Tech
Microsoft users warned over privilege elevation flaw | Computer Weekly
Microsoft marked the penultimate Patch Tuesday of 2025 with an update lighter than of late, addressing a mere 63 common vulnerabilities and exposures (CVEs) across its product estate – a far cry from many of its recent drops averaging well over 100 – and a solitary zero-day flaw.
Tracked as CVE-2025-62215, this month’s single zero-day is an elevation of privilege (EoP) vulnerability in the Windows Kernel that sits at the core of Microsoft’s operating system. It carries a CVSS score of just 7.0, and is not rated critical in its severity, however, exploitation has been observed in the wild, although no public proof-of-concept has yet been released.
Ben McCarthy, lead cyber security engineer at Immersive, explained that the root cause of the issue stems from two combined weaknesses one a race condition in which more than one process tries to access shared data and change it concurrently, the other a double free memory management error.
“An attacker with low-privilege local access can run a specially crafted application that repeatedly attempts to trigger this race condition,” he explained. “The goal is to get multiple threads to interact with a shared kernel resource in an unsynchronised way, confusing the kernel’s memory management and causing it to free the same memory block twice.
“This successful double-free corrupts the kernel heap, allowing the attacker to overwrite memory and hijack the system’s execution flow.”
McCarthy added: “Organisations must prioritise applying the patch for this vulnerability. While a 7.0 CVSS score might not always top a patch list, the active exploitation status makes it a critical priority. A successful exploit grants the attacker System privileges, allowing them to completely bypass endpoint security, steal credentials, install rootkits, and perform other malicious actions. This is a critical link in an attacker’s post-exploitation playbook.”
In the real world, said Mike Walters, president and co-founder of Action1, there are three core business impacts that would potentially arise from a successful compromise via CVE-2025-62215. Walters highlighted the possibility of mass credential exposure arising from the compromise of critical file servers, lateral movement and ransomware deployment, and regulatory, financial and reputational harm from data leakage or other operational disruption.
“Exploitation is complex,” he noted, “but a functional exploit seen in the wild raises urgency, since skilled actors can reliably weaponise this in targeted campaigns.”
Also high on the agenda for November is CVE-2025-60724 an RCE vulnerability in Graphics Device Interface Plus (GDI+), which carries a CVSS score of 9.8. GDI+ is a relatively low-level component but is responsible for rendering 2D graphics, images and text and therefore provides core functionality multiple Microsoft applications – and countless third-party programs, too.
Adam Barnett, Rapid7 lead software engineer, said this was as close to a zero-day as it was possible to get and likely to affect just about every asset running Microsoft software.
“In the worst-case scenario, an attacker could exploit this vulnerability by uploading a malicious document to a vulnerable web service,” he said.
“The advisory doesn’t spell out the context of code execution, but if all the stars align for the attacker, the prize could be remote code execution as System via the network without any need for an existing foothold. While this vuln almost certainly isn’t wormable, it’s clearly very serious and is surely a top priority for just about anyone considering how to approach this month’s patches.”
Action1’s Walters added: “This is emergency-level: a network-reachable RCE with no user interaction and low attack complexity is among the most dangerous bugs. Server compromise, tenant impact in multi-tenant systems, and the potential for rapid mass exploitation make this a top priority.
“Exploitation may take time to perfect because attackers must build reliable allocator and interpreter manipulations that bypass mitigations like CFG, ASLR, and DEP. Still, GDI+ and image parsing bugs have a history of being weaponised quickly.”
Critically acclaimed bugs
Finally, the docket for security teams this month includes four critical vulnerabilities, highlighted by Dustin Childs of Trend Micro’s Zero Day Initiative (ZDI). These are CVE-2025-30398, a third-party information disclosure flaw in Nuance PowerScribe 360; CVE-2025-60716, an EoP flaw in DirectX Graphics Kernel; CVE-2025-62199, an RCE flaw in Microsoft Office; and CVE-2025-62214, another RCE flaw in Visual Studio.
Tech
6 Great After-Christmas Deals to Spend Your Gift Cards On
After-Christmas deals are an excellent way to redeem any gift cards or cash you got for Christmas. You can purchase something you actually want, and you can do it for less money than usual. I’ve scoured the Internet for truly good after-Christmas deals on the gear that we’ve hand-tested on the WIRED Reviews team. Many of these sales will end this weekend, so keep that in mind while you’re shopping. Find all the highlights below.
