Modalità di lettura

Corsa verso l’abisso. L’uccisione di Renee Good: il volto del trumpismo

Un fischio, poi un altro e un altro ancora: l’ICE è arrivata. Poi arriva la lunga esplosione: fiuuuuuuuu! L’ICE ha preso qualcuno.

Questi sono i codici che i gruppi di pronto intervento a sostegno degli immigrati stanno usando per avvisare i loro vicini e colleghi quando viene avvistata l’ICE e quest’ultima rapisce qualcuno.

Gli agenti federali sono armati in modo militare. Contro di loro, la gente comune ha fischietti, coraggio sconfinato e l’acronimo S.A.L.U.T.E. per le informazioni da raccogliere: le dimensioni (Size) degli schieramenti di agenti federali, le azioni (Actions) che stanno intraprendendo, la posizione (Location) specifica, le uniformi che indossano, il tempo e l’equipaggiamento, o il tipo di armi.

Durante i corsi di formazione organizzati in tutto il Paese, i soccorritori simulano come dimostrare solidarietà agli immigrati e superare la paura per sfidare il terrore. L’attivismo dal basso e l’azione diretta hanno giocato un ruolo fondamentale nella storia popolare degli Stati Uniti, una storia di lotte che hanno portato all’abolizione della schiavitù, assicurato la libertà di organizzazione sindacale e conquistato libertà civili.

La trentasettenne Renee Nicole Good era una paladina della solidarietà e della lotta per la libertà. Come moltissimi altri statunitensi provenienti da ogni ceto sociale, fungeva da occhi e orecchie dei suoi vicini latini e somali, avvisandoli della presenza dell’ICE e di altri agenti federali.

Good, madre di tre figli, faceva parte di un gruppo informale di pronto intervento, ICE Watch, composto dai genitori della scuola paritaria frequentata da suo figlio. “È stata addestrata su come comportarsi con questi agenti dell’ICE: cosa fare, cosa non fare, è un addestramento molto approfondito”, ha detto un genitore al New York Post, un tabloid conservatore che ha cercato di dare un’immagine negativa del suo attivismo. “Ascoltare i segnali, conoscere i propri diritti, fischiare quando si vede un agente dell’ICE”.

L’amministrazione Trump ha descritto Renee Nicole Good come una “terrorista interna”. Ma le persone che conoscevano Good la hanno descritta come una cristiana dichiarata, vedova di un veterano, una donna queer, una cantante e una poeta. “Quello che ho visto nel suo lavoro è stata una scrittrice che stava cercando di illuminare la vita degli altri”, ha detto un’insegnante, descrivendo il suo interesse per la vita degli anziani, dei veterani e di persone provenienti da diversi paesi ed epoche.

Come molti di noi che hanno una vita frenetica ma trovano il tempo per stare accanto agli altri, aveva accompagnato il figlio di sei anni a scuola poco prima che l’ICE la uccidesse. L’analisi delle riprese video da tre angolazioni effettuata dal New York Times mostra che Good sembra allontanare il suo SUV dagli agenti federali mentre l’agente dell’ICE Jonathan Ross cammina davanti al veicolo. Quindi quest’ultimo spara tre colpi a bruciapelo contro il veicolo, uccidendola in pieno giorno non lontano dalla sua abitazione, come si vede nelle riprese.

La sua compagna era sulla scena con lei. “Mercoledì, 7 gennaio, ci siamo fermate per aiutare i nostri vicini. Avevamo dei fischi. Avevano le pistole”, ha detto Rebecca Good in una dichiarazione venerdì. “Abbiamo cresciuto nostro figlio insegnandogli che, indipendentemente dalla propria provenienza o dal proprio aspetto fisico, tutti meritano compassione e gentilezza”.

Lo scorso settembre, il cuoco Silverio Villegas-Gonzalez è stato ucciso a colpi di pistola durante un controllo stradale a Chicago, poco dopo aver accompagnato i suoi due figli all’asilo, mentre presumibilmente tentava di fuggire. Il bracciante agricolo Jaime Alanís García si è rotto il collo a luglio, quando è caduto dal tetto di una serra nella contea di Ventura, in California, mentre tentava di sfuggire alla caccia degli agenti dell’ICE, ed è morto dopo il ricovero in ospedale. Trentadue persone sono morte mentre erano sotto la custodia dell’ICE nel 2025 – l’anno più letale per l’agenzia, ormai trasformata in una forza paramilitare, dalla sua fondazione nel 2003.

A differenza di Villegas-Gonzalez e Garcia, entrambi lavoratori immigrati provenienti dall’America Latina, Good era una cittadina statunitense bianca. Non avrebbe dovuto essere nella lista delle persone che l’ICE ha brutalizzato impunemente a causa della loro origine o del loro status di immigrati. Ma lei si è rifiutata di rimanere a guardare l’ingiustizia e ha protetto i suoi vicini. Non era tenuta a schierarsi, ma lo ha fatto. In realtà, alcuni membri della sua famiglia avrebbero preferito che non lo facesse.

Spesso diciamo che la solidarietà è una pratica molto importante, e Good ha agito, esercitando i diritti che tutti noi abbiamo, indipendentemente dallo status di immigrati, di documentare l’attività violenta della polizia e di esprimere la propria opinione.

Un attivista sindacale ha collegato la sua azione solidale alle lotte operaie. “Nel nostro sindacato abbiamo la tradizione di indossare abiti rossi ogni giovedì per onorare un membro molto speciale della CWA (Communications Workers of America), Gerry Horgan, ucciso mentre esercitava il suo diritto fondamentale di scioperare e partecipare a un picchetto. Proprio come Gerry, Renee Nicole Good è stata uccisa mentre esercitava il suo diritto di esprimersi e di essere solidale con la sua comunità, diritto che dovrebbe essere protetto dalla Costituzione”.

Noi siamo ciò che facciamo. Se la scelta che dobbiamo affrontare è tra Good e ICE, la popolazione di Minneapolis sceglie Good. Si stima che circa 10.000 persone abbiano partecipato a una veglia a lume di candela il 7 gennaio per onorare la sua vita.

La violenza scatenata dall’amministrazione Trump sul suolo statunitense non riuscirà a raggiungere i suoi obiettivi dichiarati.

Nessun personaggio nell’amministrazione USA ha mai avuto tanto potere come Stephen Miller, il consigliere per la sicurezza interna di Trump. Esercita una straordinaria autorità su una fascia insolitamente ampia delle branche di governo, dall’immigrazione alla giustizia penale fino anche alle operazioni militari sul suolo americano. Gran parte di ciò che caratterizza l’era Trump – rapimenti mascherati per le strade degli Stati Uniti, scontri tra gli scagnozzi dell’ICE e i manifestanti, pattuglie militari per le strade degli Stati Uniti – è stato creato da Miller.

