout farming at best, not for the whole thing to blow up like this.”
(While WIRED has done its due diligence in verifying that the person speaking to us was behind the @ImStillDissin X account, we acknowledge that the hacking community is known to troll.)
According to @ImStillDissin, a screen-grabbed version of Avatar: Aang, The Last Airbender was circulating among people he knew from his days in the hacking community, one of whom shared it with him. “Broadly speaking, the supply chain for movies and TV is rife with insecure companies and vendors and lax checks,” he claims. He notes that two different SpongeBob SquarePants movies leaked months before their release dates in 2024. “Someone on 4chan who wasn’t happy at me drip-feeding stuff posted a copy of a draft script [of the new Avatar film] from like two years back,” says @ImStillDissin.
Neither Nickelodeon nor its parent company Paramount have confirmed a hack had taken place, nor have they issued a statement on the matter. They also did not respond to requests for comment.
Originally announced in 2021, Avatar: Aang, The Last Airbender marked the first production for Avatar Studios, a division of Nickelodeon’s animation department.
Some people felt justified in pirating and sharing the movie due to the recasting of voice actors. Last year, during a Reddit AMA, casting director Jenny Jue wrote that the voice cast from the Avatar TV show that aired on Nickelodeon in the 2000s was not returning due to efforts to “match actors’ ethnic/racial background to the characters they’re portraying.”
Tech
NASA Wants to Put Nuclear Reactors on the Moon
Having demonstrated that it has the operational capability to transport humans safely to the moon and back, the United States is moving on to its next major aim: It wants nuclear reactors in orbit and on the lunar surface by 2030. For such a feat, the National Aeronautics and Space Administration will have to work in conjunction with the Department of Defense and the Department of Energy.
In a post on X, the White House Office of Science and Technology Policy (OSTP) unveiled a document with new guidelines for federal agencies to establish the space nuclear technology road map for the coming years. This, they say, will ensure “US space superiority.”
At present, space instruments use solar power to operate. However, this is considered impractical for more complex purposes. Although technically there is always sunlight, the power is intermittent and almost always requires bulky batteries to store it.
Reactors produce fairly continuous energy for years through nuclear fission. They can also be used for so-called nuclear electric propulsion. Continuous output makes them the most viable option for lunar base subsistence, but they can also allow spacecraft to undertake long or complex missions without worrying about depleting a limited supply of chemical fuel.
Nuclear technology, in short, makes it possible to go farther, with more payload, for longer, and with fewer constraints.
According to the memorandum, the US goal is to put a medium-power reactor in orbit by 2028, with a variant designed for nuclear electric propulsion, and a first functional large reactor on the surface of the moon by 2030. To achieve this, both NASA and the Pentagon will develop energy technologies in parallel, using the current strategy of competition among contractors.
The reactors will have to be modular and scalable, and will have to include applications for both future life on the moon and space propulsion. For its part, the DOE will have to ensure that these projects have the fuel, infrastructure, and safety features necessary to achieve their objectives. In addition, the agency will evaluate whether the industry has the capacity to produce up to four reactors in five years.
The plan contemplates technologies that produce at least 20 kilowatts of electricity (kWe) for three years in orbit and at least five years on the lunar surface. In the meantime, they should have a design capable of raising power to 100 kWe. The first designs should arrive within a year.
Finally, the order tasks the OSTP with creating a road map for the initiative, noting obstacles and recommendations for addressing them.
“Nuclear power in space will give us the sustained electricity, heating, and propulsion essential to a permanent presence on the moon, Mars, and beyond,” OSTP posted. For his part, NASA administrator Jared Isaacman posted, “The time has come for America to get underway on nuclear power in space.” The message was followed by an emoji of a US flag.
The plan provides a common framework for each agency to work within. In the background, the race for space infrastructure is evidence of technological competition with China, which is also seeking advanced energy capabilities for the moon.
This story originally appeared in WIRED en Español and has been translated from Spanish.
Tech
AI Could Democratize One of Tech’s Most Valuable Resources
Nvidia is the undisputed king of AI chips. But thanks to the AI it helped build, the champ could soon face growing competition.