For more inspiration, check out some of our recently updated buying guides, including the Best Office Chairs, the Best Cheap Phones, and the Best Space Heaters.
WIRED Featured Deals:
Anker Laptop Power Bank for $88 ($47 off)
We love this beefy power bank. Its 25,000-mAh capacity is more than enough for fully charging your iPhone between 4 and 6 times, and it can deliver up to 165 watts to two devices meaning that you can charge your laptop, gaming console, or anything else you fancy. The built-in USB-C cable doubles as a carrying loop. There’s also a nifty display that’ll give you at-a-glance information on remaining battery, temperature, charging speeds, and more. It has pass-through charging support and only takes about two hours to fully recharge. This deal price matches what we saw on Black Friday.
Google Pixel 10 for $599 ($200 off)
There was an on-page coupon (PIXEL10) that had the best price we’ve tracked for any of the phones in the Google Pixel 10 lineup. That coupon is not available as of Saturday morning, but it may be back—clip it if you see it. This is still a good deal on the smartest Android phones you can buy, with fantastic cameras, snappy processors, gorgeous displays, and more AI integration than the average person needs. Check out our dedicated buying guide to figure out which Google Pixel 10 is right for you. If you’re in the market for an upgrade, now is a good time to buy considering that we’ve never seen any phone in this flagship lineup sell for less.
Bruvi BV-01 Brewer Bundle for $228 ($120 off)—Clip the Coupon
I’ve tested a lot of pod coffee makers, and the Bruvi BV-01 is my favorite. This deal price is the best we see outside of special events like Black Friday and Cyber Monday. The brewer is cute and looks great on a counter, with a large reservoir, an intuitive touchscreen display, and a built-in wastebin that collects used pods for you. The best part are the proprietary B-Pods, which are designed to biodegrade in a landfill. The bundle gets you the machine plus an assortment of bestselling coffee and espresso pods to get you started.
Fitbit Charge 6 for $100 ($60 off)
The Fitbit Charge 6 has been at the top of our fitness tracker buying guide since we first tested it. It’s attractive, affordable, accessible, and on sale for a match of the best deal we’ve seen. It’ll play well with iOS and Android, and it has a solid suite of features that’ll cover almost anyone’s needs—including skin temperature, heart rate readings, ECGs, activity and workout tracking, and more. The battery lasts for at least a week on a single charge. This deal comes with a six-month subscription to Fitbit Premium, which normally costs $10 per month.
Hydro Flask Standard Mouth Water Bottle for $30 ($10 off)
This budget-friendly deal gets you a steal on the best reusable water bottle. Hydro Flask bottles are durable, portable, and easy to cover in all the stickers you’ve been hoarding. The handle is flexible, the bottle is leakproof, and every component is dishwasher safe (though you may want to opt for hand-washing if you do end up plastering it in stickers). A few different colors are on sale at this price.
Beats Powerbeats Pro 2 for $200 ($50 off)
If hitting the gym is one of your New Year’s resolutions for 2026, the Beats Powerbeats Pro 2 are worth considering. They’re the best workout headphones we’ve tested thanks to their comfortable and ergonomic fit, noise cancelation, spatial audio, a heart rate monitor, and the fact that they play well with both iOS and Android phones. The sound is solid, the battery life is good, and they’re water-resistant. This deal price comes within $20 of the best we’ve seen. Every color—orange, lavender, grey, and black—is on sale.
Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.
Tech
Hyperkin’s Competitor Upgrades the Xbox Controller by Copying Sony’s Design
The most immediately striking difference is that Hyperkin’s product swaps the typical Xbox approach of asymmetric thumbsticks for the PlayStation’s horizontal layout. It also separates the D-pad (it’s one piece inside the pad, but splits its cardinal directions so each appears to be its own button), while the ABXY face buttons are spaced slightly further apart. Where the DualSense’s touchpad would sit, we have the Xbox home, menu, view, and share buttons, all blended in rather smartly. An LED ring around the home button just about echoes the lights running the periphery of the DualSense’s touchpad, although it’s really more of an inversion of the regular Xbox controller, where the home button itself lights up.
The Competitor’s thumbsticks come equipped with thumbcaps that mirror the PS5’s, an outer ring with a convex central point, but a pair of Xbox-standard concave caps are included. These easily pop on and off, and can be mixed and matched, if you were so (strangely) inclined.
