June 2024 [A Doozy of a Patch Tuesday]

A close-access RCE changes the threat model: instead of war-driving for open networks, an attacker parks within Wi-Fi range with an antenna and fires CVE-2024-30078 straight at a system to land remote code execution, no credentials or physical access needed. The hosts expect proof-of-concept code on GitHub and a Metasploit module fast.

Two Windows kernel elevation-of-privilege bugs shipped this month: CVE-2024-30068 grants system-level access and CVE-2024-30064 elevates privileges within the running process, both tied to Windows app containers.

CVE-2024-30072 is a remote code execution flaw triggered by opening a malicious Microsoft Event Trace Log file, a strong phishing lure against IT support staff who routinely open trace files and hold high privileges.

Microsoft Recall drew sharp criticism for storing searchable screenshots and plain-text records of user activity; Microsoft later moved it to opt-in, gated behind Windows Hello and encrypted at rest, though the team notes an attacker with RCE still benefits from any window where it is unlocked.

A record 5,000 CVEs were published in a single month, averaging 164 a day and nearly double the 2023 rate. With volume this high, the hosts pair patching with controls that prevent or restrict damage and detection that catches what gets through. They also push checks left into the CI/CD pipeline (image scanning, admission controllers) to block known-vulnerable builds before they deploy.