authorization

Tech Optimizer
June 13, 2026
On June 10th, Splunk released an advisory for CVE-2026-20253, a high-severity vulnerability with a CVSS score of 9.8 that requires no authentication. The vulnerability is associated with the PostgreSQL Sidecar Service Endpoint and affects Splunk Enterprise versions 10 and above. In default installations, the service is not installed on Windows but is installed and enabled by default on AWS. The vulnerability allows unauthorized users to create and truncate arbitrary files through an API that lacks authentication controls. Additionally, it enables the execution of SQL commands via a backup and restore mechanism, potentially leading to remote code execution (RCE). A Detection Artefact Generator has been developed to help organizations assess their vulnerability to this issue.
AppWizard
June 2, 2026
Meta has launched 13+ Teen Accounts on Instagram, Facebook, and Messenger, aiming to create a safer online environment for younger users. The rollout includes default settings that resulted in a 68% reduction in mature content on Instagram compared to other platforms. Meta is collaborating with the trust and safety firm Alice to test these new settings and is exploring ways to limit specific content types, particularly related to nutrition and anxiety. A report by whistleblower Arturo Béjar raised concerns about the effectiveness of Meta's teen safety features, leading to an overhaul of Instagram Teen Accounts. Meta faced controversy for comparing its content restrictions to PG-13 guidelines without authorization from the MPAA, which resulted in a cease and desist order but ended in a resolution. Additionally, new features have been introduced, including enhanced parental supervision tools and global age detection capabilities.
AppWizard
May 27, 2026
Google has enhanced the Android checkout experience by integrating stored credentials from Google Wallet, allowing developers to offer a seamless payment process with the new Express checkout feature using Google Pay for Android native applications. Developers can implement dynamic callbacks in their applications for real-time updates on shipping options, taxes, and total prices during transactions, improving the checkout process without closing the payment interface. These dynamic callbacks, previously available on the web, are now fully supported in Android applications, streamlining the checkout funnel. This innovation reduces friction in payments, facilitates a one-click experience, and enhances accuracy and authorization feedback, ultimately driving higher conversion rates. Recent reports indicate that mobile wallets, including Google Pay, are becoming mainstream, with 31% of consumers using a mobile wallet in-store within the past week, and the number of users reporting Google Pay usage doubling year over year. Additionally, 84% of shoppers prioritize one-click options, and 80% utilize stored credentials, highlighting the importance of these features in reducing cart abandonment and enhancing conversion rates.
Tech Optimizer
May 21, 2026
PostgreSQL has released versions 18.4, 17.10, 16.14, 15.18, and 14.23 to address 11 security vulnerabilities and over 60 bugs. The vulnerabilities affect PostgreSQL versions 14 through 18 and include issues such as remote code execution, SQL injection, and denial-of-service risks. Specific vulnerabilities include: - CVE-2026-6472: Missing authorization in CREATE TYPE allows query hijacking. - CVE-2026-6473: Integer wraparound leads to out-of-bounds writes and server crashes. - CVE-2026-6474: Format string issue leaks server memory. - CVE-2026-6475: Symlink attack allows overwriting arbitrary files. - CVE-2026-6476: SQL injection allows execution of arbitrary SQL as superuser. - CVE-2026-6477: Memory buffer overwrite via libpq lo_* functions. - CVE-2026-6478: Timing attack exposes MD5-hashed passwords. - CVE-2026-6479: SSL/GSS recursion flaw allows denial-of-service. - CVE-2026-6575: Buffer over-read leaks memory data (PostgreSQL 18 only). - CVE-2026-6637: Refint module enables stack overflow and SQL injection, leading to possible RCE. - CVE-2026-6638: SQL injection in REFRESH PUBLICATION via table names. Organizations are advised to upgrade to the latest versions, avoid MD5 password authentication, restrict privileges, audit extensions, and monitor for abnormal activity. PostgreSQL 14 will reach its end-of-life on November 12, 2026.
Winsage
May 14, 2026
Microsoft's Windows Autopatch service mistakenly deployed restricted driver updates to some managed Windows devices without proper approval, affecting Windows 11 versions 25H2, 24H2, and 23H2. This led to unexpected restarts and stability issues. Microsoft implemented a server-side fix to address this problem, confirming that only a limited subset of devices in the EU region was impacted and that no client-side action was required. Additionally, some users faced difficulties installing Office on Windows 365 machines due to a configuration change from a recent service update.
Tech Optimizer
May 1, 2026
Surfshark One+ with Incogni is a comprehensive online privacy solution that combines a VPN, antivirus protection, and personal data removal services. The two-year plan is currently priced at .99, reduced from its regular price of 9.40. The Surfshark component includes a VPN, real-time antivirus protection, and Surfshark Alert for data breach notifications, while Incogni handles the removal of personal information from over 420 data brokers. Incogni has processed over 245 million removal requests, verified by Deloitte, and offers identity theft coverage of up to million. The service supports up to five devices and is compatible with various operating systems.
AppWizard
April 10, 2026
PC Gamer's Mollie Taylor praised the Starsand Island demo in December 2025, while Lauren Morton called it "the first can't-miss cozy game of 2026" in February. The game is currently unavailable on Steam due to the developer, Seed Sparkle Lab, using unauthorized visual elements from a classic title in their mini-game section. They apologized for this oversight and are working on a new build to remove the contentious content. Fans speculate the classic title might be Tetris, but this is unconfirmed. Seed Sparkle has decided to temporarily delist Starsand Island and will reward current owners with the "Shining Star" outfit set once the revised version is approved. Players' progress will remain intact. The studio is enhancing its internal review processes following this incident and a previous wave of fake positive user reviews. A specific return date for the game on Steam has not been disclosed, but it is still available on the Xbox Store.
Search