There are two areas where this departs from both the standard Xbox and PlayStation controllers in terms of inputs. The first is the presence of two programmable rear buttons, M1 and M2. By default, these duplicate the input of the A and B buttons, but holding down the Mode button between them lets you remap them. There are also physical button locks to prevent their use entirely. The other is that while the Competitor boasts a 3.5-mm headphone jack like Microsoft’s official pad, it adds a built-in audio mute button, hidden in the black between the thumbsticks—a nice little upgrade.
Oddly Familiar
In use, the Competitor feels … well, a lot like a PS5 pad. The slightly wider grip fits in the hand comfortably, all inputs are accessible, and those symmetrical thumbsticks sit nicely in reach for all but the smallest hands. A microtextured underside provides a solid grip that, when coupled with its 232-gram weight, makes the Competitor feel particularly suited to longer play periods. It’s all very familiar if you’re already a multiformat gamer, to the extent that it sometimes slightly threw my muscle memory off, reaching a thumb out to do a PlayStation touchpad function and finding only the Xbox system buttons.
Photograph: Matt Kamen
Tech
In Cryptoland, Memecoin Fever Gives Way to a Stablecoin Boom
When US president Donald Trump launched his own meme cryptocurrency on January 17, days before his return to the White House, I was halfway up a Swiss alp, attending a crypto conference in the town of St. Moritz.
Memecoins, which typically have no purpose beyond financial speculation, were having a moment. The previous year, millions of new memecoins had flooded the market; a few, like Fartcoin, had rocketed to billion-dollar valuations. Pump.Fun, a platform for launching and trading memecoins, had become one of the fastest-growing crypto launchpad businesses ever. Now, the soon-to-be president was getting in on the act.
Over lunch on the second day of the conference, beneath the ornate stucco ceiling and golden chandeliers of the venue’s dining hall, I located a table designated for a conversation about memecoins. Whereas other tables were half full, the memecoin workshop was oversubscribed; latecomers pulled up chairs to create two full rows.
The discussion was led by Nagendra Bharatula, founder of investment firm G-20 Group. Bharatula had recently coauthored a paper arguing that memecoins, despite their juvenile spirit, had a place in professional investors’ portfolios. In the six months prior, a basket of 25 “bluechip memecoins”—an oxymoron if ever there was one—had outperformed bitcoin by 150 percent, he pointed out. Some of the attendees murmured their approval.
Since then, the shine has come off the memecoin market. The paper value of Trump’s coin, which climbed to a peak of $14 billion two days after its launch, has cratered to roughly $1 billion. Hundreds of thousands of small investors lost their shirts. Pump.Fun’s daily revenue, a proxy for the overall appetite for memecoin trading, is barely more than a tenth of what it was in January. The memecoin gold rush has spawned a raft of litigation.
Next up: the stablecoin. If memecoins are symbolic of reckless abandon and unflinching profiteering in cryptoland, stablecoins are a symbol of the industry’s search for purpose and respectability. Designed to hold a steady $1 valuation, stablecoins are pitched by proponents as a faster and cheaper way to make everyday payments and international money transfers.
In a year in which the US has declared itself open for crypto business, where previously crypto firms feared regulatory backlash under the Biden administration, stablecoins have supplanted memecoins as the coin à la mode—and punctured the mainstream.
Though stablecoins have been around since 2014, they have predominantly been used by crypto traders as a safe harbor during bouts of market volatility, not by regular people. The concept has also faced resistance from regulators skeptical of a new form of money; Diem, a stablecoin venture incubated at Meta, famously shuttered in 2022 in the face of broad-based opposition.
-
Sports1 week ago
Alabama turned Oklahoma’s College Football Playoff dream into a nightmare
-
Entertainment1 week agoRare look inside the secret LEGO Museum reveals the system behind a toy giant’s remarkable longevity
-
Business1 week agoGold prices in Pakistan Today – December 20, 2025 | The Express Tribune
-
Business1 week agoRome: Tourists to face €2 fee to get near Trevi Fountain
-
Entertainment1 week agoIndia drops Shubman Gill from T20 World Cup squad
-
Entertainment1 week agoZoe Kravitz teases fans with ring in wedding finger
-
Tech1 week agoWe Tried and Tested the Best Gifts for Plant Lovers With Our Own Green Thumbs
-
Fashion1 week agoColumbia launches star-studded US Curling team uniforms for 2026


.png)






-Reviewer-Photo-SOURCE-Ryan-Waniata.jpg)