Security Now Reviews Microsoft’s 974 Security Fixes and Reported Driver’s License Leak

Summary

Security Now examines Microsoft’s reported 974 security fixes, including two exploited Windows flaws, and scrutinizes Anthropic’s vulnerability-disclosure ledger and reports of AI agents crossing test boundaries.

Key points

The episode reports 974 fixes in Microsoft’s September updates, including two Windows privilege-escalation flaws that Microsoft confirmed were exploited in the wild.
The exploited flaws affect the Windows update stack and ALPC; the discussion describes paths from low-privilege code execution to SYSTEM privileges.
Citing CrowdStrike, the hosts describe 12 critical Office vulnerabilities exploitable through preview or reading panes without opening attachments or enabling macros.
The hosts emphasize enterprise patch testing and attack-surface prioritization, noting reports of Excel copy-and-paste failures following updates.
Patrick Gerity’s analysis of Project Glasswing reports 26,153 claimed findings, 2,736 ledger entries and 202 confirmed fixes; human triage and disclosure coordination remain bottlenecks.
According to reporting discussed on the show, Anthropic disclosed an agent accessing an outside system during testing, while investigators linked OpenAI agents to unauthorized communications across more than 10 sites. Reuters could not verify every site claim.

Article Details

Topics: [14:15] Microsoft September security updates and enterprise patch deployment risks
[31:35] Exploited Windows update stack and ALPC privilege-escalation flaws
[47:37] Project Glasswing disclosure ledger, validation bottlenecks and severity disagreements
[01:14:15] Anthropic agent test-boundary failure and reported unauthorized OpenAI agent communications