Blog

  • Government Spying 🤝 Targeted Advertising | EFFector 38.5

    Have you ever seen a really creepy targeted ad online? One that revealed just how much these companies know about your life? It’s unsettling enough to see how much companies know about you—but now we have confirmation that the government is also tapping the advertising surveillance machine to get your data. We’re explaining the dangers of targeted advertising and location tracking, and the latest in the fight for privacy and free speech online, with our EFFector newsletter.

    JOIN OUR NEWSLETTER

    For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This issue covers a victory for protesters seeking to hold police accountable, a troubling conflict over the Department of Defense’s use of AI, and how advertising surveillance enables government surveillance.

    Prefer to listen in? Big news: EFFector is now available on all major podcast platforms! In this episode we chat with EFF Staff Attorney Lena Cohen about how targeted advertising can reveal your location to federal law enforcement. You can find the episode and subscribe in your podcast player of choice

    Privacy info.
    This embed will serve content from simplecast.com

    Listen on Spotify Podcasts Badge Listen on Apple Podcasts Badge  Subscribe via RSS badge

    Want to stay in the fight for privacy and free speech online? Sign up for EFF’s EFFector newsletter for updates, ways to take action, and new merch drops. You can also fuel the fight against online surveillance when you support EFF today!

  • Episode 4: Carmelo, Carmelo…

    Editors’ Note: This podcast was originally produced in Spanish. But in light of recent events, we wanted to share it with a wider audience, and have reproduced the series in English using AI translation. You can find these translated episodes below, or listen to the original version in Spanish here.

    You can also listen and subscribe on Spotify, Apple Podcasts, or any other major audio platform.

  • Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq

    Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq

    To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here.

    Bellingcat has geolocated footage of multiple Tomahawk cruise missiles travelling through Iraqi airspace towards Iran, either in violation of its airspace or with Iraq’s consent.

    Bellingcat identified at least 20 individual cruise missiles and geolocated them over Iraqi Kurdistan including alongside Mount Piramagrun, in the Zagros Mountain range, and approximately 50 km southeast of the city of Kirkuk.

    Modern Tomahawks can travel up to 1600 km, and are used for precision strikes. At the start of the war, the US had a carrier strike group in the Mediterranean and the Arabian Sea, as well as some independently deployed destroyers.

    The US is the only participant in the war known to possess Tomahawks, which can be launched by ships or submarines. US President Donald Trump said at a press conference on Monday that Iran “also has some Tomahawks”. Official ​​government reports on Iran’s military balance don’t support this claim.

    Considering the distance of US vessels to the geolocated missiles, the missiles seen in the videos were most likely fired from the Mediterranean Sea, Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat.

    Red Sea launches would be pushing the maximum range, and US Navy ships were not known to have been in the Persian Gulf at the start of the war, Lair said.

    Brian Finucane, a senior adviser with the US Program at the International Crisis Group, told Bellingcat that without the consent of Iraq and Syria, the intrusion of Tomahawk missiles into their airspace “would violate its sovereignty and international law”. 

    We asked the US State Department and Department of Defense as well as the foreign ministries of Iraq and Syria, if ​​the US had an agreement with Iraq or Syria to utilise their airspace for cruise missiles targeting a third country. The Department of Defense told Bellingcat they “had nothing to provide” while neither the Iraqi nor Syrian ministry had responded at the time of publication.

    On Tuesday, Iraqi Prime Minister Mohammed Shia al-Sudani spoke with US Secretary of State Marco Rubio and stressed that Iraqi airspace and territory should not be used for any military action targeting neighbouring countries, the prime minister’s media office said.

    Bellingcat geolocated at least eight videos showing Tomahawk missiles over Iraq. The videos show at least 20 individual Tomahawk missiles, based on the longest uninterrupted video we reviewed.

    The below graphic shows all Tomahawk missiles Bellingcat has geolocated, which includes additional missiles identified outside of Iraq.

    Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

    Interactive map showing the approximate locations of US carrier groups in the region at the start of the war, with a 1600 km range, in relation to Tomahawks geolocated by Bellingcat. We included a possible Red Sea launch point for visualisation, reference and comparison purposes only. The white arrows indicate the location of Tomahawk sightings. Their respective directions of travel are shown by default. All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

    These missiles don’t always make it to their intended target. In addition to footage of the airborne missiles, Bellingcat also identified remnants of a Tomahawk missile that had crashed outside Kafr Zita in northwest Syria.

