Timing is everything—and that’s especially true for the millions of Microsoft Windows users with a fast-approaching July 4 deadline to update their systems. It’s just two weeks ago that we saw a patched Windows vulnerability come back to life. While Microsoft had suggested no known exploits for CVE-2024-26169, Symantec’s security researchers thought somewhat differently, with “some evidence” that attackers “compiled a CVE-2024-26169 exploit prior to patching.” And it’s just last month that several U.S. government agencies—including CISA and the FBI—collaborated on a Cybersecurity Advisory warning that “Black Basta affiliates have impacted a wide range of businesses and critical infrastructure in North America, Europe, and Australia. As of May 2024, Black Basta affiliates have impacted over 500 organizations globally.” Black Basta is a Ransomware-as-a-Service (RaaS) group that has targeted “12 out of 16 critical infrastructure sectors,” the agencies said, “including the Healthcare and Public Health (HPH) Sector.” But the group’s activities have extended well beyond the public sector, hitting the likes of Hyundai, Rheinmetall, Capita and ABB. Timing is everything. And these stories come together—somewhat awkwardly for Microsoft—because Symantec suggested it was “the Cardinal cybercrime group (aka Storm-1811, UNC4393), which operates the Black Basta ransomware” that was likely exploiting the privilege escalation vulnerability in Microsoft’s Windows Error Reporting Service for several weeks before it was patched in March. CISA has added CVE-2024-26169 to its Known Exploit Vulnerability (KEV) catalog, flagging that it is “known to be used in ransomware campaigns” and mandating all Windows systems be updated or shut down by July 4. That mandate only applies to US federal agencies, but CISA says it “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation.” Black Basta has now generated significantly more than $100 million in ransomware payments, and so leaving Windows systems unpatched is a gamble no organization should take. All should follow CISA’s July 4 update mandate. While the specific issue here is less relevant to personal users, update right away if you haven’t done so. Since this article was published, the situation for Windows 11 users has been complicated by spreading news of an unexpected restart loop impacting some users installing June’s Windows 11 KB5039302. Microsoft has warned users that “after installing updates released June 26, 2024 (KB5039302), some devices might fail to start,” advising that “affected systems might restart repeatedly and require recovery operations in order to restore normal use.” KB5039302 is not a mandatory update in itself and is not a security update—as such, put those headlines aside and proceed as normal. Do not confuse this update with the security patching that resolves the Microsoft Windows Error Reporting Service vulnerability. In any case, it’s highly likely that your Windows 11 PC will be unaffected by the new issue. This restart loop impacts enterprise machines running “virtual machines tools and nested virtualization features,” Microsoft has said, which means home users are less likely to be hit. Users will still see relevant updates as available. The issues covered by CISA’s warning were patched ahead of June’s release, and given the Black Basta angle, the urgency remains. And that means that while Microsoft may have pulled KB5039302 for some users, you should still ensure you update your PC ahead of the July 4 deadline. The much bigger issue that does impact Windows home users is now fast approaching, albeit that deadline is still more than a year away on October 14, 2025. Just days before Symantec’s report, we saw Microsoft again urging Windows 10 users to upgrade to Windows 11. With a daunting 70% of users yet to make the switch ahead of next year’s end-of-life, that challenge is becoming ever more acute and Microsoft’s nags have started to hit PCs worldwide. Learn more by visiting OUR FORUM.

Although some people might worry about the National Security Agency itself spying on their phones, the NSA has some sage advice for iPhone and android users concerned about zero-click exploits and the like: turn it off and on again once per week. How often do you turn off your iPhone or android device? Completely turn it off and then reboot it, rather than just going into standby mode, that is. I suspect that the answer for many people is only when a security or operating system update requires it. That, according to the NSA, could be a big mistake. In a document detailing several mobile device best practices, the NSA recommends users turn their devices off and then back on once every week to protect against zero-click exploits, which attackers often use to eavesdrop on and collect data from phones. Users can mitigate the threat of spear-phishing, which can lead to the installation of yet more malware and spyware, by the same simple action. However, the NSA document does warn that the turn it off and on again advice will only sometimes prevent these attacks from being successful. “Threats to mobile devices are more prevalent and increasing in scope and complexity,” the NSA said while warning that some smartphone features “provide convenience and capability but sacrifice security.” As such, doing something is always better than doing nothing when it comes to being proactive about your device and data security. The advice given is not some silver bullet that will solve all your security ills, it must be noted. Indeed, the NSA document includes a chart that shows how effective each tactic is against different threats. While good general advice, turning it off and on again will not help you against many of the more advanced malware and spyware threats that are programmed to reload on reboot. The NSA also advises Phone users to disable Bluetooth when not using it, update the device as soon as possible when operating system and application updates become available and disable location services when not needed. The small matter of security over convenience comes into play for much of the advice given, as you can tell already. Throw in not using public Wi-Fi networks and not using public charging stations, despite plenty of security experts considering the risk to be low in most real-world use cases, and many smartphone users are likely to roll the dice. When it comes to public Wi-Fi there’s a difference between the risks that can be present and an individual actually being at risk. While it is possible for a determined criminal to use unsecured networks for nefarious purposes, this usually involves tricking an unsuspecting user into connecting to their Wi-Fi hotspot rather than one being provided by the railway company, airport, or coffee shop. A recently disclosed vulnerability that can lead to something called an SSID Confusion Attack is a good example of how this can work. Without going into the technical details, read the article for that; it can disable your VPN in certain circumstances and make it appear that you have connected to a secure network when you haven’t. But, again, most unsecured public WiFi networks are safe to use for general activity. The U.K. National Cyber Security Centre suggests that users instead connect by way of their mobile 4G or 5G network as these “will have built-in security and you can also use the tethering feature of most such devices to connect your laptop to your smartphone’s network. This makes sense when performing sensitive activities such as online banking, for example. The Federal Communications Commission, an independent agency of the U.S. government, also offers some pertinent security advice for smartphone users. There is a lot of overlap in the advice offered by differing government and law enforcement agencies, some of the FCC advice is worth mentioning here. Not modifying the security settings of your smartphone, for example. “Tampering with your phone’s factory settings, jailbreaking, or rooting your phone undermines the built-in security features offered by your wireless service and smartphone,” the FCC advises, “while making it more susceptible to an attack.” The mantra of not disabling security settings for the sake of convenience is one I agree with, but I acknowledge this is likely to go ignored by the general user, for whom convenience is everything until a security incident impacts them personally. The FCC also warns that understanding app permissions is important as these can be used to bypass certain security functionality by a malicious app developer. Luckily, modern mobile operating systems have made such permission granting more transparent than ever, but it still pays to be alert to the danger. “You should be cautious about granting applications access to personal information on your phone or otherwise letting the application have access to perform functions on your phone,” the FCC said. Learn more by visiting OUR FORUM.