NewApp Digest
search bot

authentication

The Windows 11 June update makes your Start menu and Search feel much more snappier
Winsage
June 14, 2026

The Windows 11 June update makes your Start menu and Search feel much more snappier

Microsoft released update KB5094126 on June 9, 2026, for Windows 11 versions 24H2 and 25H2 to improve shell responsiveness. This update introduces the Low Latency Profile, which temporarily boosts CPU frequency for one to three seconds during interactions with system features like the Start menu and taskbar, resulting in system flyouts opening up to 70% faster and core applications launching up to 40% quicker. The update also includes features such as Shared Audio for simultaneous audio use by two users, enhanced Windows Task Manager with NPU usage columns, the ability for multiple applications to access the same camera stream, improved Windows Search for locating files with two characters, a refined installation process allowing custom user folder names, and optimizations to Windows Hello for authentication methods. The update also addresses over 200 security vulnerabilities.
Neon vs Supabase 2026: $1B Deal, Scale-to-Zero
Tech Optimizer
June 14, 2026

Neon vs Supabase 2026: $1B Deal, Scale-to-Zero

Neon and Supabase are two managed PostgreSQL platforms with distinct approaches. Neon adopts a serverless architecture that separates storage and compute, allowing databases to scale to zero when idle and enabling rapid database branching. Supabase, in contrast, provides a comprehensive backend-as-a-service that includes authentication, file storage, real-time subscriptions, and edge functions, all built around PostgreSQL. In 2025, Databricks acquired Neon for approximately billion, motivated by the observation that around 80% of databases created on Neon were generated by AI agents. Post-acquisition, users experienced reduced storage costs and improved pricing structures, although concerns arose regarding Neon's independence. Neon features instant database branching and a scale-to-zero capability, while Supabase offers a fully integrated backend with built-in authentication and storage. Neon operates on a usage-based pricing model, whereas Supabase has a flat-tier pricing structure. Both platforms support the pgvector extension for AI applications, but Supabase is fully open-source and allows for self-hosting, unlike Neon. The developer community recognizes Supabase for its ease of use and rapid application development capabilities, while Neon is praised for its innovative serverless features and cost efficiency. Migration between the two platforms is simplified due to their shared PostgreSQL foundation.
For June, Patch Tuesday means an IT scramble
Winsage
June 13, 2026

For June, Patch Tuesday means an IT scramble

A systematic approach to testing is essential following the latest updates. The process begins with installing the .NET SDK update, then building and executing representative applications to ensure existing projects compile and run without issues. For SQL Server users, the GDR update must be installed on the appropriate branch, followed by a service restart and standard transaction execution to verify stability. Backup and restore verification is also necessary, including checking the health of Always On availability groups and testing patch installation and removal. The Readiness team recommends prioritizing testing for Remote Desktop this month due to its frequent patches and high-risk classification. The focus should be on printer redirection, followed by general connectivity, RemoteApp functionality, clipboard and device redirection, gateway access, and licensing considerations. The next priority is validating NTLM authentication updates, including domain and standalone logon processes, file-share access, and application sign-in capabilities. Other updates are security-focused with no functional changes, requiring routine regression testing across networking, Hyper-V, storage, and graphics components. Office remains MSI-only, with Click-to-Run installations unaffected by these updates. The updates for .NET and SQL Server complete the landscape for developers and database administrators.
Windows Server 2025 Adds DNS Over HTTPS for Secure DNS Traffic
Winsage
June 13, 2026

Windows Server 2025 Adds DNS Over HTTPS for Secure DNS Traffic

Microsoft has rolled out support for DNS over HTTPS (DoH) in Windows DNS Server as part of the Windows Server 2025 update. This feature enhances the security of DNS communications through encryption and server authentication, allowing encrypted client-to-resolver traffic in on-premises DNS environments. DoH encrypts DNS queries and responses using HTTPS, protecting sensitive information from interception or alteration. It also uses digital certificates for DNS server authentication to reduce spoofing and impersonation risks. The feature is compatible with existing Windows DNS Server configurations and supports both encrypted and traditional DNS. DoH support is available on Windows Server 2025 with the June 9, 2026 update or newer. Administrators must configure a trusted TLS certificate and enable DoH in the DNS Server service to deploy this feature. Microsoft plans to extend encryption capabilities to include communication between the Windows DNS Server and upstream DNS resolvers in the future.
Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)
Tech Optimizer
June 13, 2026

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

On June 10th, Splunk released an advisory for CVE-2026-20253, a high-severity vulnerability with a CVSS score of 9.8 that requires no authentication. The vulnerability is associated with the PostgreSQL Sidecar Service Endpoint and affects Splunk Enterprise versions 10 and above. In default installations, the service is not installed on Windows but is installed and enabled by default on AWS. The vulnerability allows unauthorized users to create and truncate arbitrary files through an API that lacks authentication controls. Additionally, it enables the execution of SQL commands via a backup and restore mechanism, potentially leading to remote code execution (RCE). A Detection Artefact Generator has been developed to help organizations assess their vulnerability to this issue.
Hackers Use Fake Windows Update Installers to Deliver OnyxC2 Credential Stealer
Winsage
June 12, 2026

Hackers Use Fake Windows Update Installers to Deliver OnyxC2 Credential Stealer

OnyxC2 is a sophisticated credential stealer available for a subscription fee of 0 per month, distributed through disguised lures such as fake Windows updates and legitimate software installers. It functions as a commercial product with features like an automated payload builder, tiered licensing, and a centralized web dashboard. The malware boasts a 99% detection-evasion rate, successfully evading major antivirus solutions during tests. It is developed in C++, utilizing direct system calls and mutating with each build to avoid detection. OnyxC2 collects data from around 210 applications, targeting 45 web browsers, password managers, cryptocurrency wallets, and FTP clients. The malware is delivered using DLL sideloading, where a password-protected archive contains a legitimate application and a malicious DLL. The attacker's DLL is disguised by inflating its size and is loaded by a trusted binary. The malicious code remains encrypted on disk and decrypts in memory to evade analysis. OnyxC2 communicates with a Cloudflare-fronted command-and-control server to manage infected hosts and execute commands like hardware registration and cookie uploads. The threat extends to business environments, targeting FTP and email clients, with stolen session cookies allowing ongoing access to corporate infrastructure. Implementing anti-data exfiltration controls is recommended as a mitigation strategy.
Microsoft patches a record 206 flaws—and one is already being exploited
Winsage
June 11, 2026

Microsoft patches a record 206 flaws—and one is already being exploited

Microsoft patched 206 vulnerabilities during June's Patch Tuesday, surpassing the previous record of 175 vulnerabilities patched in October 2025. Among the patched vulnerabilities, 118 are related to different versions of Windows, including Windows 10, Windows 11, and Windows Server. One critical vulnerability, CVE-2026-41091, in Microsoft Defender is actively being exploited, prompting an update to the Malware Protection Engine. Microsoft also addressed ten vulnerabilities in the Security Feature Bypass category due to the expiration of old Secure Boot certificates. Of the 118 Windows vulnerabilities, 19 are classified as critical Remote Code Execution (RCE) vulnerabilities, including CVE-2026-47288 and CVE-2026-47291. In Microsoft Office, 54 vulnerabilities were patched, including 25 RCE vulnerabilities, with nine classified as critical. Microsoft patched eight vulnerabilities in Exchange Server, including CVE-2026-45583, which can be exploited in a man-in-the-middle scenario. Additionally, the update for Edge addressed 74 Chromium vulnerabilities, including a zero-day vulnerability (CVE-2026-11645).
Search