Posts in Powershell (7 found)
Krebs on Security 1 months ago

Microsoft Patch Tuesday, December 2025 Edition

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities. Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable , this year marks the second consecutive year that Microsoft patched over one thousand vulnerabilities, and the third time it has done so since its inception. The zero-day flaw patched today is CVE-2025-62221 , a privilege escalation vulnerability affecting Windows 10 and later editions. The weakness resides in a component called the “ Windows Cloud Files Mini Filter Driver ” — a system driver that enables cloud applications to access file system functionalities. “This is particularly concerning, as the mini filter is integral to services like OneDrive, Google Drive, and iCloud, and remains a core Windows component, even if none of those apps were installed,” said Adam Barnett , lead software engineer at Rapid7 . Only three of the flaws patched today earned Microsoft’s most-dire “critical” rating: Both CVE-2025-62554 and CVE-2025-62557 involve Microsoft Office , and both can exploited merely by viewing a booby-trapped email message in the Preview Pane. Another critical bug — CVE-2025-62562 — involves Microsoft Outlook , although Redmond says the Preview Pane is not an attack vector with this one. But according to Microsoft, the vulnerabilities most likely to be exploited from this month’s patch batch are other (non-critical) privilege escalation bugs, including: – CVE-2025-62458 — Win32k – CVE-2025-62470 — Windows Common Log File System Driver – CVE-2025-62472 — Windows Remote Access Connection Manager – CVE-2025-59516 — Windows Storage VSP Driver – CVE-2025-59517 — Windows Storage VSP Driver Kev Breen , senior director of threat research at Immersive , said privilege escalation flaws are observed in almost every incident involving host compromises. “We don’t know why Microsoft has marked these specifically as more likely, but the majority of these components have historically been exploited in the wild or have enough technical detail on previous CVEs that it would be easier for threat actors to weaponize these,” Breen said. “Either way, while not actively being exploited, these should be patched sooner rather than later.” One of the more interesting vulnerabilities patched this month is CVE-2025-64671 , a remote code execution flaw in the Github Copilot Plugin for Jetbrains AI-based coding assistant that is used by Microsoft and GitHub. Breen said this flaw would allow attackers to execute arbitrary code by tricking the large language model (LLM) into running commands that bypass the user’s “auto-approve” settings. CVE-2025-64671 is part of a broader, more systemic security crisis that security researcher Ari Marzuk has branded IDEsaster (IDE  stands for “integrated development environment”), which encompasses more than 30 separate vulnerabilities reported in nearly a dozen market-leading AI coding platforms, including Cursor , Windsurf , Gemini CLI , and Claude Code . The other publicly-disclosed vulnerability patched today is CVE-2025-54100 , a remote code execution bug in Windows Powershell on Windows Server 2008 and later that allows an unauthenticated attacker to run code in the security context of the user. For anyone seeking a more granular breakdown of the security updates Microsoft pushed today, check out the roundup at the SANS Internet Storm Center . As always, please leave a note in the comments if you experience problems applying any of this month’s Windows patches.

security Security devops DevOps Powershell
0 views
Jason Scheirer 2 months ago

I Don't Like that I Like Starship

I have my seed Starship config up as a Gist. Starship is a tool that frustrates me because it seems so bikesheddy and unneeded: a custom prompt manager. We already had shell prompt customization! I blindly install on new machines for prompt customization! And Starship is written in Rust. People just use Rust to be cute. Then I realize that it’s okay to have nice things. The command line environment from the 90s can change. doesn’t suck. is right up there with Perl in opaque tools other people do interesting things with and then I steal the interesting things for myself. The TUIs don’t suck. I mock Textual and Charm openly and unrepentantly and still hypocritically use and enjoy the tools built with them. The terminal is changing because the people using it have the agency and hubris to use it differently. I can have a growth mindset and accept that But its killer features: So here it is. All this talk for something that doesn’t look substantively different but compounds into feeling different over the course of the days and weeks I use it: The preferred command line tool to do a thing can change in my lifetime and The preferred workflow to accomplish a task can change in the face of new tools and The people who invented the old tools we’re replacing were not gods, they were just as fallible as us so Writing new tools that learn hard lessons from decades of using the old ones is fine. It’s not sacrilege. Limited/Constrained/Opinionated : Other prompt customization schemes I’ve used have let you do anything , but you had to know how to do anything . I can’t think of cleverness I want in my prompt, I just want to see which Git branch I’m on. We’re all doing that. We all want that. Starship has a way to do that which isn’t brittle bash I have to maintain myself. Multiplatform : I have Windows Bash, Windows PowerShell, Linux Bash/Zsh, and macOS Bash/Zsh all driven by the same seed config. I can have it show the same information everywhere. I can use little emblems to let me know if I’m on my Mac, on a Linux machine, if I’m on Windows and if that’s PowerShell or Bash all right there. The Nerd Font Dark Horse : This system takes advantage of the glyphs in Nerd Fonts and normalizes abusing them. This adds the additional “burden” of installing a Nerd Font enabled typeface on all my apps with terminal editors, but I’ve already normalized that.