Eppure, ora che siamo a un anno dall’inizio del secondo mandato del presidente Trump, è chiaro che, sotto molti aspetti importanti, Miller non sta riuscendo a realizzare i suoi piani autoritari più elaborati. Le espulsioni sono molto indietro rispetto alle sue aspettative. Non è riuscito a convincere Trump a esercitare il potere dittatoriale che tanto desidera vedere. E ha scatenato un movimento culturale in difesa degli immigrati che è più potente di quanto avesse previsto.

Il sogno di Miller di 3.000 arresti giornalieri rimane questo: un sogno. Miller spera di deportare un milione di persone all’anno, ma con il tasso attuale non si avvicinerà a questo. Mentre l’amministrazione sta ancora aumentando il personale dell’ICE, e le deportazioni potrebbero aumentare, molti esperti si aspettano che Miller resti molto al di sotto dell’obiettivo di un milione di deportazioni all’anno nel corso dell’intero mandato di Donald Trump.

Ma l’obiettivo del governo USA va oltre il numero delle deportazioni.

Molti settori produttivi sarebbero nei guai se il governo andasse davvero avanti con le sue deportazioni di massa annunciate. La caccia ai migranti e il modo brutale e arbitrario in cui viene effettuata (gli arresti dei migranti sono fatti davanti alle telecamere come per pubblicizzare la loro pericolosità) sembra progettata per diffondere la paura e per dividere la classe operaia. La paura (dei migranti, del crimine, della violenza, delle minoranze, dei poveri, del decadimento morale e altro) è costantemente alimentata e giustapposta all’immagine rassicurante del potente leader fiducioso e della sua squadra di guerrieri senza paura. L’amministrazione Trump diffonde paura ovunque. Nella popolazione in genere per creare la paura dell’estraneo infiltrato all’interno della comunità nazionale, che farà la fine del capro espiatorio, e perseguitando questo capro espiatorio la maggioranza della popolazione viene compattata dalla paura su un terreno comune. Così si forma una falsa comunità e si evita il pericolo di una classe operaia unificata.

L’esperienza del nazismo in Germania ci mostra quanto sia importante il processo di esclusione di un capro espiatorio interno nel forgiare la volksgemeinschaft, la comunità del popolo. Quella che sta combattendo l’amministrazione Trump è una una battaglia ideologica per creare una comunità nazionale, una “volksgemeinschaft” che è disposta a combattere e morire per il capitale. Si tratta di un attacco alle spinte verso l’unità e l’autonomia della classe operaia, un elemento fondamentale della preparazione alla guerra, che non è solo preparazione militare, ma soprattutto attacco alle forze antimilitariste e internazionaliste.

Di fronte all’arroganza dell’amministrazione e alla marcia verso la guerra, è incoraggiante vedere quanto rapidamente siano apparse reazioni spontanee e intense contro i raid dell’ICE a Los Angeles, New York e Chicago. Anche l’organizzazione di quartiere (allertando una rete di attivisti solidali quando agenti dell’ICE entrano in un’area) si è diffusa nelle città. Lo stesso assassinio di Renee Good è frutto della reazione governativa a questa mobilitazione dal basso, mentre le reazioni che ha provocato in tante città americane testimonia la profondità del movimento.

Il governo Trump usa qualsiasi pretesto per espandere i suoi mezzi repressivi e per abituare la popolazione alla presenza dei militari nelle strade. Anche questa è la preparazione alla guerra. Trump ha detto che le grandi città sarebbero un buon campo di addestramento per i militari. È convinto che una terribile repressione entusiasmerà il suo esercito MAGA e intimidirà i suoi avversari. È la costruzione della nazione per salvare la civiltà occidentale. Nel frattempo quella civiltà produce la bolla dell’IA, la bolla delle criptovalute, il banking ombra e molti altri fenomeni che portano all’abisso. Trump potrebbe essere l’Hoover, il presidente repubblicano della crisi del 1929, dei nostri giorni. Ma è stato il successore “progressista” di Hoover, il democratico Franklin Delano Roosevelt che si è rivelato il più grande ostacolo alla crescita della coscienza di classe autonoma del proletariato.

Avis Everhard

L'articolo Corsa verso l’abisso. L’uccisione di Renee Good: il volto del trumpismo proviene da .

  •  

A Black Teen Died Over a $12 Shoplifting Attempt. 13 Years Later, Two Men Plead Guilty in His Killing.

A judge in Milwaukee brought a 13-year quest for justice by a grieving father to a close on Thursday, accepting a plea deal for two men charged criminally for their role in the killing of his teenaged son. 

Robert W. Beringer and Jesse R. Cole pleaded guilty to felony murder under a deferred prosecution agreement that allows them to avoid jail time yet publicly stand accountable for their actions leading to the 2012 death of Corey Stingley. The men helped restrain the 16-year-old inside a convenience store after an attempted shoplifting incident involving $12 worth of alcohol.

“What happened to Corey Stingley should have never happened. His death was unnecessary, brutal and devastating,” Dane County District Attorney Ismael Ozanne told the judge in a letter filed with the court. 

Both of Stingley’s parents spoke directly to the judge in an hourlong hearing in a courtroom filled with family members, community activists, spiritual leaders and some of the teen’s former classmates. 

“Corey was my baby. A mother is not supposed to bury her child,” Alicia Stingley told the judge. She spoke of the grace of forgiveness, and after the hearing she hugged Beringer. The Stingleys’ surviving son, Cameron, shook both men’s hands. 

The agreement requires Cole and Beringer to make a one-time $500 donation each to a charitable organization of the Stingley family’s choosing in honor of Corey. After six months, if the two men comply with the terms and do not commit any crimes, the prosecution will dismiss the case, according to documents filed with the court. 

ProPublica, in a 2023 story, reexamined the incident, the legal presumptions, the background of the men and Stingley’s father’s relentless legal campaign to bring the men into court. The three men previously had defended their actions as justified and necessary to deal with an emergency as they held Stingley while waiting for police to arrive.

Ozanne, who was appointed in 2022 to review the case, recommended the agreement after the two men and the Stingley family engaged in an extensive restorative justice process, in which they sat face to face, under the supervision of a retired judge, and shared their thoughts and feelings. Ozanne said in the letter that the process “appears to have been healing for all involved.”

From the bench, Milwaukee County Circuit Court Judge Laura Crivello said she found the agreement to be fair and just and commended the work of all the parties to come to a resolution. 

“Maybe this is the spark that makes other people see similarities in each other and not differences,” she said. “Maybe this is the spark that makes them think about restorative justice and how do we come together. And maybe this is part of the spark that decreases the violence in our community and leads us to finding the paths to have those circles to sit down and have the dialogue and to have that conversation. So maybe there’s some good that comes out of it.”

