InfoSecBulletin Cybersecurity for mankind
A critical 0 click security flaw, known as CVE-2026-32202, comes from a patch that did not fully fix a Windows Shell security issue. Microsoft confirmed active exploitation of the flaw and released a fix as part of its April 2026 Patch Tuesday update.
CERT-UA reported that the APT28 group, also called Fancy Bear, Forest Blizzard, and Pawn Storm, started a targeted cyber attack on Ukraine and some EU countries in December 2025 using a harmful LNK (Windows Shortcut) file.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Akamai researchers found the campaign in January 2026. They linked the infection to two connected vulnerabilities: CVE-2026-21513 (an MSHTML exploit) and CVE-2026-21510 (a Windows Shell SmartScreen bypass rated 8.8).
Windows Shell 0-Click Vulnerability Exploited
The main way of this attack misuses the Windows Shell namespace reading system. APT28 included a harmful LinkTargetIDList structure in the LNK file, a binary IDList that Windows Explorer reads and shows, just like Control Panel items are shown.
The IDList had three main parts: a CLSID for the Control Panel COM object, another entry for “all control panel items,” and a third _IDCONTROLW structure that included a UNC path to the attacker’s remote server.
When the victim’s explorer.exe parsed this LNK file, it resolved the malicious path as:
text::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\{GENERATED GUID OF THE UNC PATH}
This made Windows load a DLL from a server controlled by the attacker, acting like a Control Panel component, without activating SmartScreen or Mark of the Web checks.
Microsoft fixed CVE-2026-21510 in February 2026. They added a new COM object named ControlPanelLinkSite. This new object connects the CPL launch path with ShellExecute’s trust check system. Click here to read full report.