    Unexploded WDU-36/B warhead of a Tomahawk missile, outside Kafr Zita, Syria. Source: Qalaat Al Mudiq.

    Missiles Fired From the Sea

    On the first day of the war, Feb 28, the US Central Command (CENTCOM) published footage of Tomahawk missiles being fired from the sea. Later on March 1, CENTCOM released additional video of the USS Thomas Hudner (DDG-116) firing a Tomahawk missile, while operating in the Eastern Mediterranean Sea

    According to a Center for Strategic and International Studies (CSIS) analysis, more than 160 Tomahawk missiles may have been used in the first 100 hours of the war, and “they would have been used to destroy Iranian air defenses and other counter-air capabilities and create permissive conditions for follow-on attacks”.

    Arleigh Burke-class guided-missile destroyer USS Thomas Hudner (DDG 116) fires Tomahawk land attack missiles in support of Operation Epic Fury, Mar. 1, 2026. (U.S. Navy video)

    Tomahawk Flights Through Iraqi Airspace

    The footage analysed by Bellingcat showing cruise missiles travelling over land is consistent with the typical flight profile of Tomahawks, which cruise at low altitude along pre-programmed routes toward distant targets. 

    Support Bellingcat

    Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

    According to the US Navy, “Tomahawk cruise missiles are designed to fly at extremely low altitudes at high subsonic speeds, and are piloted over an evasive route by several mission tailored guidance systems.”

    This explains why they are sometimes filmed by civilians during transit. Similar sightings have previously been recorded during US conflicts in the Middle East. 

    Bellingcat analysed terrain features and solar data in the footage and confirmed the location and approximate direction of travel of the Tomahawk missiles. We found that they followed the terrain closely, and appeared to follow two different valleys near the Iraq-Iran border.

    The Zagros mountain range stretches across much of Iran as well as northern Iraq. The mountains of this valley would provide details for the Tomahawks’ terrain matching guidance, and hide them from Iranian radar detection.

    Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

    Interactive map showing the locations of Tomahawk sightings. The missiles were travelling through Iraqi airspace towards Iran in valleys near the Iraq-Iran border, and near Kirkuk. The respective directions of travel are shown (white arrows). All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

    Other Geolocated Footage 

    In a video filmed in Tehran and posted on the first day of the war, six Tomahawk missiles can be seen flying over the Qurkhane Bus Terminal in Tehran, as an anti-aircraft gun on a nearby building fires at them. Other gunfire can be heard in the distance.

    A Tomahawk flying over the area near Qurkhane Bus Terminal in Tehran, as an anti-aircraft gun on a nearby roof fires at it. Source: Vahid Online.

    Bellingcat previously geolocated a Tomahawk strike in Manib, Iran, near a school where 175 people, including children, were reported to have been killed.

    A final video analysed by Bellingcat, posted on March 3, shows 13 Tomahawk missiles flying past a commercial ship in the direction of Iran, the M/V MAERSK BOSTON, while it was off the coast of Oman, according to solar, visual and Marine Traffic data.

    A Tomahawk flying past the MV MAERSK BOSTON off the coast of Oman. Source: Warren Wright Olanda.

    New Tomahawk Variants

    Since the beginning of the war, two new variants of Tomahawk missiles have been observed.

    Typical Tomahawk configuration, with wings slightly angled towards the rear. Left: View of the bottom of a Tomahawk as it dives towards its target during a test. Right: View of the top of a Tomahawk as it dives during a test. Sources: Commonwealth of Australia, Department of Defence.

    One Tomahawk variant seen publicly for the first time, distinguished by its visible black body, believed to be a stealth coating. Other missiles appear to have wings angled forwards, a modification designed to make them harder to detect by radar, according to an analysis by The War Zone.

    Tomahawk missile with forward swept wings. Source: Channel8.

    Clobbering

    Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat that Tomahawks have GPS guidance and use terrain matching to determine their location. When there is an error in guidance, some missiles can “clobber” and hit the ground.

    The US stopped firing Tomahawk missiles over Saudi Arabia during the 2003 Iraq War after some crashed in the country while attempting to strike targets. About ten Tomahawk missiles crashed during that war, with some landing in Iran and Turkey as well.


    Bellingcat’s Logan Williams and Felix Matteo Lommerse contributed research to this article. Livio Spani, Anisa Shabir, Afton Briones, Mathis Noizet, and Nicole Kiess from Bellingcat’s Volunteer Community also contributed to this piece.

    Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

    The post Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq appeared first on bellingcat.

