News and Analysis

A zero-day vulnerability was discovered in NTLM, a Microsoft authentication protocol, by researchers at 0patch. This vulnerability enables hackers to steal user passwords by creating a malicious file that users view in Windows Explorer. Despite its deprecation, NTLM is still widely used, putting 64% of Active Directory user accounts at risk. Microsoft advises users to mitigate this threat by enabling Extended Protection for Authentication and transitioning to modern protocols like Kerberos. However, Microsoft’s latest 2025 server has addressed the issue by default.