Modern AI runs on Nvidia designs, a dynamic that has propelled the company to a market cap of well over $4 trillion. Each new generation of Nvidia chip allows companies to train more powerful AI models using hundreds or thousands of processors networked together inside vast data centers. One reason for Nvidia’s success is that it provides software to help program each new generation of chip. That may soon not be such a differentiated skill.
A startup called Wafer is training AI models to do one of the most difficult and important jobs in AI—optimizing code so that it runs as efficiently as possible on a particular silicon chip.
Emilio Andere, cofounder and CEO of Wafer, says the company performs reinforcement learning on open source models to teach them to write kernel code, or software that interacts directly with hardware in an operating system. Andere says Wafer also adds “agentic harnesses” to existing coding models like Anthropic’s Claude and OpenAI’s GPT to soup up their ability to write code that runs directly on chips.
Many prominent tech companies now have their own chips. Apple and others have for years used custom silicon to improve the performance and the efficiency of software running on laptops, tablets, and smartphones. At the other end of the scale, companies like Google and Amazon mint their own silicon to improve the performance of their cloud-computing platforms. Meta recently said it would deploy 1 gigawatt of compute capacity with a new chip developed with Broadcom. Deploying custom silicon also involves writing a lot of code so that it runs smoothly and efficiently on the new processor.
Wafer is working with companies including AMD and Amazon to help optimize software to run efficiently on their hardware. The startup has so far raised $4 million in seed funding from Google’s Jeff Dean, Wojciech Zaremba of OpenAI, and others.
Andere believes that his company’s AI-led approach has the potential to challenge Nvidia’s dominance. A number of high-end chips now offer similar raw floating point performance—a key industry benchmark of a chip’s ability to perform simple calculations—to Nvidia’s best silicon.
“The best AMD hardware, the best [Amazon] Trainium hardware, the best [Google] TPUs, give you the same theoretical flops to Nvidia GPUs,” Andere told me recently. “We want to maximize intelligence per watt.”
Performance engineers with the skill needed to optimize code to run reliably and efficiently on these chips are expensive and in high demand, Andere says, while Nvidia’s software ecosystem makes it easier to write and maintain code for its chips. That makes it hard for even the biggest tech companies to go it alone.
When Anthropic partnered with Amazon to build its AI models on Trainium, for instance, it had to rewrite its model’s code from scratch to make it run as efficiently as possible on the hardware, Andere says.
Of course, Anthropic’s Claude is now one of many AI models that are now superhuman at writing code. So Andere reckons it may not be long before AI starts consuming Nvidia software advantage.
“The moat lives in the programmability of the chip,” Andere says in reference to the libraries and software tools that make it easier to optimize code for Nvidia hardware. “I think it’s time to start rethinking whether that’s actually a strong moat.”
Besides making it easier to optimize code for different silicon, AI may soon make it easier to design chips themselves. Ricursive Intelligence, a startup founded by two ex-Google engineers, Azalia Mirhoseini and Anna Goldie, is developing new ways to design computer chips with artificial intelligence. If its technology takes off, a lot more companies could branch into chip design, creating custom silicon that runs their software more efficiently.
-
Fashion1 week agoIndia’s exports face reset as EU links trade to carbon metrics: EY
-
Entertainment1 week agoLamar Odom shocking response to Khloé Kardashian account of his overdose
-
Entertainment1 week agoQueen Elizabeth II emotional message for Archie, Lilibet sparks speculation
-
Tech1 week agoAzure customers up in arms over ‘full’ UK South region | Computer Weekly
-
Tech1 week agoAs the Strait of Hormuz Reopens, Global Shipping Will Take Months to Recover
-
Fashion1 week agoCII submits 20-pt agenda to Indian govt to back firms hit by Iran war
-
Tech7 days agoThis AI Button Wearable From Ex-Apple Engineers Looks Like an iPod Shuffle
-
Politics6 days agoIndian airlines hit hardest after Dubai limits foreign flights until May 31
