Not content with broken Windows updates, Microsoft has disclosed two problems with Defender for Endpoint on Linux – one that could disable the security service after a reboot, and another that prevents updates on FIPS-enabled Red Hat Enterprise Linux 8 and 9. The more serious problem affected versions 101.26042.0000 through 101.26042.0009 across all supported Linux operating systems. After an upgrade or reinstall followed by a reboot, "the Defender service might be disabled on some devices," according to Microsoft. "If you use Defender for Servers (Plan 1 or 2) with Defender for Cloud and have the MDE [Microsoft Defender Endpoint] integration enabled, automatic updates for the MDE.Linux extension are enabled by default, which means your machines could have received an affected version automatically," it explained. "If an affected version was installed, the issue might impact active protection on rebooted devices until remediation steps are taken." Microsoft did not specify what caused Defender to become disabled, but anything that could knock out endpoint protection will give administrators sweaty palms. A separate problem affected RHEL 8 and 9 systems running in FIPS mode: the 101.26042.x update could fail to install, leaving devices on their previous version. FIPS refers to US Federal Information Processing Standards, which in this context impose requirements on the cryptography used by government and other regulated systems. Although Microsoft's alert did not mention an available update, its release notes direct users affected by the disabled-service bug to build 101.26042.0011. The separate FIPS installation problem is fixed in version 101.26052.0011 and later. Microsoft Defender for Endpoint on Linux protects server workloads on-premises and in the cloud. According to Microsoft, "it helps you prevent, detect, investigate, and respond to advanced threats with unified visibility through the Microsoft Defender portal." Other endpoint security platforms are available, but where an organization has gone all-in with Microsoft, the unified management offered by Defender for Endpoint on Linux can be difficult to resist. Microsoft has an unfortunate habit of shipping broken updates for its flagship operating system, Windows. An update that breaks software specifically designed to protect a device takes things to another level, particularly given the relentless rise in attacks and the need to both fend them off and monitor activity. Hence the appeal of unified visibility through the Microsoft Defender portal. However, an update that could leave Defender disabled after a reboot – while also refusing to install on some security-hardened systems – is less than ideal. ®

Kremlin cyber goons have been breaking into government and commercial networks for at least a year by exploiting a Zimbra bug with a novel twist on Russia’s usual phishing expeditions: this attack occurs as soon as the victim looks at an email, with no need to even click on a link or open a file. These attacks have been ongoing since July 2025, according to a whopping 27 US, UK, and other international government agencies, which attribute the intrusions to a group they track as Laundry Bear, aka Void Blizzard. “Laundry Bear’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data,” according to the joint security alert. The Russians’ latest campaign targets CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite that was patched in November 2025 – but Moscow's attackers began exploiting it long before then. This type of vulnerability allows attackers to inject malicious JavaScript into web pages viewed by the victim. In this case, the phishing bears abused the security hole in the Zimbra Collaboration Suite by sending malware-laden HTML email messages to target Western organizations. Targeted orgs include those in the defense industrial base, federal and local governments, education, energy, law enforcement, media, non-governmental organizations, and technology sectors. Some of the email addresses used in this campaign include ivanka.zurabishvili@proton[.]me, zmul1@buildandconsulting[.]com, garrysmithme@pinmx[.]net, and hostingclient@pinmx[.]net, we’re told. The attack doesn’t require any user interaction other than viewing the malicious email, and once that happens, the attackers get to work exfiltrating a ton of data. This includes the victims’ last 90 days of email communications, email addresses and passwords, the organizations’ email directories such as global address lists, two-factor authentication tokens, and newly created application passcodes. Then the attackers use these stolen credentials to maintain access to the victims’ email, modifying account preferences and collecting authentication information. Laundry Bear stores the stolen goods on an unattributable virtual private server (VPS) running its custom “Flowerbed” collection framework. Flowerbed is a Python project that uses Docker for containerization. “The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development,” the government agencies noted. The 31-page security alert includes an extensive indicators of compromise (IOC) section, which organizations should review to identify individuals compromised by the campaign. Also, the agencies recommend minimizing employees’ use of the ZCS webmail client until their organizations update to a patched version that is not vulnerable to CVE-2025-66376. ®