Craig Stingley, Corey’s father, said during the hearing that his 13-year struggle “has turned into triumph.” 

Earlier, the Stingley family filed a statement with the court affirming its support for the agreement and the restorative justice process. 

“We sought not vengeance, but acknowledgement — of Corey’s life, his humanity, and the depth of our loss,” it states. “We believe this agreement honors Corey’s memory and offers a model of how people can come together, even after profound harm, to seek understanding and healing.” 

The family remembered Stingley as a “vibrant, loving son, brother, and friend” and found that the restorative dialogues brought “truth, understanding, and a measure of healing that the traditional court process could not.” 

Jonathan LaVoy, Cole’s attorney, told reporters after the hearing: “This has been a long 13 years. He’s been under investigation with multiple reviews over that time. I think everyone is just so happy that this day has come, that there’s been some finality to this whole situation.” 

In a joint written statement provided to the court, Beringer and Cole said they came to recognize “the profound ripple effects” of the incident and their connection to Stingley’s death. They expressed sorrow that Stingley’s “time on this earth ended far too soon.”

The proceeding followed years of work by Craig Stingley to force the justice system to view his son as a crime victim whose life was unlawfully cut short by Beringer, Cole and another store patron, Mario Laumann, who died in 2022. 

Prosecutors at the time declined to charge anyone, saying the men did not intend to kill Corey Stingley when they tackled him and pinned him to the floor of VJ’s Food Mart, in West Allis, Wisconsin. They were detaining him for police after the youth attempted to steal bottles of Smirnoff Ice. In surveillance video, Laumann can be seen holding Stingley in a chokehold while the other two men aided in restraining him. A witness told police Laumann was “squeezing the hell” out of the teenager.

The Milwaukee County Medical Examiner’s Office found that Stingley died of a brain injury due to asphyxiation after a “violent struggle with multiple individuals.” It ruled the death a homicide.

Under Wisconsin law, the charge of felony murder is brought in cases in which someone dies during the commission of another alleged crime — in this case false imprisonment. 

Ozanne wrote to the court that his analysis found that “there is no doubt Cole, Beringer and Laumann caused Corey Stingley’s death.”

All three men, he wrote, restrained Stingley “intentionally and without his consent” and without legal authority to “arrest” him. “Simply put, Corey, a teenager, was tackled and restrained to the ground by three grown men because they suspected him of shoplifting,” Ozanne wrote. “They killed him while piled on top of his body awaiting the police.” 

But he noted that there is no evidence that Beringer or Cole knew that Stingley was in medical distress during the incident. He described their hold on him as “rudimentary detention techniques.” 

It was Laumann, Ozanne concluded, who “strangled Corey Stingley to death.” Ozanne wrote that surveillance video shows Laumann’s arm for several minutes across Stingley’s neck “as he fades out of consciousness.” 

If Laumann were still alive, Ozanne said in court, prosecutors likely would have been seeking a lengthy prison term for him.

A bearded and bald man, wearing a white blazer seated in a courtroom with people behind him.
Defendant Jesse Cole sits in the courtroom on Thursday before a hearing on his case. Taylor Glascock for ProPublica
A man wearing a face mask, glasses and a jacket over a sweatshirt enters a courtroom while carrying a camouflage baseball hat.
Defendant Robert Beringer walks into the Milwaukee County courtroom. Taylor Glascock for ProPublica

Stingley died the same year as Trayvon Martin, a Black Florida teen shot to death by a neighborhood volunteer watchman, who was acquitted in 2013. Martin’s case drew national attention and led to the formation of the Black Lives Matter movement. But Stingley’s death after being restrained by three white men did not garner widespread notice outside Wisconsin. 

Over the years, Craig Stingley unsuccessfully advocated for the men to face charges. Two prosecutors reviewed the case, but nothing came of it. 

He then discovered an obscure “John Doe” statute, dating back to Wisconsin’s territorial days, that allows a private citizen to ask a judge to consider whether a crime has been committed and, if so, by whom when a district attorney can’t or won’t do so.

Stingley filed such a petition in late 2020. That led to the appointment of Ozanne as a special prosecutor to review the matter yet again. In 2024, Ozanne informed the Stingley family that his office had found evidence of a crime but that a guilty verdict was not assured for the remaining two men.

That set in motion an effort to achieve healing and accountability through a restorative justice process. Restorative justice programs bring together survivors and offenders for conversations, led by trained facilitators, to work toward understanding and healing and how best to make amends. Last year, Stingley and members of his family met on separate occasions with both Cole and Beringer through the Andrew Center for Restorative Justice, part of the law school at Milwaukee’s Marquette University. 

The discussions led to the deferred prosecution agreement.

In an interview, Anthony Neff, a longtime friend of Craig Stingley’s, recalled seeing Corey Stingley in a hospital bed, attached to tubes and a ventilator in his final days. Corey Stingley had been a running back on his high school football team. Everyone in the program showed up for the funeral, Neff said. 

“Coaches. The ball boys. The cheerleaders. I mean, they’re all standing in solidarity with Craig and the family,” he said. 

In the years since, he and other golfing buddies of Craig Stingley’s have provided emotional support in his quest. Neff called it “a lesson in civics, a master lesson in civics.”

The post A Black Teen Died Over a $12 Shoplifting Attempt. 13 Years Later, Two Men Plead Guilty in His Killing. appeared first on ProPublica.

  •  

Patch Tuesday, January 2026 Edition

Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.

January’s Microsoft zero-day flaw — CVE-2026-20805 — is brought to us by a flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Kev Breen, senior director of cyber threat research at Immersive, said despite awarding CVE-2026-20805 a middling CVSS score of 5.5, Microsoft has confirmed its active exploitation in the wild, indicating that threat actors are already leveraging this flaw against organizations.

Breen said vulnerabilities of this kind are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits.

“By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack,” Breen said. “Microsoft has not disclosed which additional components may be involved in such an exploit chain, significantly limiting defenders’ ability to proactively threat hunt for related activity. As a result, rapid patching currently remains the only effective mitigation.”

Chris Goettl, vice president of product management at Ivanti, observed that CVE-2026-20805 affects all currently supported and extended security update supported versions of the Windows OS. Goettl said it would be a mistake to dismiss the severity of this flaw based on its “Important” rating and relatively low CVSS score.

“A risk-based prioritization methodology warrants treating this vulnerability as a higher severity than the vendor rating or CVSS score assigned,” he said.

Among the critical flaws patched this month are two Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) that can be triggered just by viewing a booby-trapped message in the Preview Pane.

