Microsoft fixed 120 vulnerabilities on Tuesday - 17 Critical, no zero-days for the first time since June 2024. Two Word RCEs (CVE-2026-40361 and CVE-2026-40364) trigger just by viewing a malicious document in Outlook's Preview Pane and are rated 'Exploitation More Likely.' Windows DNS Client (CVE-2026-41096) lets an attacker-controlled DNS server execute code on any Windows machine resolving a hostile name - echoing SigRed. Other priorities: Netlogon RCE (CVE-2026-41089) and Microsoft SSO Plugin for Jira and Confluence (CVE-2026-41103, CVSS 9.1).
A new ransomware family called Kyber has been deployed in attacks combining a Rust-based Windows encryptor with a Linux ESXi variant on the same victim network, and its Windows build is one of the first in the wild to advertise post-quantum cryptography. Rapid7 analysed both variants during a March 2026 incident response and found the Windows build genuinely uses Kyber1024 (a NIST-selected post-quantum key-encapsulation algorithm) plus X25519 to wrap the AES-CTR keys that actually encrypt files, matching its ransom-note claims. The Linux ESXi variant makes the same post-quantum marketing claim but actually uses ChaCha8 with RSA-4096 - pure marketing theatre rather than real crypto defense. For victims the distinction does not matter: without the attacker's private key the files are unrecoverable regardless of algorithm. Windows-encrypted files get a '.#~~~' extension; Linux gets '.xhsyw'. The ESXi variant enumerates all VMs, encrypts datastore files, defaces management interfaces, adds crontab persistence, and terminates VMs. The Windows variant deletes shadow copies, disables boot repair, kills SQL/Exchange/backup services, clears event logs, wipes the Recycle Bin, and ships with an experimental Hyper-V shutdown feature. Only one victim appears on the Kyber leak site so far (a multi-billion-dollar American defence contractor and IT services provider), meaning most current victims are still in the extortion window and not publicly known.
TrustStrike Labs