“I was able to make a fully patched Windows machine susceptible to thousands of past vulnerabilities, turning fixed vulnerabilities into zero-days”
Alon Leviev hijacked Windows Update with an edited XML action list and rolled critical components back to old, broken versions. Verification steps never noticed. SafeBreach reported it to Microsoft in February. Six months later Microsoft has two CVEs, interim guidance and no fix with a release date. “Fully patched” means whatever Windows Update says it means.