A month is a long time to be SYSTEM
Microsoft patched CVE-2026-50656 on July 9, 2026 — a privilege escalation in Windows Defender that gave an attacker SYSTEM-level access. The vulnerability was disclosed June 10 by Kudelski Security . That's 29 days between public disclosure and patch. For a zero-day in the thing that is supposed to protect the operating system. SYSTEM privilege is not elevated access. It is higher than Administrator. It is the trust level the OS itself runs at — the level that controls drivers, kernel objects, and security policy. An attacker with SYSTEM can disable protections, install persistent backdoors, and own the machine in a way that survives reboots and administrator attempts to remove it. And this was in Defender — the software that Microsoft ships enabled by default, running with the highest privileges, on every Windows install. What 29 days means A disclosed zero-day with no patch is a countdown. Proof-of-concept code circulates. Attackers reverse-engineer the fix from the advisory. Red...