Cyber Security News

Hacking Editorial Brief — July 18, 2026

Windows LegacyHive Zero-Day and OpenSSL HollowByte Flaw Disclosed

Security researcher Nightmare Eclipse released a Windows zero-day exploit dubbed LegacyHive that grants attackers local privilege escalation to administrator access on fully patched Windows systems. The vulnerability exploits a flaw in the Windows User Profile Service, affecting current desktop and server versions. Separately, researchers disclosed HollowByte, a critical OpenSSL vulnerability that allows attackers to strand server memory using specially crafted 11-byte TLS requests on glibc-based systems. Despite the severity, OpenSSL maintainers patched the flaw without issuing a CVE identifier, security advisory, or changelog entry, complicating detection and remediation efforts for enterprise teams. Both disclosures add to an already turbulent week for defensive security teams managing Microsoft's record 570-vulnerability patch cycle.

Ernst & Young Breach and Microsoft Zero-Days Under Active Exploitation

Professional services firm Ernst & Young notified clients of a data breach after attackers compromised a third-party support platform and exfiltrated client documents. The incident underscores continued risk in supply chain and vendor access vectors. Meanwhile, Microsoft confirmed that two zero-day vulnerabilities disclosed earlier this week—CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server—are already being exploited in active attack campaigns. Both flaws enable unauthorized access and remote code execution, with threat actors moving quickly to weaponize the vulnerabilities despite patches being available in Tuesday's release.

Sources: Bleeping Computer · The Hacker News · LinkedIn · Forbes