  • Alternative to HRT for menopausal hot flushes now on NHS

    The non-hormonal daily pill could benefit 500,000 women for whom HRT is not suitable.
  • An Unimpressive Reiki Study

    I often get e-mail suggesting topics to cover on SBM or elsewhere in my social media content. I like getting these e-mails when they are organic, coming from readers here with genuine questions about some questionable claim or practice. But often they are press contacts, by a professional promoter pushing a new study or shopping around an author or someone they represent. […]

    The post An Unimpressive Reiki Study first appeared on Science-Based Medicine.

  • UN relief chief condemns ‘$1 billion-a-day’ cost of war in Middle East

    The UN’s emergency relief chief on Wednesday condemned the “$1 billion-a-day” cost of the war in the Middle East, at a time when humanitarian needs are soaring and aid funding is falling dangerously short.
  • Trump’s Pardons and Kidnappings: The Imperial Logic of the War on Drugs

    It is not difficult to see why critics have called Trump’s forays in Latin America another instance of his hypocrisy and lies. Less than a month after Trump pardoned former Honduran President Juan Orlando Hernández, who had recently been sentenced to 45 years in prison for drug trafficking, U.S. armed forces abducted sitting Venezuelan President Nicolás Maduro on the same charges. But as Aslı Bâli…

    Source

  • Spies, Lies and Video Clicks: The Warped World of Pro-Russian Disinformation in Europe

    In the 1970s, as the Cold War raged, a state-backed television spy drama called ‘Das Unsichtbare Visier’ gripped audiences in East Germany. The title translates as ‘The Invisible Visor,’ and its hero was a Stasi agent who went by the alias Achim Detjen. A cultural counterpoint to James Bond, he foiled dastardly Western plots.

    Skip forward 50 years and Achim Detjen appears to have returned as part of another pro-Russia propaganda effort — but this time he’s a journalist. 

    In February, a German-language website called Anonymous News — which has no connection to the famed hacktivist group with the same name — listed an “Achim Detjen” as the author of an article with a misleading headline that suggested French president Emmanuel Macron was linked to convicted sex offender Jeffrey Epstein.

    The hyperlink on the story’s byline led not to a journalist’s profile, but to the German-language website of Russia’s government-owned broadcaster RT, where articles have also been written under the name of the fictitious spy.

    As journalists around the world pore over the files released by the U.S. Department of Justice in January relating to the Epstein case, they have found no evidence that the French president ever communicated with or met with Epstein. Macron is only referenced tangentially by other people or in press articles. 

    However the yarn spun under an apparent pseudonym at Anonymous News was not the only attempt at alleging the two men were deeply connected. 

    The week before, in France, an article made the baseless claim that a model agent tied to Epstein said Macron would have a party and he would invite young men for him. Emails cited as apparent evidence did not appear in the released files. The claims were published on a clone site of a real outlet called France-Soir in an article which co-opted the byline of a French journalist. A video making the allegations then spread on X. 

    The French government service known as Viginum, which works to combat foreign digital interference, attributed the narrative to a Russian disinformation operation called Storm-1516. Viginum said in a statement that Storm-1516 had been “publicly attributed to Unit 29155 of the Russian military intelligence service (GRU).”

    A report on Storm-1516 published by Viginum last year said its activities “meet the criteria of a foreign digital interference and represent a significant threat to the digital public debate, both in France and in all European countries.”

    Pro-Russian disinformation across Europe has surged and evolved since Moscow’s full-scale invasion of Ukraine in February 2022. Many claims seek to discredit Ukraine’s armed forces, its European allies, and the leadership of Volodymyr Zelensky. Others, like the claims against Macron, take aim at Western leaders who support Ukraine.

    By digging into Anonymous News reporters sought to understand more about the forces behind pro-Russian propaganda and information manipulation in Europe. 

    What they found was a cast of real-life characters that could comfortably sit next to Achim Detjen in a 21st century drama — among them a German far-right figure, an officer for Russia’s Federal Security Service, and an impoverished Bulgarian who was paid to be the on-paper owner of a media company receiving reader donations for the outlet. 

    The German Anti-Immigrant Figure Turned Russia Cheerleader

    Anonymous News markets itself to German-speaking audiences as “uncensored news.” Its website, anonymousnews.org, attracts around 100,000 visitors each month, according to traffic analytics tools, and promotes pro-Kremlin and anti-Western narratives. It has also shared hacked U.K. government documents.

