Windows 0-Day HiveLegacy Drops With Record Patch Batch

A Windows 0-day called HiveLegacy surfaced the same day Microsoft shipped its largest-ever batch of patches, according to Ars Technica. Build agents are a particularly bad place for a chainable primitive to land. They hold signing keys and deploy credentials by design, exactly what it's built to reach.

If you're running Windows build agents or dev VMs, patch now rather than waiting for the next Patch Tuesday cycle. A compromised build agent hands over the credentials that sign whatever ships next.

Ars Technica's report doesn't say whether HiveLegacy is being exploited in the wild, only that researchers see the chaining potential. "Researchers describe a powerful primitive" is a different threat level than "we've seen this used in the wild." Teams should patch as if the more serious version is already true.

I'd watch whether HiveLegacy turns up against CI infrastructure specifically, since that's where the signing-key blast radius actually lives.