audit Archives

AppWizard

July 10, 2026

Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

Researchers analyzed 281 popular free VPN applications on the Google Play Store and found significant privacy and security shortcomings. The study, conducted by teams from the University of Michigan, the University of New Mexico, and IIT Delhi using a framework called MVPNalyzer, revealed that flagged apps had over 2.4 billion downloads. Key findings included: - Five apps transmitted configuration files unencrypted, allowing attackers to intercept and modify them. - 29 apps allowed user traffic to leak outside the encrypted tunnel, with 24 leaking DNS traffic and six leaking full browsing traffic. - 169 apps made no effort to disguise their traffic, making it identifiable to network operators or government censors. - 76 apps transmitted the device's Advertising ID to advertisers, and over 80% contacted known advertising and tracking servers. - Only one of 108 OpenVPN configurations adhered to recommended security practices; 89% used a single authentication method, and nearly 20% employed outdated encryption techniques. - Many apps passed through Play Store checks without adequate scrutiny, with safety labels often serving as marketing tools rather than security indicators. These findings align with previous research highlighting similar issues in popular Android VPN apps. Users are advised to be cautious when selecting VPNs, prioritizing those with recent independent security audits.

Winsage

July 9, 2026

GDID Windows – Cut the tracker that follows you even through a VPN

In April 2026, the FBI apprehended an individual associated with the Scattered Spider group, who had concealed his online activities using a VPN. His efforts were thwarted by the GDID, a 64-bit Persistent Unique Identifier assigned by Microsoft upon logging into Windows. The GDID is stored in plain text in the registry and is linked to Microsoft’s servers, remaining unaffected by changes to IP addresses or attempts to delete it. Disabling Windows telemetry does not prevent the GDID from being accessed, as it operates through other services. To mitigate its transmission, users can disable certain services and modify the hosts file, although the GDID itself remains stored on Microsoft’s servers. Scripts are available on GitHub to audit and implement changes regarding the GDID. Transitioning to a local account does not guarantee anonymity, and for sensitive activities, using a live Linux system is recommended for better data control.

Tech Optimizer

July 8, 2026

PostgreSQL Extensions Are an Architecture Decision, Not an Afterthought

A common issue in database migrations is the unplanned accumulation of extensions in PostgreSQL, leading to extension sprawl. Teams often install extensions without documenting the rationale, resulting in a complex web of dependencies that complicates future upgrades and removals. The installation process involves PostgreSQL accessing a control file that details the extension's version and dependencies, which can lead to multiple extensions being installed unintentionally. Upgrading and removing extensions are often neglected, causing risks such as the loss of dependent objects. Extensions typically default to the public schema, which can become cluttered; relocating them to dedicated schemas can improve organization. Trusted Language Extensions (TLE) allow non-privileged users to utilize procedural languages in managed databases without needing superuser access. Key extensions recommended for use include pg_stat_statements, pg_trgm, hstore, citext, and PostGIS, each serving specific use cases. Proper governance is essential for managing extensions, including documenting their purpose, ownership, and dependencies, to prevent operational surprises.

Tech Optimizer

July 8, 2026

Critical PHP PDO Driver Bugs Expose Firebird SQL Injection and PostgreSQL DoS Risks

A recent examination of PHP's database driver layer revealed two significant vulnerabilities in PHP Data Objects (PDO) affecting the pdo_firebird and pdo_pgsql drivers. The first vulnerability, CVE-2026-25289, allows SQL injection attacks through NUL byte manipulation in quoted strings, compromising the safety of SQL statements. The second vulnerability, CVE-2026-25290, can cause application crashes due to null pointer dereferencing when invalid multibyte character sequences are processed. Both vulnerabilities stem from assumptions about C string handling and have been addressed in a security release. Researchers recommend treating binary input as untrustworthy and encapsulating financial workflows within atomic transactions.

Tech Optimizer

July 7, 2026

PDO PostgreSQL Bug Triggers NULL Pointer Dereference and Crashes PHP Worker Processes

Researchers at Positive Technologies have identified two significant vulnerabilities in the PHP Data Objects (PDO) extension layer, both posing high severity risks. The first vulnerability (CVE-2025-14180) leads to a NULL pointer dereference, causing PHP worker processes to crash. It affects PHP versions 8.1.x prior to 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1. This issue occurs when the pdo_pgsql driver operates with PDO::ATTR_EMULATE_PREPARES enabled, allowing a remote attacker to exploit it without authentication by submitting malformed character sequences. The second vulnerability (CVE-2025-14179) allows for SQL injection and affects PHP versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6. It arises from a mishandling of NUL bytes in the Firebird driver during the PDO::prepare() process, despite the quoting routine functioning correctly. Additionally, the audit revealed an integer overflow in PostgreSQL’s libpq client library and an information disclosure flaw in Firebird 3’s fbclient.

