🧰 Windows 11

The items that name it 10

• Post-quantum authentication: Why organizations should start testing certificate ecosystems now
  article2026-10-08

  Supported and appropriately configured systems can evaluate ML-DSA certificates in the pilot's controlled, non-production testing scenarios; support begins with the July 28, 2026 updates

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeup2026-09-28

  NCSI runs under Network List Service (netprofm), implemented in ncsi.dll

• Pass-the-Passkey Family of Attacks
  writeup2026-09-16

  Writes complete WebAuthn assertions to a Windows Event Log readable by unprivileged local and remote users, turning a phishing-resistant credential into a replayable secret. Patched by Microsoft in July 2026.

• CrystalPotato
  repo2026-08-27

  affected by SeImpersonatePrivilege local privilege escalation via CrystalPotato

• nikaiw/VMkatz
  repo2026-05-22

  target OS for credential extraction

• PathSentinel Radar
  tool2026-05-16
• Bullying LLMs
  writeup2026-05-13

  used for binary diffing between Patch Tuesdays

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeup2026-03-23

  Versions 24H2 (OS/10.0.26200), 23H2 (OS/10.0.26100), 22H2 (OS/10.0.22631) reflected in spoofed user agent strings

• Local administrator account remote logon in Windows
  writeup2026-01-31

  target workstation DESKTOP-5TJUSRP, 192.168.10.128; RID 500 Administrator account disabled by default on install

• Dev Machine Guard Now Supports Windows - StepSecurity
  article

  Developer machines, now supported by Dev Machine Guard