Our October 2025 Patch Tuesday “End of 10” roundup noted that Microsoft had removed a modem driver from all versions after it was discovered that hackers were abusing a vulnerability in it to hack into systems. Adam Barnett at Rapid7 said Microsoft today removed another couple of modem drivers from Windows for a broadly similar reason: Microsoft is aware of functional exploit code for an elevation of privilege vulnerability in a very similar modem driver, tracked as CVE-2023-31096.

“That’s not a typo; this vulnerability was originally published via MITRE over two years ago, along with a credible public writeup by the original researcher,” Barnett said. “Today’s Windows patches remove agrsm64.sys and agrsm.sys. All three modem drivers were originally developed by the same now-defunct third party, and have been included in Windows for decades. These driver removals will pass unnoticed for most people, but you might find active modems still in a few contexts, including some industrial control systems.”

According to Barnett, two questions remain: How many more legacy modem drivers are still present on a fully-patched Windows asset; and how many more elevation-to-SYSTEM vulnerabilities will emerge from them before Microsoft cuts off attackers who have been enjoying “living off the land[line] by exploiting an entire class of dusty old device drivers?”

“Although Microsoft doesn’t claim evidence of exploitation for CVE-2023-31096, the relevant 2023 write-up and the 2025 removal of the other Agere modem driver have provided two strong signals for anyone looking for Windows exploits in the meantime,” Barnett said. “In case you were wondering, there is no need to have a modem connected; the mere presence of the driver is enough to render an asset vulnerable.”

Immersive, Ivanti and Rapid7 all called attention to CVE-2026-21265, which is a critical Security Feature Bypass vulnerability affecting Windows Secure Boot. This security feature is designed to protect against threats like rootkits and bootkits, and it relies on a set of certificates that are set to expire in June 2026 and October 2026. Once these 2011 certificates expire, Windows devices that do not have the new 2023 certificates can no longer receive Secure Boot security fixes.

Barnett cautioned that when updating the bootloader and BIOS, it is essential to prepare fully ahead of time for the specific OS and BIOS combination you’re working with, since incorrect remediation steps can lead to an unbootable system.

“Fifteen years is a very long time indeed in information security, but the clock is running out on the Microsoft root certificates which have been signing essentially everything in the Secure Boot ecosystem since the days of Stuxnet,” Barnett said. “Microsoft issued replacement certificates back in 2023, alongside CVE-2023-24932 which covered relevant Windows patches as well as subsequent steps to remediate the Secure Boot bypass exploited by the BlackLotus bootkit.”

Goettl noted that Mozilla has released updates for Firefox and Firefox ESR resolving a total of 34 vulnerabilities, two of which are suspected to be exploited (CVE-2026-0891 and CVE-2026-0892). Both are resolved in Firefox 147 (MFSA2026-01) and CVE-2026-0891 is resolved in Firefox ESR 140.7 (MFSA2026-03).

“Expect Google Chrome and Microsoft Edge updates this week in addition to a high severity vulnerability in Chrome WebView that was resolved in the January 6 Chrome update (CVE-2026-0628),” Goettl said.

As ever, the SANS Internet Storm Center has a per-patch breakdown by severity and urgency. Windows admins should keep an eye on askwoody.com for any news about patches that don’t quite play nice with everything. If you experience any issues related installing January’s patches, please drop a line in the comments below.

  •  

A Father’s Quest for Justice Finds Resolution After 13 Years

The quest for justice dominated his life. 

He gathered police reports, witness statements and other evidence in the Dec. 14, 2012, fatal incident inside a Milwaukee-area convenience store. The youth had tried to shoplift $12 worth of flavored malt beverages at the shop before abandoning the items and turning to leave. That’s when three men wrestled him to the ground to hold him for the police. 

The medical examiner determined that he died of a brain injury from asphyxiation after a “violent struggle with multiple individuals.” The manner of death: homicide. 

When prosecutors chose not to charge anyone, Stingley waged a legal campaign of his own that forced the case to be reexamined. A 2023 ProPublica investigation pieced together a detailed timeline of what happened inside the store, recounted what witnesses saw and examined the backgrounds of the three customers involved in the altercation.

Finally, this week, in an extraordinary turn of events, Stingley will see a measure of accountability. On Monday, a criminal complaint filed in Milwaukee County Circuit Court charged the surviving patrons — Robert W. Beringer and Jesse R. Cole — with felony murder. The defendants are set to appear in court on Thursday. 

Beringer’s attorney, Tony Cotton, described the broad outlines of a deferred prosecution agreement that can lead to the charges being dismissed after the two men plead guilty or no contest. The men may be required by the court to make a contribution to a charity in honor of Corey Stingley and to perform community service, avoiding prison time, according to Cotton and Craig Stingley.

In Wisconsin, felony murder is a special category for incidents in which the commission of a serious crime — in this case, false imprisonment — causes the death of another person. The prosecutor’s office in Dane County, which is handling the matter, declined to comment. Cole’s attorney said his client had no comment. Previously, the three men have argued that their actions were justified, citing self-defense and their need to respond to an emergency. 

For Stingley, a key part of the accountability process already has taken place. Last year, as part of a restorative justice program and under the supervision of a retired judge, Stingley and the two men interacted face to face in separate meetings.

There, inside an office on a Milwaukee college campus, they confronted the traumatic events that led to Corey Stingley’s death and the still-roiling feelings of resentment, sorrow and pain. 

Craig Stingley said he felt that, after years of downplaying their role, the men showed regret and a deeper understanding of what had happened. For instance, Stingley said, he and Cole aired out their different perspectives on what occurred and even reviewed store surveillance video together. 

“I have never been able to breathe as clearly and as deeply and feel as free as I have after that meeting was over,” Stingley said. 

Restorative justice programs bring together survivors and offenders — via meetings or letters or through community panels — to try to deepen understanding, promote healing and discuss how best to make amends for a wide range of harms. The approach has been used by schools and juvenile and criminal justice systems, as well as nations grappling with large-scale atrocities.

Situations where restorative justice and deferred prosecution are employed for such serious charges are rare, Cotton said. But, he said, the whole case is rare — from the prosecution declining to issue charges initially to holding it open for multiple reviews over a decade. 

“Our hearts go out to the Stingley family, and we believe that the restorative justice process has allowed all sides to express their feelings openly,” Cotton said. “We are glad that a fair and just outcome has been achieved.”

Large pillars on the exterior of the Milwaukee County Courthouse in downtown Milwaukee, Wisconsin.
A medical examiner determined that Corey Stingley died of a brain injury from asphyxiation after an altercation with three men at a convenience store in 2012. Prosecutors assigned to the case declined to press charges. Taylor Glascock for ProPublica

The Legal Quest

Milwaukee’s district attorney at the time of Corey Stingley’s death, John Chisholm, announced there would be no charges 13 months later, in January 2014. Cole, Beringer and a third man, Mario Laumann, now deceased, were not culpable because they did not intend to injure or kill the teen and weren’t trained in proper restraint techniques, Chisholm determined. 