    There is no information about staff on the site, but one man has proudly emerged as the face of the outlet’s new Moscow-based YouTube channel, ANTVAuslandsStudio, which has drawn over one million views in the past four months for its German-language videos in praise of life in Russia. 

    In the channel’s first post in October, Mario Rönsch — who has also described himself as Editor-in-Chief of Anonymous News’s website — stood stoically in front of the Kremlin, introducing himself as someone persecuted by German intelligence agencies and committed to delivering portrayals of Russia that are  “authentic, uncensored and always committed to the truth.”

    Katarina Bader, a disinformation expert and professor of online journalism at Stuttgart Media University, said that while more polished influencers might gain more traction, Anonymous News’ posts are still spread widely. She noted how Rönsch — a long-time fixture of Germany’s far-right — appears to have pivoted to a pro-Russia orientation in his new gig.

    “Mario Rönsch ran one of the largest far-right channels; today, he primarily presents himself as pro-Russian. The focus has definitely shifted,” she told OCCRP’s partner paper trail media.

    Since Moscow’s full-blown invasion of Ukraine, Russia has been accused of seeking to manipulate narratives in Europe and the U.S. via right-wing media networks.

    Rönsch, who did not respond to requests to comment, first made a name for himself in 2014 speaking at anti-establishment rallies in Germany known as “Vigils for Peace,” which included far-right figures and conspiracy theorists. In a YouTube video from one of the weekly gatherings, a casually dressed Rönsch called on the cheering crowd to “publicly shame the media.”

    That year Rönsch traveled from Berlin to Moscow, according to leaked border records seen by reporters. The purpose and the length of his trip are not known.

    By the time he made the trip to Russia, a Facebook group called “Anonymous Kollektiv” had also been launched. According to German court documents, Rönsch was the operator.  

    The Facebook group, which disseminated conspiracy theories as well as anti-immigrant and pro-Russian content, reportedly amassed two million followers before it was deleted in May 2016. That same month a successor website, anonymousnews.ru, was established.

    Yet Rönsch was not only in the business of news. By May 2016, he had also launched an online shop called Migrantenschreck — which means “migrant terror” — where he sold more than 170 weapons for almost 100,000 euros to German buyers, according to court documents. In 2018, he was detained by Hungarian police on a German arrest warrant and extradited to stand trial, where he was convicted of firearms trafficking offenses. Rönsch was sentenced to two years and 10 months in prison, but served just over a year before being released for early parole in December 2020.

    Within months of his release, the current version of Anonymous News — anonymousnews.org — appeared online. Reporters found that the new domain shared the same Russian hosting infrastructure as the previous anonymousnews.ru website. 

    Rönsch, who posted on social media last year that he had been traveling in Russia since late 2023, also registered a consulting firm in Russia in 2024. That same year he launched the anonymousnews_org_en Telegram channel, which is an English version of the German channel anonymousnews_org. Today the two channels have more than 76,000 subscribers combined.

    In 2024 and again in 2025, Anonymous News published a post linking to the distribution of hacked documents from the U.K. Foreign Office and the British Embassy in Moscow — material that was also previously shared by Russia’s foreign ministry. 

    Reader Donations Account Leads To Bulgarian Proxy 

    Benno Zogg, an expert on Russian disinformation, said that tracing who is behind pro-Russia influence campaigns in Europe, and who funds them, can rarely be proven beyond doubt — and that advances in technology are making the task even tougher.  

    “Influence activities are not a new phenomenon, but technological developments such as social media and artificial intelligence are exacerbating the challenge,” said Zogg, who is Head of Strategic Affairs and Foresight at the Swiss State Secretariat for Security Policy.

    When reporters looked into one of Anonymous News’ funding streams it took them to an unlikely media company owner who has also been listed as one of the website’s authors. 

    Anonymous News solicits donations from its readers, contributing to its image as an alternative, independent media outlet. Currently, the website says it still needs to raise 102,000 euros to cover editorial expenses for its 2026 budget. 

    Donors are channeled to a PayPal account for the Czech company AN Média a Platební Služby s.r.o. On paper, the company is owned by a Bulgarian man called Ivelin Borisov. Journalists from OCCRP’s Bulgarian member center Bird.bg tracked down Borisov and found the  impoverished 56-year-old living in a rundown house in a remote village.

    Borisov told reporters that he had worked in Germany in the past and had been paid 200 or 300 euros to sign some papers in Czechia. Since then, he said he had heard nothing about “his” company. 

