Minecraft Dungeons 2 is developed by Mojang and Double Eleven, published by Xbox Game Studios and Mojang. It is available on Xbox Series X/S, PC, and PS5, with a release date of September 29, 2026, priced at £24.99. The game serves as an accessible introduction to the action RPG genre, targeting younger audiences, particularly Minecraft fans. It features a semi-open-world structure, allowing exploration of various areas, but the main quest line and side quests can be completed in approximately seven to ten hours. Combat mechanics are straightforward, with rapid loot acquisition and a system that can frustrate players due to hidden stats. The narrative involves ill-intentioned Illagers and lacks variety in quests. The game includes a co-op mode for up to four players and cross-platform online play, but players cannot transfer offline characters online. The Deluxe Edition includes additional content such as a Soul Cape, hero skins, and access to DLC packs.
Microsoft is testing five new builds of Windows 11 as part of the Windows K2 initiative, which includes several updates:
- Support for Unicode 17.0 has been added, allowing Windows to display over 4,800 new characters and scripts.
- Performance improvements have been made to the Settings home page, reducing loading times.
- The Settings > Apps > Installed apps section now shows version numbers for packaged apps.
- A new entry point for Cloud Rebuild has been introduced under Settings > System > Recovery.
- The Cloud rebuild feature can restore a Windows 11 PC to a clean state without USB media.
- The Address Bar in File Explorer now supports the '~' character for quicker navigation.
- Adjustments to the preview pane in File Explorer include a new button for HTML files and automatic previews for non-HTML files.
- Folder view customizations in File Explorer are now consistently maintained.
- The Windows Magnifier now allows input of exact zoom percentages and includes preset step increments.
- Cloud rebuild options have been enhanced to include drive sanitization.
- The Windows share window now allows users to pin favorite apps.
- Messaging related to age-restricted parental controls in Family Safety has been improved.
- Minor visual issues in the taskbar have been addressed.
- Fixes have been implemented for certain USB Audio Class 1.0 devices.
- Corrections have been made for Remote Desktop window sizing.
- Issues causing lag for some Insiders after updates have been resolved.
Minecraft Dungeons II features over 30 enchantments that enhance player combat capabilities. Enchantments are represented by reusable Enchantment Books, which can be found as loot or purchased from the Enchantsmith using Soul Corrupted currency. Players can apply these books to weapons or armor, with most enchantments having three tiers that increase effectiveness.
Key enchantments include:
1. Lightning Surge: A melee enchantment that unleashes a wave of lightning on jump attacks and finishing blows, dealing up to 90% of the weapon's base damage at its highest tier.
2. Healing Smite: Applicable to melee or ranged weapons, this enchantment heals players upon defeating enemies, with a healing chance of 20% at Tier 1 and 50% at Tier 3.
3. Ancient Alchemy: An armor enchantment that converts health potions into Souls, yielding up to 60 Souls per use at maximum level.
4. Ricochet: A ranged weapon enchantment that allows arrows to bounce between targets, hitting up to three enemies per shot at its highest tier.
5. Dynamo: An armor enchantment that amplifies damage by up to 40% for the next attack after rolling, rewarding mobility-focused playstyles.
Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.
Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed.
When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription.
CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.
Absolum, a beat 'em up roguelite game with 92% positive reviews on Steam, is coming to Android and iOS on November 5, 2026. Pre-registration is open on Google Play and the App Store. The game offers unique gameplay mechanics, four distinct heroes, revamped interface for mobile, online co-op, controller support, and cloud saves.
- Mobile version of Dome Keeper, a popular mining survival game, is in the works
- Pre-registration is open on Google Play and pre-orders are available on the App Store for 899 rubles
- Dome Keeper involves balancing resource extraction and defense against alien attacks
- Players can enhance the dome, upgrade mining equipment, and increase movement speed with materials found
- Procedurally generated maps offer a unique experience with each new run
- Dome Keeper was originally released on Steam in 2022 and has sold over a million copies by October 2024
Absolum, a beat 'em up roguelite game, is set to debut on Android and iOS on November 5, 2026, with optimized touch controls, online co-op, controller support, cloud saves, and achievements.
Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days.
The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include:
- APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone.
- UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor.
- UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary.
- UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly.
CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.
