The newly discovered Spirals ransomware, written in Rust, utilizes a rapid attack timeline to move from initial breach to full network encryption in less than a day. Attackers gain entry by compromising internet-facing IIS web servers to deploy web shells and establish interactive sessions through the IIS worker process. Once inside, the threat actors escalate privileges by bypassing User Account Control and enabling the Remote Desktop Protocol for persistent access.

Source

Microsoft has issued a formal 90-day reminder that mainstream support for Windows Server 2022 will conclude on October 13, 2026. After this date, the operating system enters an extended support phase that is scheduled to last until October 14, 2031. During this five-year period, the vendor will continue to provide critical security patches at no additional cost to customers.

Source

Microsoft's Windows Server vNext preview program has introduced three significant features since build 29531, released on February 12, 2026: boot support for the Resilient File System (ReFS), a built-in NVMe-over-Fabrics (NVMe-oF) initiator for high-performance network storage, and Quick Machine Recovery (QMR) for automated recovery from boot failures. Build 29621, released July 13, 2026, adds an early implementation of Trusted Launch for Hyper-V virtual machines. This article covers what each feature does, its requirements, and its current limitations.

Source

Windows Server Insider Build 29621 introduces Trusted Launch for Generation 2 virtual machines to bolster security during the boot process. This feature automatically enables Secure Boot and provisions a virtual Trusted Platform Module (vTPM) to defend against firmware-level attacks. The vTPM state is specifically protected at rest, ensuring that sensitive cryptographic data remains secure even when the virtual machine is not running.

Source

Microsoft’s July 2026 Patch Tuesday has set a new record by addressing 570 vulnerabilities, nearly tripling the volume of previous monthly releases. This massive surge is attributed to the implementation of a new AI-powered vulnerability discovery system designed to scan the Windows codebase for flaws. The release includes 60 critical vulnerabilities, primarily focusing on remote code execution and elevation of privilege issues across Windows, Office, and SharePoint.

Source

A security researcher has released a proof-of-concept exploit named LegacyHive that targets the Windows User Profile Service (ProfSvc). This vulnerability allows for local elevation of privileges by forcing the system-level service to load arbitrary registry hives. The exploit remains functional on all currently supported versions of Windows desktop and server, even after applying the July 2026 Patch Tuesday updates.

Source

Microsoft has launched its July 2026 security updates for Exchange Server, providing critical fixes for the Subscription Edition (SE) and legacy on-premises versions. The release addresses several high-severity vulnerabilities, including a critical spoofing flaw (CVE-2026-55008) with a CVSS score of 9.6 and a remote code execution bug. While the update for Exchange SE is publicly available, updates for Exchange 2016 and 2019 are restricted to organizations enrolled in the Period 2 Extended Security Update (ESU) program.

Source

A threat actor recently utilized an AI-generated PowerShell script to conduct reconnaissance within a compromised Active Directory environment. The intrusion began after the attacker gained access to a domain-joined Windows Server via Remote Desktop Protocol using previously stolen credentials. Once inside, the intruder staged tools in the ProgramData directory and executed a script designed to map users, groups, and domain controllers.

Source

Microsoft Threat Intelligence has identified GigaWiper, a sophisticated Golang-based backdoor that integrates components from three distinct malware families. This modular implant combines command-and-control capabilities with destructive payloads, including physical disk wiping and fake ransomware routines. By consolidating tools like Crucio and FlockWiper, threat actors can switch between stealthy espionage and immediate system sabotage within a single deployment.

Source

Microsoft prolonge d'un an le Hotpatching de Windows Server 2022 Datacenter: Azure Edition, jusqu'en octobre 2027. À une condition près.

Le post Windows Server 2022 : le Hotpatching prolongé jusqu’en octobre 2027 a été publié sur IT-Connect.

Découvrez comment activer et configurer DNS-over-HTTPS (DoH) sur un serveur DNS Windows Server 2025, avec la gestion du certificat, pour chiffrer les flux DNS.

Le post Windows Server 2025 : comment configurer le DNS-over-HTTPS sur le serveur DNS ? a été publié sur IT-Connect.

Superviser Windows sans installation de logiciels : découvrez PS-MRTG et d'autres outils PowerShell autonomes, accessibles via le navigateur, même en air‑gap.

Le post Superviser un serveur Windows verrouillé sans rien installer : l’approche d’Eric Guiffault en PowerShell a été publié sur IT-Connect.

Microsoft a mis en ligne les mises à jour de juin 2026 pour les machines sous Windows Server : KB5094125, KB5094128, etc.... Voici les nouveautés.

Le post Le point sur les mises à jour de juin 2026 pour Windows Server a été publié sur IT-Connect.

Cet article explique comment utiliser PowerBgInfo pour afficher l'état du système sur le fond d'écran des machines Windows et Windows Server via PowerShell.

Le post PowerBgInfo : personnalisez le fond d’écran des serveurs avec PowerShell a été publié sur IT-Connect.

Le CCB a publié une alerte à propos de la CVE-2026-41089, une faille présente dans le service Netlogon de Windows Server : elle est exploitée par les pirates.

Le post Windows Server – CVE-2026-41089 : cette faille critique dans Netlogon est exploitée ! a été publié sur IT-Connect.

Suite à l’installation de la mise à jour KB5087537 sur Windows Server 2016, la recherche et la découverte des contrôleurs de domaine AD peuvent échouer.

Le post Un bug surprenant affecte Windows Server 2016 suite aux correctifs de mai 2026 a été publié sur IT-Connect.

Dans cet article, nous verrons ensemble comment installer un serveur SFTP sur Windows Server. J’utiliserai ici Windows Serveur 2022 mais vous pouvez faire de même sur les versions précédentes. Nous utiliserons ici le logiciel open source OpenSSH pour réaliser cette tâche. Pourquoi utiliser un serveur SFTP ? Un serveur SFTP est un moyen sécurisé et …