[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv1EqL0I_cLiRfSlkYvVaxs6nh1x-J7TCnjd0B7HMqx0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"ad2cd298-a9f0-4a0c-842d-b5504e6c7501","Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave","four-byte-write-and-timing-bug-let-researchers-run-code-in-windows-smartscreen-e-0c18f2","Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of","Security researchers have successfully executed their own code within the Windows SmartScreen VBS enclave, a protected memory area designed to safeguard sensitive information. This enclave is crucial for protecting passwords and is part of Windows' anti-phishing capabilities. The researchers demonstrated this capability in a lab setting as a proof of concept, highlighting a significant security flaw.","Researchers bypass Windows SmartScreen enclave security to run code.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffour-byte-write-and-timing-bug-let.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEizNi7OCo6m5vsFkEP85LndyXnfiDgk2h5R0WwW_yHZ7mdK6Uh9xuLaI5ddFQJ45fW7jG8eC4VtIHJT1IQaUJCoAEMClMEiv9dA9kASwDQJj4l61ZSIlqW2bw605LQLL5kNUszoxI8Wkr54oguKY7guQGE9rwUmvzCVUjt19-0pWJpxir366NU5eqopHmk\u002Fs1600\u002Fenclave.jpg","2026-10-14T05:52:28+00:00","2026-10-14T08:00:13.912618+00:00",8,[17,20],{"name":18,"type":19},"Windows SmartScreen","product",{"name":21,"type":22},"VBS enclave","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[18],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":80,"name":81,"problem":82,"products":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[138],{"slug":85,"name":86,"logo_path":87,"roles":139},[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":155},"researchers-breach-windows-smartscreen-vbs-enclave-via-memory-write-and-timing-flaw","Researchers Breach Windows SmartScreen VBS Enclave via Memory Write and Timing Flaw","A four-byte memory write vulnerability combined with a timing bug allowed security researchers to execute arbitrary code inside the Windows SmartScreen Virtualization-Based Security (VBS) enclave — a protected region specifically designed to isolate sensitive credentials and anti-phishing logic. This is significant because VBS enclaves are considered a hardened trust boundary; breaching one undermines a core security assumption of Windows' defense-in-depth architecture. Attackers who replicate this technique in the wild could potentially extract protected passwords or disable phishing protections silently. The lab-based proof of concept demonstrates that even hardware-assisted isolation is not immune to software-level logic flaws. Organizations relying on Windows Credential Guard and SmartScreen as compensating controls must treat this as an urgent patching priority.",[146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 AC-25: Reference Monitor","NIST SP 800-190: Application Container Security (isolation principles)","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1006: Direct Volume Access","ITIL Change Management: Emergency Change Procedures",{}]