InfoSecBulletin Cybersecurity for mankind
A critical 0 click security flaw, known as CVE-2026-32202, comes from a patch that did not fully fix a Windows Shell security issue. Microsoft confirmed active exploitation of the flaw and released a fix as part of its April 2026 Patch Tuesday update.
CERT-UA reported that the APT28 group, also called Fancy Bear, Forest Blizzard, and Pawn Storm, started a targeted cyber attack on Ukraine and some EU countries in December 2025 using a harmful LNK (Windows Shortcut) file.
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Akamai researchers found the campaign in January 2026. They linked the infection to two connected vulnerabilities: CVE-2026-21513 (an MSHTML exploit) and CVE-2026-21510 (a Windows Shell SmartScreen bypass rated 8.8).
Windows Shell 0-Click Vulnerability Exploited
The main way of this attack misuses the Windows Shell namespace reading system. APT28 included a harmful LinkTargetIDList structure in the LNK file, a binary IDList that Windows Explorer reads and shows, just like Control Panel items are shown.
The IDList had three main parts: a CLSID for the Control Panel COM object, another entry for “all control panel items,” and a third _IDCONTROLW structure that included a UNC path to the attacker’s remote server.
When the victim’s explorer.exe parsed this LNK file, it resolved the malicious path as:
text::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\{GENERATED GUID OF THE UNC PATH}
This made Windows load a DLL from a server controlled by the attacker, acting like a Control Panel component, without activating SmartScreen or Mark of the Web checks.
Microsoft fixed CVE-2026-21510 in February 2026. They added a new COM object named ControlPanelLinkSite. This new object connects the CPL launch path with ShellExecute’s trust check system. Click here to read full report.
