Light

Episode #1075 Quiz

Yes. Exactly.
Date: 2026-04-21 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

This Security Now! episode details a Windows Defender zero-day exploit, RedSun, enabling SYSTEM privileges via a file rewrite flaw, unpatched except BlueHammer, actively exploited after public PoC release by a disgruntled researcher.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific vulnerability does the 'RedSun' exploit abuse to gain SYSTEM privileges on Windows systems, even after April 2026 updates?

Question 1

What specific vulnerability does the 'RedSun' exploit abuse to gain SYSTEM privileges on Windows systems, even after April 2026 updates?

An unpatched flaw in Windows Update service that allows remote code execution during updates. The Windows Defender Cloud Files API rewriting system files using a cloud tag detection mechanism. A buffer overflow in the Windows kernel's network stack unrelated to Defender functionality. A privilege escalation via Windows Firewall misconfiguration allowing local users SYSTEM access.

Question 2: Why did Microsoft suspend developer accounts for kernel driver publishing, and what issue arose from this action?

Question 2

Why did Microsoft suspend developer accounts for kernel driver publishing, and what issue arose from this action?

As a policy to encourage third-party security audits; all affected developers had submitted audits beforehand. Due to detected malware in developer code; Microsoft warned developers before suspension. Because of unpaid developer fees; most developers easily reached human support to appeal. For failure to complete identity verification; many developers claimed no prior notification was received.

Question 3: What critical problem arises from software that phones home for updates when its parent company goes out of business, as exemplified by Dragon Boss Solutions LLC's product?

Question 3

What critical problem arises from software that phones home for updates when its parent company goes out of business, as exemplified by Dragon Boss Solutions LLC's product?

Automatically disables all antivirus software permanently across all systems worldwide. Legacy software self-updates continuously preventing any removal by end-users without special tools. Software automatically transfers user data to new owners without consent after domain expiry. Expired domains can be re-registered by attackers, enabling push of malicious payloads to infected hosts.

Question 4: According to the Cloud Security Alliance paper on Mythos and AI-driven vulnerability, what is the expected impact on patching and responses in cybersecurity?

Question 4

According to the Cloud Security Alliance paper on Mythos and AI-driven vulnerability, what is the expected impact on patching and responses in cybersecurity?

Security organizations will be overwhelmed with a rapidly increasing volume of vulnerabilities and complex attacks, requiring faster patch response times. AI will eliminate the need for patching by preventing vulnerabilities from occurring in the first place. Cybersecurity risks will reduce as AI automates incident response completely, removing human intervention. Attackers' speed will decrease due to AI creating more false positives, giving defenders an advantage.

Question 5: What is the proposed future solution discussed for securing open source repositories against undetected malicious code?

Question 5

What is the proposed future solution discussed for securing open source repositories against undetected malicious code?

Only allowing code from well-known, pre-approved developers to be published, excluding newcomers. Abandoning version pinning and hash checking in favor of weekly forced code rebuilds to detect tampering. Using AI agents as automatic auditors to analyze and sign code before release, analogous to LetsEncrypt for SSL certificates. Mandating manual code reviews by human security experts before repository acceptance, scaled globally.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.