Perl open-source Open Source rust Rust Bash Powershell
0 views
Kix Panganiban 2 months ago

Unhogging RAM from WSL

I have 64 gigs of RAM. I thought that was plenty, but recently I've noticed Libre Hardware Monitor reporting that I was consistently at 90% RAM usage. Opening Task Manager reveals that VmmemWSL.exe was consuming 30GB of RAM -- but when I ran inside Ubuntu running on the Windows Subsystem for Linux (WSL), it was only reporting 6GB of use. I also run Docker, but it's reporting only 2GB of use. So where did the rest of the ~22GB go? It turns out it has something to do with the way WSL's dynamic memory allocation works (hence VmmemWSL.exe), and how it doesn't immediately free up memory from the host OS even that memory is no longer in use by the Linux OS. The fix was to do: So now, WSL only ever hogs up to 16GB of idle RAM -- which is still a lot -- but I now have plenty of RAM available again for my Windows host. in Powershell to force free the memory Create with the following contents Restart WSL with in Powershell Comet was eating 6GB of RAM with only a few tabs open. Chromium, am I right? I wish there was Orbstack for Windows

performance Performance Powershell linux Linux
0 views
Takuya Matsuyama 6 months ago

How to automate signing your Windows app with Certum's SimplySign app

I’ve been running a SaaS for 9 years, which includes an Electron app for Windows. For code signing, I’ve been using Certum's Code Signing Certificate: The pricing has been great, but there’s been one small annoyance that makes automation a bit tricky. In this post, I’ll share how I worked around it. Certum uses an app called SimplySign to handle authentication. This app is required for signing but unfortunately makes it impossible to automate the code-signing process out of the box. By default, SimplySign Desktop isn’t connected: You need to manually double-click the tray icon and enter a TOTP (Time-based One-Time Password): The code is generated by their mobile app. This manual step breaks automation because, without completing it, you can’t use — the private key isn't loaded until SimplySign authenticates. While setting up SimplySign, you scan a QR code to activate your account: It turns out that this QR code contains a standard URI. You can scan it with other password managers like 1Password — and indeed, 1Password shows the exact same token as the SimplySign app. When you click the Edit button, you can reveal the underlying URI. This means you can generate the token programmatically using a script! Here’s a PowerShell snippet that generates a TOTP using inline C#: This alone gives you the token. Now, let’s use it to automate the authentication step. PowerShell can simulate keystrokes sent to a window. This snippet searches for the SimplySign Desktop window and, if found, sends the TOTP code via simulated keystrokes. Here’s the full PowerShell script you can use to automate the entire process: You’ll need to define these environment variables: I keep these in a file and use to load them when running the script. I hope this helps you automate code signing with Certum and SimplySign! Looking for a good Markdown tech note-taking app? Here is what I'm building:

Powershell security Security devops DevOps c# C#
0 views
dfir.ch 1 years ago

ScriptBlock Smuggling

Introduction PowerShell’s Script Block Logging is a security feature that records and logs the contents of all scripts and commands executed within PowerShell. This includes both legitimate administrative scripts and potentially malicious commands. When enabled, Script Block Logging generates detailed logs stored in the Windows Event Log under Microsoft-Windows-PowerShell/Operational. I have previously tweeted several times about PowerShell and why monitoring the executed PowerShell scripts is so important. A few of these tweets are listed here.

Powershell security Security
0 views
Danny McClelland 2 years ago

Running Powershell Script an Elevated User

When running a powershell script, I often find I need to run the script in an elevated prompt. The nature of my job is that often these scripts will be run by people that don’t really know what Powershell is. I have found it quite useful to first create a bash script that the user executes, which in turn calls the actual Powershell script as an elevated user. To keep this handy, I’m posting it here for future me.

Powershell Bash tutorial Tutorial
0 views
W. Jason Gilmore 17 years ago

Improving the Windows Console

Although over the years I've run a number of Linux distributions on my main development laptop, for some time now I've been running Windows XP. Of course, anybody who is even vaguely familiar with Linux' powerful command-line interface shudders at the notion of using Windows pathetic console, and accordingly I regularly gnash my teeth over dealing with even rudimentary administration issues. Personally I've never been a fan of Cygwin, and so have sought out other alternatives to the console. As an alternative to Windows' terminal window, I've long used Console, an open source terminal window replacement which among other things allows the window to be resized. It also supports tabbed windows, meaning you can easily navigate between your MySQL client, Rails console, and Rails log windows for instance. But even a vastly improved terminal window doesn't resolve one of Windows' other wildly annoying features, or rather lack thereof: crucial commands such as "tail". DOS' built-in “more” command doesn't allow you to view the last X lines of a file, and for crying out loud you'd think they'd have thought to add the tail command to Powershell (such a command exists, but they've mysteriously decided to call it "get-content". "tail" must have been too obvious a choice). Seriously, admitting Unix got something right must be akin to devil worship in Redmond. At any rate, you can add “tail” to your system by installing the Windows Server 2003 Resource Kit Tools package, which is freely available from the Microsoft site. Once installed, you'll have a very Unix-like tail command at your disposal.

Powershell open-source Open Source ruby Ruby programming Programming devops DevOps
0 views