Alerts

Microsoft January 2026 Patch Tuesday: 114 Vulnerabilities Fixed Including 3 Zero-Days

Zero Day Wire

— 1 min read
Share
Microsoft January 2026 Patch Tuesday: 114 Vulnerabilities Fixed Including 3 Zero-Days

Microsoft's first Patch Tuesday of 2026 addresses 114 security vulnerabilities across Windows, Office, and related services. The release includes 12 critical-severity flaws and patches for three zero-day vulnerabilities.

By the Numbers

Zero-Days Patched

Three zero-day vulnerabilities were addressed in this release:

  • CVE-2026-20805 - Desktop Window Manager information disclosure flaw allowing unauthorized access to sensitive data
  • CVE-2026-21265 - Windows Digital Media elevation of privilege bug commonly used in attack chains
  • CVE-2023-31096 - Legacy Agere Soft Modem driver elevation of privilege issue included in cumulative updates

Critical Vulnerabilities

The most severe flaws patched this month include:

Patch Priority

Administrators should prioritise:

  1. Internet-facing systems including WSUS servers (CVE-2026-20856) and SMB servers
  2. Office endpoints due to multiple critical RCE flaws
  3. Systems running affected kernel drivers

Testing in staging environments is recommended due to potential regressions in drivers like Cloud Files Mini Filter. Monitor CISA KEV for any rapid additions as zero-days may see active exploitation.

Read more

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

A compromised version of the Nx Console extension — a popular VS Code plugin with over 2.2 million installations — was published to the Visual Studio Code Marketplace after an attacker leveraged stolen developer credentials to inject a multi-stage credential stealer into the official nrwl/nx GitHub repository. The malicious version

By Zero Day Wire
Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Symantec and Carbon Black have published a definitive analysis confirming that Fast16, a Lua-based malware framework first surfaced by SentinelOne weeks ago, was purpose-built to sabotage nuclear weapons testing simulations. The findings establish Fast16 as the earliest known cyber sabotage tool targeting nuclear weapons research — predating the first known version

By Zero Day Wire