Loading story…
Microsoft added Code Integrity page-hash validation for executable images hosted on remote devices in Windows Insider Canary build 25941, mitigating the PPLFault zero-day. The flaw abused the Cloud Filter API and unvalidated paging of SMB-hosted DLLs, allowing an attacker who already held administrator privileges to inject unsigned code into highly privileged WinTcb-Light Protected Process Light (PPL) processes.
PPLFault could bypass LSA protection and terminate or blind endpoint detection and response products. Its companion GodFault exploit chained PPLFault with a PPL-to-kernel vulnerability to alter kernel memory and gain physical-memory read/write access. The new validation causes altered remotely hosted payload DLLs to fail integrity checks, preventing injection; the change was initially released in an Insider pre-release build, with general-availability rollout not assured at the time.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft released Windows Insider Canary build 25941 with Code Integrity page-hash validation for executable images on remote devices. The change prevents altered SMB-hosted payload DLL pages used by PPLFault from passing validation.
Elastic publicly released the PPLFault and GodFault exploits at Black Hat Asia. It also released NoFault, a mitigation intended to block network-redirected DLL loads into PPL processes.
Gabriel Landau of Elastic Security reported PPLFault, an administrator-to-Protected Process Light exploit, and GodFault, a PPL-to-kernel exploit, to the Microsoft Security Response Center under VULN-074311 and provided proof-of-concept source code.
Microsoft patched the Windows Code Integrity time-of-check/time-of-use vulnerability used by PPLFault. The patch addressed the technique that enabled code execution at the WinTcb-Light protection level and protected-process memory dumping.
Elastic Defend version 8.9.0 and later blocks PPLFault exploitation.
According to Elastic, MSRC declined to take action on the reported vulnerabilities, although the Windows Defender team expressed interest in them.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcegithub.com
Open sourcemicrosoft.com
Open sourcei.blackhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched the Windows user-mode **Protected Process Light (PPL)** Known DLL loading behavior abused by PPLdump to inject arbitrary code into protected processes, including `LSASS`. The technique relied on creating a malicious `\KnownDlls` symbolic link through arbitrary object-directory creation, an exploitation primitive previously documented by Google Project Zero for local privilege escalation scenarios. Testing on Windows 10 21H2 build `19044.1826` showed PPLdump could still create the malicious symbolic link, but the protected target process no longer loaded the hijacked DLL. Analysis of `NTDLL` identified a change in `LdrpInitializeProcess`, controlled by `Feature_Servicing_2206c_38427506__private_IsEnabled`, that makes both Protected Processes and PPLs bypass Known DLLs. The update closes this specific user-mode PPL bypass, though other weaknesses affecting PPL protections may remain.
Sep 9, 2026
Elastic Security Labs disclosed two Windows zero-day exploit paths that enable attackers with local administrator privileges to bypass Protected Process Light (PPL) protections and escalate from PPL to kernel-level execution. The `PPLFault` and `GodFault` techniques can disable Windows Defender and other AV/EDR controls without a bring-your-own-vulnerable-driver (BYOVD) component, undermining controls intended to restrict administrator-driven kernel tampering. The techniques operate despite Windows defenses including Driver Signing Enforcement, Secure Boot, and the Vulnerable Driver Blocklist, which limit untrusted kernel drivers but do not prevent this driverless exploit chain. Microsoft reportedly declined to patch the issues because exploitation requires administrator access; Elastic released the NoFault kernel driver as an interim PPL mitigation and integrated protection into Elastic Endpoint/Defend version 8.9.0 and later, while the underlying kernel escalation remained unpatched.
Aug 26, 2026
Microsoft has disclosed a sustained series of **security feature bypass** vulnerabilities across Windows and related components, with multiple advisories tied to **Mark of the Web (MotW)**, **SmartScreen**, **MapUrlToZone**, Windows shortcut handling, and security zone mapping. The most detailed recent case, `CVE-2026-32225`, affects **Windows Shell** and allows attackers to bypass SmartScreen protections that rely on MotW by persuading a user to open a specially crafted `.lnk` file. Microsoft said successful exploitation could cause Windows to launch commands or Control Panel applets without proper MotW handling, potentially enabling arbitrary command execution or the loading of attacker-controlled DLLs; the flaw was rated **Important**, assigned a **CVSS 8.8**, marked as **more likely to be exploited**, and fixed at disclosure. The newer Windows Shell issue follows a broader pattern of Microsoft fixes for related bypasses, including `CVE-2022-44698` in **Windows SmartScreen**; `CVE-2023-36564` in **Windows Search**; `CVE-2023-36584`, `CVE-2024-38217`, and `CVE-2024-43487` in **Windows Mark of the Web**; `CVE-2024-30073` in **Windows Security Zone Mapping**; `CVE-2025-21328`, `CVE-2025-21329`, and `CVE-2025-21332` in **MapUrlToZone**; and `CVE-2025-47160` in **Windows Shortcut Files**. Additional bypass advisories affected Microsoft products including **Publisher**, **Office Developer Platform**, **PowerShell**, **Kerberos**, **Windows Hello**, **Surface**, and **PC Manager**, underscoring Microsoft's continued effort to close gaps in trust labeling and execution safeguards that attackers can abuse to reduce warnings and increase the success of social-engineering attacks.
Jun 29, 2026