[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

public PoC from the researcher (Nov 10, 2026); independently reproduced per The Hacker News; Microsoft has not confirmed it, no CVE or patch; no in-the-wild use reported

SignDrop: public Windows CLFS zero-day PoC turns the CLFS log-authentication mitigation into a SYSTEM shell; no CVE or patch yet

  • Exposure check: HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication value Mode: 0 or 1 is in the claimed scope; 2 or 3 means the mitigation is off.
  • Don't disable the mitigation to dodge this: Microsoft and the researcher both warn that reopens the older CLFS memory-corruption bugs (10 CLFS CVEs are in KEV).
  • Watch: Microsoft's Security Update Guide for a CVE/fix. This researcher's earlier Defender bugs (RoguePlanet CVE-2026-50656, ShieldBreak CVE-2026-69414) were later patched, and three of their earlier Defender flaws were exploited in attacks.
  • See the SignDrop tip for detection ideas.

Sources: SignDrop README (MSNightmare / Project NightCrawler, released Nov 10, 2026) · The Hacker News: New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access (Nov 12, 2026) · Microsoft: Common Log File System (CLFS) authentication mitigation