Craig Stingley, who is Black, and others in the community protested the decision, claiming the three men — all white — were not good Samaritans but had acted violently to kill a Black youth with impunity. “When a person loses his life at the hands of others, it would seem that a ‘chargeable’ offense has occurred,” the Milwaukee branch of the NAACP said in a statement at the time.

Looking for a way to reopen the case, Stingley reexamined the evidence, including security video. In a painful exercise, he watched the takedown of his son, by his estimation hundreds of times, analyzing who did what, frame by frame. What he saw only reinforced his view that his son’s death was unnecessary and his right to due process denied.

Corey Stingley and his father lived only blocks from VJ’s Food Mart, in West Allis, Wisconsin. That December day, Stingley made his way to the back of the store and stuck six bottles of Smirnoff Ice into his backpack. At the front counter, the teenager provided his debit card to pay for an energy drink, but the clerk demanded the stolen items. Stingley surrendered the backpack, reached toward the cash register to recover his debit card, then turned to exit.

Cole told police he extended his hand to stop Stingley and claimed that the teen punched him in the face, though it is not evident on the video. The three men grabbed the youth. During a struggle, the men pinned Stingley to the floor. 

Laumann kept Stingley in a chokehold, several witnesses told investigators. ProPublica later discovered that Laumann had been a Marine. His brother told ProPublica he likely learned how to apply chokeholds as part of his military service decades ago. 

Beringer had Stingley by the hair and was pressing on the teen’s head, a witness told authorities. Cole helped to hold Stingley down. Eventually, Stingley stopped resisting. The police report states that Cole thought the teen was “playing limp” to trick them into loosening their grip.

“Get up, you punk!” Laumann told the motionless teen when an officer finally arrived, according to a police report. Stingley was foaming at the mouth and had urinated through his clothes. The officer couldn’t find a pulse. Stingley never regained consciousness, dying at a hospital two weeks later.

Four young people smiling in a black-and-white family portrait.
Corey Stingley, far right, with his siblings in a 2010 portrait. He was 16 at the time of his death. Courtesy of Craig Stingley

Craig Stingley unsuccessfully sought a meeting with Chisholm in 2015 to discuss the lack of charges. “Feel free to seek legal advice in the private sector regarding your Constitutional Rights,” an assistant to Chisholm replied to Stingley in an email. “I extend my deepest sympathy to you and your family!”

Stingley’s review of the video, however, did bring about another legal opportunity in 2017, after he notified West Allis police that there was footage showing Laumann with his arm around the teen’s throat. (Laumann had denied putting him in a headlock.) A Racine County district attorney was appointed to review the evidence again. She issued no report for three years, until pressed by the court, then concluded that no charges were warranted. 

Finally, Stingley discovered an obscure Wisconsin “John Doe” statute. It allows private citizens to petition a judge to consider whether a crime had been committed if a district attorney refuses to issue a criminal complaint.

A former process engineer for an electrical transformer manufacturer, Stingley had no legal training. Still, in November 2020, he filed a 14-page petition with the then-chief judge of the Milwaukee County Circuit Court, Mary Triggiano. It cited legal authority and “material facts,” including excerpts from police reports, witness statements and stills from the surveillance video. Stingley quoted former U.S. Supreme Court Justice Louis Brandeis in the petition and the British statesman William Gladstone: “Justice delayed is justice denied.”

That led to the appointment in July 2022 of Dane County District Attorney Ismael Ozanne to review the case. But that process was slowed by procedural hurdles. Stingley took the delays in stride, saying he trusted that Ozanne and his staff were treating the matter seriously and acting appropriately.

In 2024, Stingley said, Ozanne’s office advised him that they had found sufficient evidence to issue charges against Cole and Beringer but could not guarantee that a jury would deliver a guilty verdict. Stingley, researching the family’s options, said he inquired about the restorative justice process. The DA’s office supported the idea, arranging for him and the two men to meet under the supervision of the Andrew Center for Restorative Justice, part of the law school at Milwaukee’s Marquette University. The program is run by Triggiano, who’d retired from the court.

The concept of restorative justice can be traced back to indigenous cultures, where people sat together to talk through conflict and solve problems. It emerged in the United States in criminal justice systems in the 1970s as a way to provide alternatives to prison and restitution to victims. Elsewhere, it has notably been used to address the aftermath of genocide in Rwanda, where beginning in 2002 truth-telling forums led to forgiveness and reconciliation.

Stingley, who has three remaining grown children and four grandchildren, desperately wanted “balance restored” for his family. He decided the best path forward was to meet with the men he considered responsible for his son’s death.

A bald man wearing blue-and-red winter clothing over a white T-shirt holds a sign with the photo of a young man while standing in front of the Milwaukee County Courthouse.
Stingley now sees the charges as a message of accountability in his son’s case. Taylor Glascock for ProPublica

The Quest for Closure

Stingley brought photos of Corey to the restorative justice meeting with Berringer in April.

The goal: to respectfully share their perspectives on the tragedy and how it impacted each of them personally. What was said was not recorded or transcribed. It was not for use in any court proceeding. 

The sessions began with the Stingley family sharing heartfelt stories about Corey as a son, brother, student and friend. They spoke of their great bond, Corey’s love of sports and their struggle to cope with his absence. 

When discussion turned to what happened in the store, Stingley said, Berringer described having only faint memories of the fatal encounter. He recalled a brief struggle and grabbing the teen by his jacket, not his hair. 

Before departing the meeting, a tearful Beringer told Stingley he was looking for peace, Stingley recalled.

Cotton, Beringer’s attorney, told ProPublica that the incident and the legal steps affected his client in profound ways. “He’s had anxiety really from this from day one,” Cotton said.

The result, he said: “Sleeplessness. Horrible anxiety. Fearful because he has to go to court.”

Does the resolution ease Beringer’s mind? “I don’t know,” Cotton said, adding that the hope is that the Stingley family finds solace in the resolution process.

Cole, in a meeting in May with Stingley and some of his family, brought a gift: a pair of angel wings on a gold chain with a small “C” charm and several clear reflective orbs. With it came a handwritten note, saying: “I hope this sun catcher brings a gentle reflection of the love & light of Corey’s memory and that you feel his presence shining on you each day.” 

“I told him I appreciate the gesture,” Stingley said.

Cole, according to Stingley, told him that he felt something other than the altercation — perhaps some health ailment — led to Corey’s demise.