Tech Optimizer

July 7, 2026

The TechBeat: How Small Postgres Metadata Tables Quietly Throttle Your Largest Queries (7/6/2026)

- Websites detect VPN usage through factors like IP reputation, DNS leaks, WebRTC, and browser fingerprints, with strategies to mitigate tracking. - Slow Postgres dashboards may be caused by stale metadata statistics rather than the fact table, with solutions provided to rectify these issues. - Spec-driven development enhances the reliability of AI coding agents through structured specifications, workflows, reusable skills, and proof. - A comparison of usage-based billing platforms for 2026 includes Credyt, Metronome, Orb, Lago, Stripe Billing, and Chargebee. - Loop Engineering is a rising trend in AI workflows expected to dominate in 2026, though challenges may accompany it. - ONLYOFFICE released version 3.7 of DocSpace Developer, introducing AI file generation, new webhook events, expanded plugin tools, and enhanced form workflows. - ANY.RUN's data inspection tool offers SOC teams comprehensive browser visibility for quicker phishing investigations. - AI systems are reducing obvious hallucinations, but deeper structural failures remain a risk for professionals. - A vendor audit revealed supply chain vulnerabilities in AI, including unpinned models and the use of trust_remote_code=True. - Developers using OpenAI Codex should avoid overloading a single conversation with tasks to maintain performance, recommending the use of subagents. - Barriers to AI adoption are not purely technological, as shared by insights from discussions with 500 individuals. - Guidance on creating production AI agent loops emphasizes state management, tool governance, evidence verification, and domain-specific controls. - Dawnguard launched a security architecture automation platform with million in pre-seed funding to address AI code vulnerabilities. - The AI boom is driven by complex memory architecture rather than GPUs, influencing consumer electronics pricing strategies. - The origins of functional programming trace back to John McCarthy's practical needs for differentiating expressions. - A guide for AI startup founders addresses common pitfalls in understanding AI agents and the autonomy trap for developing reliable systems.

BetaBeacon

June 29, 2026

Winlator Setup 2026: Run PC Games on Android in 12 Steps

Winlator is an orchestration layer that combines four open-source projects to run Windows games on Android phones. The projects involved are Wine, Box86, Box64, DXVK, and VKD3D-Proton.

Tech Optimizer

June 26, 2026

EDB launches agentic Postgres AI with governance tools

EDB has introduced new features for its Postgres AI platform, including an agentic database and converged analytics capabilities, allowing enterprises to run AI agents alongside transactional workloads on a unified PostgreSQL foundation. The platform includes governance tools that position control mechanisms at the data layer and integrates AI processing with operational data, enabling businesses to connect live records with AI systems without transferring sensitive information. The agentic database can monitor over 200 metrics, identify issues, suggest changes, and apply fixes automatically based on user-defined policies. It consolidates various data types through a single SQL interface, significantly accelerating database tuning processes and enhancing application performance. EDB has also expanded its analytics capabilities with a zero-ETL architecture for real-time analysis and large-scale warehousing. EDB PG AI for ClickHouse targets real-time analysis, while EDB PG AI for WarehousePG focuses on historical analysis at petabyte scale. The platform claims up to 30 times faster query performance compared to legacy systems and improved scaling efficiency. EDB's platform integrates vector search and retrieval for AI agents, demonstrating lower query latency and higher retrieval accuracy than competitors. NTT East is using EDB PG AI for AI-driven network operations, while the governance feature manages agent access at the data querying point using native Postgres roles and row-level security. The platform can be deployed on-premises, in hybrid environments, or across cloud infrastructures, with partnerships including Dell, IBM, Nvidia, Red Hat, and Supermicro.

Winsage

June 25, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update to eligible Windows 11 and Windows 10 PCs ahead of the expiration of the Microsoft Corporation KEK CA 2011 on June 24, 2026. This update enhances device targeting data for automatic Secure Boot certificate updates. Secure Boot is a firmware-level security feature that verifies digital signatures of boot components to prevent rootkits and bootkits. The certificates for Secure Boot were first issued in 2011, with subsequent expirations for related certificates occurring in June and October 2026. Users can check their Secure Boot certificate status through the Windows Security app or System Information. If a PC does not receive the update, it will still boot normally but will lose the ability to receive future boot-level security updates. Multiple restarts after updates are expected due to the Secure Boot certificate process. A new folder, C:WindowsSecureBoot, is not malware but is used for staging cryptographic certificate files. Windows 10 users enrolled in the Extended Security Updates program will also receive the Secure Boot update, while those not enrolled will not. The expiration of the KEK CA 2011 means Microsoft will not be able to sign new Secure Boot revocation payloads using the old key, but existing signed payloads will remain functional.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.