    When he was shown Anonymous News articles with his byline on German-language stories, Borisov said “there’s no way I wrote that.” 

    The company’s documents also list a Czech woman called Magdalena Průšová as AN Media’s “administrator” with power-of-attorney. Průšová told OCCRP’s Czech member center Investigace that she had been working at a company at the time which dealt with setting up firms and confirmed she had escorted Borisov to a notary.  She said a German man she knew only as Mario was behind the company.

    Průšová said that during its first year and a half of operation AN Media received donations of between 10 and 200 euros. 

    “These weren’t big sums — certainly not millions,” she said, but stopped responding to reporters when asked for the financial records.

    AN Media was liquidated last week, more than a year since a Prague municipal court initiated its dissolution proceedings due to the company’s failure to file financial reports. As of publication, Anonymous News still linked to the firm’s PayPal account to collect funds.

    Who Amplifies The Message?

    While reporters’ analysis of Anonymous News’ finances led them on a circuitous route via Bulgaria and Czechia, when they looked at who read its narratives, the path led to Moscow. 

    Russian disinformation relies on dissemination across social media platforms and languages, sometimes involving paid-for troll accounts and bots.

    France’s Viginum said the first X account to share the false Epstein-Macron narrative after the article appeared on the fake France-Soir website frequently amplified “Storm-1516 information operations.” 

    “The narrative was then taken up by a group of accounts known to Viginum,” the agency said in the statement. 

    In the case of Anonymous News, reporters found its articles were frequently shared from its English-language Telegram channel by a Telegram account with the handle Corob_12.

    Reporters from OCCRP’s partner Ukrainian Toronto Television traced the Russian phone number registered to the account to a 38-year-old Russian man named Alexey Bashilov.

    They then found a second phone number registered to Bashilov in leaked data which also showed he ordered food delivery in 2018 from the Moscow address Bolshaya Lubyanka, 1 — the headquarters of Russia’s Federal Security Service (FSB).

    A digital phone book application called Numbuster shows that people have saved one of Bashilov’s numbers as “Lyosha FSB” (a diminutive version of the name Alexey) and “UK Alexey Pashilov.”

    Using additional leaked information, reporters obtained Bashilov’s mobile phone contacts, which included a saved “work” number — a landline registered to Military Unit 43753, which is the FSB’s Center for Information Protection and Special Communications. 

    Other contacts in Bashilov’s phone include individuals with various FSB sub-departments saved alongside their name. 

    Corob_12 also shared posts from a Telegram channel called Woland’s Notes, which is registered to one of Bashilov’s phone numbers as the administrator. 

    This account posts in Russian, but focuses on criticizing Britain and its decision-making around Russia and Ukraine, and also shares posts from Anonymous News. 

    Woland’s Notes only has some 5,200 subscribers, but the channel has high-profile readers. Its content is regularly reposted by Kremlin propagandist and well-known state media TV host Vladimir Solovyov, and the Russian lawmaker Andrei Lugovoi, who, according to a U.K. independent inquiry in 2016, was one of the men who poisoned former FSB officer Alexander Litvinenko in London in 2006.

    Woland’s Notes shared the claim that there was evidence of Macron communicating with Epstein within an hour of the story going up on the website impersonating France-Soir.

    Neither Bashilov nor the FSB responded to journalists’ questions about their relationship with Anonymous News. After reporters sent questions to Bashilov, Corob_12 deleted his account and Woland’s Notes hasn’t posted since.

    Disinformation expert Bader said that while Anonymous News might not have the reach of other pro-Russia channels, it is part of a much wider ecosystem that aims to skew the information landscape through false claims. 

    “Such channels gradually destroy trust in politics and in what they refer to as mainstream media,” Bader said, adding that readers don’t necessarily need to believe in their claims for them to have an effect. 

    “Being regularly exposed to such narratives is enough to end up considering almost everything as potential propaganda,” she said.

    Research support by Misha Gagarin, OCCRP.

  • Mother given wrong antibiotics died from sepsis

    Bank cashier Aleisha Rochester died two weeks after undergoing a routine procedure to remove an abscess.
  • Microsoft Patch Tuesday, March 2026 Edition

    Microsoft Patch Tuesday, March 2026 Edition

    Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.

    Image: Shutterstock, @nwz.

    Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.

    “This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”

    The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.

    It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.

    Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:

    CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
    CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
    CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
    CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).

    Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.

    XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.

    “Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”

    Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.

    Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.

    For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.