Stingley invited Cole to watch the surveillance video together at a second session. As that day neared, in July, Stingley considered backing out. “It was almost as if I had to drag myself up out of the car,” he said. But he said he realized that he’d been preparing for such an event for 13 years: to come to some honest reckoning with the men involved. 

After watching the video, he and Cole reviewed the death certificate, showing the medical examiner’s conclusions. Stingley said Cole stressed that he did not choke Corey but came to realize that what happened in the store caused the teen to lose his life, not any preexisting condition. The acknowledgment eased Stingley’s burden.

“I felt like I was reaching a place where I was finally going to get the justice that I’ve been pursuing,” Stingley said, “and this is one of the steps I had to go through to get that completed.”

Triggiano commended each of the participants for their courage in meeting and the Stingley family for “seeking the humanity of their son as opposed to vengeance.” She said Beringer and Cole “keenly listened, reflected and really acknowledged their connection to the events that led to Corey’s death.” 

“The conversations were emotional and difficult but deeply human,” she said.

After the loss of his son, Stingley wanted to see the three men imprisoned. But so many years later, justice now looks different. Now Laumann is dead. Beringer is changed by the experience. And Cole is a father eager to protect his own children. 

Now, in Stingley’s eyes, prison is beside the point. Criminal charges will stand instead as a strong signal of accountability, of justice — and of a father’s unyielding love.

The post A Father’s Quest for Justice Finds Resolution After 13 Years appeared first on ProPublica.

  •  

GitHub ha disabilitato il repository Rockchip MPP dopo che FFmpeg ha reclamato il copyright sul codice

Storie di open-source, verrebbe da dire, e quella che raccontiamo è una storia che fa riflettere a proposito della riusabilità del codice, delle licenze e di tutta una serie di questioni che molte volte vengono date per scontate, ma non lo sono affatto. La notizia, riportata da Linuxiac, è molto semplice: GitHub ha reso inaccessibile...

  •  

Who Benefited from the Aisuru and Kimwolf Botnets?

Our first story of 2026 revealed how a destructive new botnet called Kimwolf has infected more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, we’ll dig through digital clues left behind by the hackers, network operators and services that appear to have benefitted from Kimwolf’s spread.

On Dec. 17, 2025, the Chinese security firm XLab published a deep dive on Kimwolf, which forces infected devices to participate in distributed denial-of-service (DDoS) attacks and to relay abusive and malicious Internet traffic for so-called “residential proxy” services.

The software that turns one’s device into a residential proxy is often quietly bundled with mobile apps and games. Kimwolf specifically targeted residential proxy software that is factory installed on more than a thousand different models of unsanctioned Android TV streaming devices. Very quickly, the residential proxy’s Internet address starts funneling traffic that is linked to ad fraud, account takeover attempts and mass content scraping.

The XLab report explained its researchers found “definitive evidence” that the same cybercriminal actors and infrastructure were used to deploy both Kimwolf and the Aisuru botnet — an earlier version of Kimwolf that also enslaved devices for use in DDoS attacks and proxy services.

XLab said it suspected since October that Kimwolf and Aisuru had the same author(s) and operators, based in part on shared code changes over time. But it said those suspicions were confirmed on December 8 when it witnessed both botnet strains being distributed by the same Internet address at 93.95.112[.]59.

Image: XLab.

RESI RACK

Public records show the Internet address range flagged by XLab is assigned to Lehi, Utah-based Resi Rack LLC. Resi Rack’s website bills the company as a “Premium Game Server Hosting Provider.” Meanwhile, Resi Rack’s ads on the Internet moneymaking forum BlackHatWorld refer to it as a “Premium Residential Proxy Hosting and Proxy Software Solutions Company.”

Resi Rack co-founder Cassidy Hales told KrebsOnSecurity his company received a notification on December 10 about Kimwolf using their network “that detailed what was being done by one of our customers leasing our servers.”

“When we received this email we took care of this issue immediately,” Hales wrote in response to an email requesting comment. “This is something we are very disappointed is now associated with our name and this was not the intention of our company whatsoever.”

The Resi Rack Internet address cited by XLab on December 8 came onto KrebsOnSecurity’s radar more than two weeks before that. Benjamin Brundage is founder of Synthient, a startup that tracks proxy services. In late October 2025, Brundage shared that the people selling various proxy services which benefitted from the Aisuru and Kimwolf botnets were doing so at a new Discord server called resi[.]to.

On November 24, 2025, a member of the resi-dot-to Discord channel shares an IP address responsible for proxying traffic over Android TV streaming boxes infected by the Kimwolf botnet.

When KrebsOnSecurity joined the resi[.]to Discord channel in late October as a silent lurker, the server had fewer than 150 members, including “Shox” — the nickname used by Resi Rack’s co-founder Mr. Hales — and his business partner “Linus,” who did not respond to requests for comment.

Other members of the resi[.]to Discord channel would periodically post new IP addresses that were responsible for proxying traffic over the Kimwolf botnet. As the screenshot from resi[.]to above shows, that Resi Rack Internet address flagged by XLab was used by Kimwolf to direct proxy traffic as far back as November 24, if not earlier. All told, Synthient said it tracked at least seven static Resi Rack IP addresses connected to Kimwolf proxy infrastructure between October and December 2025.

Neither of Resi Rack’s co-owners responded to follow-up questions. Both have been active in selling proxy services via Discord for nearly two years. According to a review of Discord messages indexed by the cyber intelligence firm Flashpoint, Shox and Linus spent much of 2024 selling static “ISP proxies” by routing various Internet address blocks at major U.S. Internet service providers.

In February 2025, AT&T announced that effective July 31, 2025, it would no longer originate routes for network blocks that are not owned and managed by AT&T (other major ISPs have since made similar moves). Less than a month later, Shox and Linus told customers they would soon cease offering static ISP proxies as a result of these policy changes.

Shox and Linux, talking about their decision to stop selling ISP proxies.

DORT & SNOW

The stated owner of the resi[.]to Discord server went by the abbreviated username “D.” That initial appears to be short for the hacker handle “Dort,” a name that was invoked frequently throughout these Discord chats.

Dort’s profile on resi dot to.

This “Dort” nickname came up in KrebsOnSecurity’s recent conversations with “Forky,” a Brazilian man who acknowledged being involved in the marketing of the Aisuru botnet at its inception in late 2024. But Forky vehemently denied having anything to do with a series of massive and record-smashing DDoS attacks in the latter half of 2025 that were blamed on Aisuru, saying the botnet by that point had been taken over by rivals.

Forky asserts that Dort is a resident of Canada and one of at least two individuals currently in control of the Aisuru/Kimwolf botnet. The other individual Forky named as an Aisuru/Kimwolf botmaster goes by the nickname “Snow.”

