Google and Mozilla Release Chrome and Firefox Updates Fixing Over 180 Vulnerabilities

SignDrop Zero-Day Exploit Abuses Windows CLFS Mitigation for SYSTEM Privileges

Security researcher Abdelhamid Naceri has publicly released a new Windows zero-day exploit named SignDrop that grants attackers SYSTEM-level privileges on vulnerable systems. The flaw stems from mitigations Microsoft introduced in October 2025 to address authentication attacks against the Common Log File System (CLFS) driver. Although the mitigation was intended to reduce CLFS-related exploits, its implementation introduced a logic flaw allowing privileged processes such as Windows Defender to be tricked into creating authentication files with SYSTEM permissions. Naceri demonstrated that the technique works against any antimalware engine's tamper protection because file creation requests appear to originate from the engine's own legitimate process. The exploit has been tested successfully on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, with an estimated 80 percent of Windows installations remaining vulnerable. No official patch is currently available, and disabling the mitigation would re-expose systems to prior memory corruption attacks in CLFS.

Citrix Patches 12 Critical NetScaler and Secure Access Client Flaws Including Authentication Bypass and Multiple DoS Issues

Citrix has released security updates addressing 12 vulnerabilities across NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client products. Nine of the flaws affect NetScaler ADC and Gateway deployments and carry CVSS scores of 9.3 or higher, primarily involving memory overflow and corruption issues that can result in denial-of-service conditions or unpredictable system behavior. One vulnerability in NetScaler Console allows unauthenticated attackers to bypass authentication controls entirely. Two additional privilege escalation flaws impact the Secure Access Client on Windows and Linux platforms. All issues have been resolved in specific updated releases, and Citrix reports no known exploitation in the wild at the time of disclosure. The company attributed the discoveries to an expanded use of AI-assisted code analysis during its internal review process.

Apache Patches Critical HTTP Server RCE Vulnerability CVE-2026-119618 Discovered by Anthropic and Google

Apache has released version 2.4.71 to address a critical remote code execution flaw in the HTTP Server affecting versions 2.4.55 through 2.4.70. The vulnerability, tracked as CVE-2026-119618, resides in the mod_http2 module and stems from a race condition that allows multiple threads to corrupt shared memory resources. Researchers from Anthropic and Google independently identified the issue, which carries a CVSS score of 9.8 from Red Hat and enables unauthenticated attackers to execute arbitrary commands on affected systems with HTTP/2 enabled. Wiz reported that 64 percent of scanned cloud environments run vulnerable Apache versions, with 51 percent exposing instances publicly. While no in-the-wild exploitation has been confirmed, a public proof-of-concept demonstrates memory corruption and process crashes. The update also resolves two additional flaws: CVE-2026-106023 and CVE-2026-109163.