advisory Archives

Winsage

August 3, 2026

Microsoft warns Windows PC users of Russian hackers on hotel WiFi

Microsoft has issued a warning to Windows PC users about Russian hackers targeting individuals using hotel WiFi networks. The campaign, named CaptiveCrunch and attributed to the Storm-2945 group, focuses on corporate travelers and employs tactics like credential theft and malware distribution through compromised guest networks. Microsoft has been monitoring this activity since May, noting its impact on hospitality networks utilizing captive portals. Hackers have been redirecting users to counterfeit sign-in pages to steal credentials without phishing emails. The threat may also extend to Android devices, with hackers using deceptive techniques to manipulate users into downloading malicious APK files. The hackers employ fake verification checks and sign-in prompts, sometimes misleading users into Microsoft's legitimate authentication process to gain access to accounts. Microsoft has identified a specific remote-access trojan named CornFlake, which can record keystrokes, steal credentials, and capture screenshots. Recommendations for travelers include using mobile hotspots, avoiding updates through captive portals, strengthening authentication methods, and blocking unnecessary device-code authentication.

Winsage

August 3, 2026

Microsoft warns Windows 11 Insiders of crucial mandatory upcoming deadline

Microsoft is updating Secure Boot certificates for Windows 11 PCs, as the previous certificates are 15 years old and nearing expiration. Users can check their certificate status easily. An advisory was issued in early September regarding changes for Windows Insider channels, particularly affecting the Experimental and Beta channels, with a deadline for certificate updates set for August 11, 2026. The Release Preview builds will not be affected by this update requirement. Users in the impacted channels must update to specific builds to obtain the new certificates, or they may stop receiving updates after the deadline. The minimum build requirements for each channel are outlined, and users can check their current Windows 11 Insider build by using the winver command. Microsoft has confirmed that these updates will not impact activation or licensing status.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Winsage

July 16, 2026

Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]

CVE-2026-41089 is a critical vulnerability in the Windows Netlogon service, rated 9.8 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on domain controllers. It affects all supported versions of Windows Server configured as domain controllers, from Windows Server 2012 R2 to the latest release. Microsoft addressed this vulnerability on May 12, 2026, during a broader update that included 138 fixes, but it went largely unnoticed until early June when active exploitation was confirmed. The vulnerability is characterized as a stack-based buffer overflow and is considered "wormable" due to its ability to self-propagate across systems without user intervention. Organizations are advised to patch all domain controllers and audit network access to mitigate exposure.

Winsage

July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.

Winsage

July 10, 2026

Microsoft is rewriting Windows patch guidance because of AI

Microsoft advises organizations to expedite their Windows update deployment timelines due to advancements in artificial intelligence that allow cyber attackers to quickly exploit vulnerabilities after security updates are released. Jeremy Chapman, Director of Microsoft 365, warns that delaying critical quality updates with security fixes increases the risk of exploitation. Microsoft recommends a quality update deferral period of fewer than three days, update deadlines of zero or one day, and a grace period of no more than two days. The Windows Autopatch report within Microsoft Intune helps identify unpatched devices, allowing administrators to adjust update deferral policies. Organizations can configure update delivery settings through policy controls in Windows Autopatch and Microsoft Intune, as well as other management tools like Microsoft Configuration Manager and Windows Server Update Services. Microsoft also promotes the use of Hotpatch for quicker installation of security updates without rebooting and encourages Conditional Access policies to restrict access to corporate resources for devices that lack required updates.

Winsage

July 7, 2026

Windows 11 24H2 and 25H2 Issue Causes Black Screen, Start Menu Failure, and Taskbar Crashes

Microsoft has addressed critical user interface failures affecting Windows 11 versions 24H2 and 25H2 in enterprise environments, documented under update advisory KB5072911. These issues arise from cumulative updates released after July 2025, including KB5062553 and KB5065789, primarily impacting enterprise-managed systems and virtualized environments. Users may experience black screens, unresponsive Start menus, and taskbar failures following updates, particularly in non-persistent environments like Virtual Desktop Infrastructure (VDI). Core components such as Explorer.exe and XAML-dependent applications may fail to initialize or crash due to a timing issue in the update process, where required application packages are not properly registered. Microsoft has released updates starting June 23, 2026, under KB5095093 to address these issues and recommends temporary workarounds for affected systems, including manual registration of missing packages and deploying logon scripts in non-persistent environments. Organizations are encouraged to install the latest updates and review their update procedures to prevent future disruptions.

Tech Optimizer

July 3, 2026

Percona & HexaCluster team up on database migrations

Percona has formed a strategic alliance with HexaCluster to assist organizations in migrating from proprietary databases to open-source alternatives, specifically PostgreSQL, MySQL, and MariaDB. The partnership combines Percona's migration assessment and production support with HexaCluster's migration software for diverse database environments. The migration process will begin with a comprehensive assessment by Percona to outline the scope and plan the transition. Percona will lead the migration efforts, while HexaCluster will provide software solutions for complex migrations. This collaboration aims to help enterprises reduce costs associated with proprietary databases and minimize risks during migration. HexaCluster specializes in PostgreSQL migration and offers tools for migration assessment, schema conversion, data migration, and live replication. Percona supports various database systems and emphasizes open-source solutions to give organizations more control over their data infrastructure.

AppWizard

June 30, 2026

After leading the studio through 2 rounds of layoffs and 1 game release, the CEO of Supermassive is stepping down

Robert Henrysson has announced his departure as CEO of Supermassive Games, two months after the launch of Directive 8020. He reflected on his tenure with pride, noting the studio's expansion and commitment to quality. Nordisk Games recognized his contributions and leadership during a transformative period. Directive 8020, part of the Dark Pictures series, received mixed user ratings on Steam but was praised by critics, achieving an 85% rating. Henrysson's leadership occurred amid industry challenges, including layoffs. He plans to spend the summer with his family while remaining open to future opportunities in the gaming industry.

Tech Optimizer

June 24, 2026

EDB converges analytics on Postgres to support AI agents

EDB's per-core pricing model offers predictable costs compared to consumption-based cloud data platforms, aiding organizations in budgeting. However, predictable billing does not guarantee lower costs, as high-speed operational data processing requires more expensive hardware than lakehouse storage solutions. EDB's architecture, built on a unified Postgres-Iceberg foundation, streamlines data governance by reducing the need for multiple specialized data stores, leading to fewer platforms to manage and enhancing operational efficiency and data governance protocols.