On January 2 — just hours after our story on Kimwolf was published — the historical chat records on resi[.]to were erased without warning and replaced by a profanity-laced message for Synthient’s founder. Minutes after that, the entire server disappeared.

Later that same day, several of the more active members of the now-defunct resi[.]to Discord server moved to a Telegram channel where they posted Brundage’s personal information, and generally complained about being unable to find reliable “bulletproof” hosting for their botnet.

Hilariously, a user by the name “Richard Remington” briefly appeared in the group’s Telegram server to post a crude “Happy New Year” sketch that claims Dort and Snow are now in control of 3.5 million devices infected by Aisuru and/or Kimwolf. Richard Remington’s Telegram account has since been deleted, but it previously stated its owner operates a website that caters to DDoS-for-hire or “stresser” services seeking to test their firepower.

BYTECONNECT, PLAINPROXIES, AND 3XK TECH

Reports from both Synthient and XLab found that Kimwolf was used to deploy programs that turned infected systems into Internet traffic relays for multiple residential proxy services. Among those was a component that installed a software development kit (SDK) called ByteConnect, which is distributed by a provider known as Plainproxies.

ByteConnect says it specializes in “monetizing apps ethically and free,” while Plainproxies advertises the ability to provide content scraping companies with “unlimited” proxy pools. However, Synthient said that upon connecting to ByteConnect’s SDK they instead observed a mass influx of credential-stuffing attacks targeting email servers and popular online websites.

A search on LinkedIn finds the CEO of Plainproxies is Friedrich Kraft, whose resume says he is co-founder of ByteConnect Ltd. Public Internet routing records show Mr. Kraft also operates a hosting firm in Germany called 3XK Tech GmbH. Mr. Kraft did not respond to repeated requests for an interview.

In July 2025, Cloudflare reported that 3XK Tech (a.k.a. Drei-K-Tech) had become the Internet’s largest source of application-layer DDoS attacks. In November 2025, the security firm GreyNoise Intelligence found that Internet addresses on 3XK Tech were responsible for roughly three-quarters of the Internet scanning being done at the time for a newly discovered and critical vulnerability in security products made by Palo Alto Networks.

Source: Cloudflare’s Q2 2025 DDoS threat report.

LinkedIn has a profile for another Plainproxies employee, Julia Levi, who is listed as co-founder of ByteConnect. Ms. Levi did not respond to requests for comment. Her resume says she previously worked for two major proxy providers: Netnut Proxy Network, and Bright Data.

Synthient likewise said Plainproxies ignored their outreach, noting that the Byteconnect SDK continues to remain active on devices compromised by Kimwolf.

A post from the LinkedIn page of Plainproxies Chief Revenue Officer Julia Levi, explaining how the residential proxy business works.

MASKIFY

Synthient’s January 2 report said another proxy provider heavily involved in the sale of Kimwolf proxies was Maskify, which currently advertises on multiple cybercrime forums that it has more than six million residential Internet addresses for rent.

Maskify prices its service at a rate of 30 cents per gigabyte of data relayed through their proxies. According to Synthient, that price range is insanely low and is far cheaper than any other proxy provider in business today.

“Synthient’s Research Team received screenshots from other proxy providers showing key Kimwolf actors attempting to offload proxy bandwidth in exchange for upfront cash,” the Synthient report noted. “This approach likely helped fuel early development, with associated members spending earnings on infrastructure and outsourced development tasks. Please note that resellers know precisely what they are selling; proxies at these prices are not ethically sourced.”

Maskify did not respond to requests for comment.

The Maskify website. Image: Synthient.

BOTMASTERS LASH OUT

Hours after our first Kimwolf story was published last week, the resi[.]to Discord server vanished, Synthient’s website was hit with a DDoS attack, and the Kimwolf botmasters took to doxing Brundage via their botnet.

The harassing messages appeared as text records uploaded to the Ethereum Name Service (ENS), a distributed system for supporting smart contracts deployed on the Ethereum blockchain. As documented by XLab, in mid-December the Kimwolf operators upgraded their infrastructure and began using ENS to better withstand the near-constant takedown efforts targeting the botnet’s control servers.

An ENS record used by the Kimwolf operators taunts security firms trying to take down the botnet’s control servers. Image: XLab.

By telling infected systems to seek out the Kimwolf control servers via ENS, even if the servers that the botmasters use to control the botnet are taken down the attacker only needs to update the ENS text record to reflect the new Internet address of the control server, and the infected devices will immediately know where to look for further instructions.

“This channel itself relies on the decentralized nature of blockchain, unregulated by Ethereum or other blockchain operators, and cannot be blocked,” XLab wrote.

The text records included in Kimwolf’s ENS instructions can also feature short messages, such as those that carried Brundage’s personal information. Other ENS text records associated with Kimwolf offered some sage advice: “If flagged, we encourage the TV box to be destroyed.”

An ENS record tied to the Kimwolf botnet advises, “If flagged, we encourage the TV box to be destroyed.”

Both Synthient and XLabs say Kimwolf targets a vast number of Android TV streaming box models, all of which have zero security protections, and many of which ship with proxy malware built in. Generally speaking, if you can send a data packet to one of these devices you can also seize administrative control over it.

If you own a TV box that matches one of these model names and/or numbers, please just rip it out of your network. If you encounter one of these devices on the network of a family member or friend, send them a link to this story (or to our January 2 story on Kimwolf) and explain that it’s not worth the potential hassle and harm created by keeping them plugged in.

  •  

Arizona Judges Launch Effort Seeking Quicker Resolutions to Death Penalty Cases

What happened: Judge Jennifer Green, who oversees the Maricopa Superior Court’s criminal department, has quietly rolled out a program to facilitate quicker resolutions to death penalty cases in Arizona’s most-populous county.

The court has begun issuing orders for the prosecution and defense to participate in settlement conferences two years after a notice to seek the death penalty is filed, according to a statement from the court. The orders are meant to “encourage” settlement talks in capital cases, which often drag on for many years only to end with prosecutors reducing the charges.

Court officials said current and retired judges will conduct the hearings. 

Why it’s happening: An investigation by ProPublica and ABC15 Arizona in June found that prosecutors in the Maricopa County Attorney’s Office have frequently pursued the death penalty but rarely secured death sentences.

In nearly 350 such cases over 20 years, just 13% ended in a death sentence. The outcomes raised questions about the office’s judgment in pursuing the death penalty, said former Maricopa County Attorney Rick Romley, who called for a review of capital charging decisions after the news organizations shared their findings with him.

“Once you allege death, the whole game changes,” Romley told ProPublica and ABC15 at the time. “So many more resources go into that particular case.” 

Capital cases can be litigated across the terms of multiple county attorneys and cost more than a million dollars each to prosecute. In the hundreds of Maricopa County death penalty cases pursued since 2007, the cost of furnishing the accused with an adequate defense alone has totaled $289 million. That figure did not include the costs of the prosecution, which the county attorney’s office said are not recorded in a way that can be tracked separately.

