·S3 E54

RoguePlanet: A SYSTEM-Level Wake-Up Call

July 12

31 mins

Episode Description

Episode 3x54: RoguePlanet: A SYSTEM-Level Wake-Up Call

Hosts: Professor CyberRisk & Cyber Cowboy

TOP STORY: RoguePlanet — Windows Defender Zero-Day (CVE-2026-50656)

Microsoft has patched a critical race condition in Windows Defender that allows attackers to escalate privileges to SYSTEM level on fully patched Windows 10 and 11 devices. Discovered by researcher Nightmare Eclipse, who published a proof-of-concept after Microsoft removed their repos from GitHub and GitLab. The exploit is probabilistic but works regardless of real-time protection status. The fix was delivered via Malware Protection Engine 1.1.26060.3008 on July 8. Every previous Nightmare Eclipse disclosure (RedSun, UnDefend, BlueHammer) has been weaponized in the wild.

Source: https://www.securityweek.com/microsoft-patches-defender-rogueplanet-vulnerability/

---

STORY 1: Injective SDK npm Supply-Chain Attack

Hackers compromised a legitimate Injective Labs contributor account to publish malicious npm package @injectivelabs/sdk-ts v1.20.21. The malware only activates when developers call wallet key functions — capturing mnemonic seed phrases and private keys, then exfiltrating them through legitimate Injective Labs infrastructure endpoints. The package had 50,000 weekly downloads and 87 dependent packages. Malicious version was downloaded 310 times before deprecation.

Source: https://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/

---

STORY 2: QIZ Security Raises $17M for Post-Quantum Readiness

QIZ Security announced a $17M seed round for its post-quantum cryptography readiness platform. The funding comes as a Trump executive order requires federal PQC migration by end of 2030 (accelerated from 2035). Most enterprises can't answer basic questions about their own cryptography — where algorithms are deployed, who owns keys, or what breaks during migration — leaving them vulnerable to "harvest now, decrypt later" attacks.

Source: https://siliconangle.com/2026/07/09/qiz-security-raises-17m-seed-round-post-quantum-readiness-platform/

---

STORY 3: Microsoft's AI-Driven Patch Tuesdays Getting Bigger

Microsoft announced heavy AI integration into its security update pipeline, resulting in larger, more comprehensive Patch Tuesday releases. AI will proactively identify vulnerabilities earlier in the development lifecycle, the Secure Development Lifecycle now accounts for AI-enabled attack techniques, and new agentic harnesses will automatically generate and validate security fixes. Expect more patches per month and increased testing overhead.

Source: https://www.theverge.com/tech/963307/microsoft-patch-tuesday-ai-security-updates

---

STORY 4: GigaWiper Sleeper Wiper

Microsoft detailed GigaWiper, a hybrid Windows backdoor combining code from FlockWiper, Crucio ransomware, and VNC-like remote access capabilities. Operators can keep it dormant for long-term surveillance before triggering irreversible damage — full disk wipe, targeted OS wipe, or fake ransomware with .candy extension using keys that are never saved. Persistence via "OneDrive Update" scheduled task. C2 uses RabbitMQ and Redis.

Source: https://hackread.com/microsoft-gigawiper-backdoor-destroy-windows-pcs/

---

RESOURCES & LINKS

• Bitdefender Threat Map: https://threatmap.bitdefender.com/

• Checkpoint Threat Map: https://threatmap.checkpoint.com/

• Kaspersky Cyber Threat Map: https://cybermap.kaspersky.com/

• Talos Intelligence Spam Map: https://talosintelligence.com/ebc_spam

• CVE-2026-50656 (RoguePlanet): https://www.securityweek.com/microsoft-patches-defender-rogueplanet-vulnerability/

---

STAY CONNECTED

• Website: https://www.youvealreadybeenhacked.com

• X: @professorcyberrisk