Loading story…
Akamai researchers have developed an AI-driven tool, PatchDiff-AI, designed to automate the root cause analysis of vulnerabilities patched during Microsoft's regular Patch Tuesday updates. This system leverages large language models in a multi-agent configuration to rapidly analyze patched binaries, identify the underlying security flaws, and generate detailed reports, including attack vector analysis and exploitability. The tool demonstrated over 80% success in fully automated report generation, significantly accelerating the defensive response to newly disclosed vulnerabilities.
A recent case study applied PatchDiff-AI to CVE-2025-60719, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) for Winsock, which affects nearly all supported Windows versions. The flaw allows local privilege escalation by enabling a low-privilege attacker to manipulate kernel memory and gain system privileges. Microsoft addressed the issue by introducing a synchronization barrier to prevent unsafe unbinding of socket endpoints during critical operations. The research and tool were presented at Black Hat Europe Arsenal, highlighting the growing role of AI in vulnerability analysis and mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Akamai disclosed PatchDiff-AI, a multi-agent LLM-based system designed to automate root cause analysis of Microsoft Patch Tuesday vulnerabilities. The research reported strong accuracy across identifying patched executables, vulnerable functions, and root causes, and highlighted case studies including CVE-2025-24991 and CVE-2025-32713.
Akamai researchers published a technical analysis of CVE-2025-60719, explaining that a race condition in afd.sys can be triggered via racing IOCTL calls and may require heap spraying for reliable exploitation. The company also advised defenders to apply the patch, monitor for suspicious IOCTL activity, and use detection rules such as YARA.
Microsoft addressed CVE-2025-60719, a critical use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys), by adding synchronization barriers to prevent socket endpoints from being unbound during critical operations. The flaw could allow a local low-privilege attacker to escalate to SYSTEM privileges on many supported and unsupported Windows versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026
Researchers from Calif disclosed a local privilege-escalation exploit against Apple systems using **M5** silicon that reportedly bypasses the chip’s **Memory Integrity Enforcement (MIE)** protections and grants a root shell on **macOS 26.4.1** from an unprivileged user context. The team said Anthropic’s **Mythos Preview** helped chain two previously unknown bugs and other techniques into a working exploit in five days, using only standard system calls. Apple was reportedly notified in advance and is working on a fix. The finding is significant because MIE was introduced to harden M5 and A19 devices against memory-corruption attacks such as buffer overflows and use-after-free flaws. Microsoft separately detailed **MDASH**, an internal AI-driven vulnerability discovery platform that coordinates more than 100 specialized agents and has already found **16 previously unknown vulnerabilities** in Windows networking and authentication components. Four of those flaws, including critical remote code execution bugs in `tcpip.sys` and the **IKEv2** service, were patched in the latest Patch Tuesday release. Microsoft said MDASH also identified issues in **IPsec** and **Netlogon**, including vulnerabilities reachable over the network without credentials, and described the system as a production-grade defensive capability now in internal use and limited private preview.
Jul 27, 2026
Microsoft disclosed and fixed multiple elevation-of-privilege vulnerabilities in the **Windows Ancillary Function Driver for WinSock (AFD.sys)**, including **`CVE-2026-34344`** and **`CVE-2026-34345`**, which could allow a low-privileged local attacker to gain **SYSTEM** privileges. `CVE-2026-34344` is a **type confusion** issue tracked as **CWE-843** with a **CVSS 7.8** rating, while `CVE-2026-34345` involves a **race condition** and **use-after-free** weakness tracked as **CWE-362** and **CWE-416**, with a **CVSS 7.0** rating. Microsoft said both flaws require local access and no user interaction, and credited **Puponia Angelboy (@scwuaptx) of DEVCORE** with reporting them through coordinated disclosure. Microsoft assessed exploitation of both newly detailed flaws as **less likely** and said neither had been publicly disclosed nor exploited in the wild at the time of publication. The disclosures add to a broader pattern of AFD.sys privilege-escalation fixes listed in Microsoft’s Security Update Guide, including **`CVE-2025-49661`**, **`CVE-2025-54099`**, **`CVE-2025-58714`**, **`CVE-2026-25176`**, and **`CVE-2026-25178`**, indicating continued security hardening around the Windows WinSock ancillary driver. Official patches are available through Microsoft’s security updates.
Jun 29, 2026