Romley applauded the court for implementing the settlement conferences. “The courts have recognized this isn’t the right way to be doing this,” he said, adding that the orders could speed up other aspects of the cases, such as discovery. Victims could also benefit from quicker resolution, he said. “If I was county attorney, I would be embracing it,” he said.

Arizona resumed executions in 2025 after a two-year pause. Gov. Katie Hobbs, a Democrat, in 2022 ordered a review of the state’s lethal injection process, but she dismissed the retired federal magistrate judge she had appointed to conduct the analysis after he determined that lethal injection is not humane, he said.

There are 107 people on Arizona’s death row

What people are saying: Rosemarie Peña-Lynch, director of public defense services for Maricopa County, said in a statement that public defenders are committed to a process that “offers an opportunity to explore potential case resolutions while safeguarding the constitutional rights of our clients.”

Maricopa County Attorney Rachel Mitchell, a Republican, said at a news conference in November that she is “for anything that would speed up this process.” But, she added, prosecutors seek death in cases “where we think the death penalty is warranted.”

Asked about holding settlement conferences two years into such cases, she said: “It’s not typically a situation where the death penalty is dropped … on a whim of a plea agreement. It’s dropped because maybe evidence changes, or, for example, witnesses die, or something like that. Whether it will help or not, I don’t know, but if it does that’s great.”

What’s next: Last month, Green issued an order in a death penalty case to schedule a settlement hearing within two years. Green’s order, in a case against two men accused of murdering a Tempe woman, cites a criminal procedure rule mandating capital cases be resolved within 24 months of the state’s notice to seek death.

On Dec. 3, Mitchell announced that her office would seek the death penalty against 

Cudjoe Young and Sencere Hayes, who were previously charged with the April 17, 2023, murder of 22-year-old Mercedes Vega. Young and Hayes have pleaded not guilty. 

An autopsy report showed Vega, who was still alive when she was left in a burning Chevrolet Malibu, died of blunt force injuries and had been shot in the arm. A medical examiner also found bleach in her throat, according to ABC15.

“We will continue to pursue justice for Mercedes Vega and her family,” Mitchell said in a statement.

The post Arizona Judges Launch Effort Seeking Quicker Resolutions to Death Penalty Cases appeared first on ProPublica.

  •  

Le straordinarie proprietà del Kuzu

Il Kuzu o Kudzu è una leguminosa rampicante selvatica che cresce nelle montagne dell’est asiatico.Viene usata da oltre due millenni dalla Medicina Tradizionale Cinese come rimedio naturale per moltissimi problemi, in particolare per quelli che interessano l’apparato gastro-intestinale.La pianta è molto simile ad una liana, che cresce velocemente e sviluppa un apparato radicale molto forte che ...continua a leggere "Le straordinarie proprietà del Kuzu"
  •  

Microsoft Patch Tuesday, December 2025 Edition

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable, this year marks the second consecutive year that Microsoft patched over one thousand vulnerabilities, and the third time it has done so since its inception.

The zero-day flaw patched today is CVE-2025-62221, a privilege escalation vulnerability affecting Windows 10 and later editions. The weakness resides in a component called the “Windows Cloud Files Mini Filter Driver” — a system driver that enables cloud applications to access file system functionalities.

“This is particularly concerning, as the mini filter is integral to services like OneDrive, Google Drive, and iCloud, and remains a core Windows component, even if none of those apps were installed,” said Adam Barnett, lead software engineer at Rapid7.

Only three of the flaws patched today earned Microsoft’s most-dire “critical” rating: Both CVE-2025-62554 and CVE-2025-62557 involve Microsoft Office, and both can exploited merely by viewing a booby-trapped email message in the Preview Pane. Another critical bug — CVE-2025-62562 — involves Microsoft Outlook, although Redmond says the Preview Pane is not an attack vector with this one.

But according to Microsoft, the vulnerabilities most likely to be exploited from this month’s patch batch are other (non-critical) privilege escalation bugs, including:

CVE-2025-62458 — Win32k
CVE-2025-62470 — Windows Common Log File System Driver
CVE-2025-62472 — Windows Remote Access Connection Manager
CVE-2025-59516 — Windows Storage VSP Driver
CVE-2025-59517 — Windows Storage VSP Driver

Kev Breen, senior director of threat research at Immersive, said privilege escalation flaws are observed in almost every incident involving host compromises.

“We don’t know why Microsoft has marked these specifically as more likely, but the majority of these components have historically been exploited in the wild or have enough technical detail on previous CVEs that it would be easier for threat actors to weaponize these,” Breen said. “Either way, while not actively being exploited, these should be patched sooner rather than later.”

One of the more interesting vulnerabilities patched this month is CVE-2025-64671, a remote code execution flaw in the Github Copilot Plugin for Jetbrains AI-based coding assistant that is used by Microsoft and GitHub. Breen said this flaw would allow attackers to execute arbitrary code by tricking the large language model (LLM) into running commands that bypass the user’s “auto-approve” settings.

CVE-2025-64671 is part of a broader, more systemic security crisis that security researcher Ari Marzuk has branded IDEsaster (IDE  stands for “integrated development environment”), which encompasses more than 30 separate vulnerabilities reported in nearly a dozen market-leading AI coding platforms, including Cursor, Windsurf, Gemini CLI, and Claude Code.

The other publicly-disclosed vulnerability patched today is CVE-2025-54100, a remote code execution bug in Windows Powershell on Windows Server 2008 and later that allows an unauthenticated attacker to run code in the security context of the user.

For anyone seeking a more granular breakdown of the security updates Microsoft pushed today, check out the roundup at the SANS Internet Storm Center. As always, please leave a note in the comments if you experience problems applying any of this month’s Windows patches.

  •  

bitume datajustice podcast

logo-bitume

Lunedì 18 novembre 2019 ore 21

Prima puntata di bitume, trasmissione radiofonica aperiodica a cura di unit hacklab di Milano.

L'approfondimento satirico della rivoluzione digitale.

Bitume parla di diritti digitali, di nuove forme di protesta incentrate sulla tecnologia, di media caldi e freddi, di server liberi, di hacking, di sicurezza …

  •  

bitume datajustice diretta

logo-bitume

Lunedì 18 novembre 2019 ore 21

Prima puntata di bitume, trasmissione radiofonica aperiodica a cura di unit hacklab di Milano.

L'approfondimento satirico della rivoluzione digitale.

Bitume parla di diritti digitali, di nuove forme di protesta incentrate sulla tecnologia, di media caldi e freddi, di server liberi, di hacking, di sicurezza …

  •