binaries Archives

Tech Optimizer

September 3, 2026

Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital's Avast Antivirus, allowing attackers with local execution access to extract the Windows Security Account Manager (SAM) database and execute a shell with NT AUTHORITYSYSTEM privileges. The flaw is located in the Avast Sandbox component and could enable a complete local takeover of the system. The PoC is compatible with any version of Avast Antivirus and has been tested on fully patched versions of Avast and Windows 11 25H2. The repository does not provide a formal release, CVE identifier, or patch details. The vulnerability may also affect other GenDigital products like AVG and Norton. Security teams are advised to monitor for suspicious activities related to Avast services and restrict local administrator access. Organizations should inventory their deployed versions and apply vendor-provided updates as they become available.

AppWizard

August 26, 2026

Galaxy Store Will Start Hiding Unverified Android Apps in September

Samsung has alerted developers using the Galaxy Store about upcoming changes due to Google's new Android Developer Verification (ADV) rules, which will take effect on September 30, 2026. Developers in Brazil, Indonesia, Singapore, and Thailand must complete the verification process to avoid having their unverified apps removed from the Galaxy Store. The ADV process requires developers to authenticate their identities and register package names and signing certificates. Apps that are not verified will be hidden from search results and listings, affecting their visibility. Users may face difficulties reinstalling or updating existing apps until developers complete the verification, although previously installed apps will continue to function. Samsung is indicating the status of app binaries in the Seller Portal and will restrict new registrations and updates lacking ADV approval starting in September. Sideloading will still be possible for certain apps and through an advanced installation flow, while ADB installations will remain unchanged. The initial rollout is limited to specific countries, with a global expansion expected in 2027. Developers are encouraged to act quickly to maintain app visibility.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.

Winsage

August 16, 2026

Microsoft releases new Defender update for Windows 11, 10, Server ISO installations

Microsoft released its August 2026 Patch Tuesday updates, including the latest Defender package for ISO installations. The updates are aimed at combating malware threats and are issued approximately every three months for Windows installation images (WIM and VHD) and ISOs. The latest Windows 11 update is available through the Media Creation Tool (MCT). The security definitions were delivered through security intelligence update version 1.455.50.0, applicable to various platforms including Windows 11, Windows 10 ESU, Windows Server 2022, and others. The update includes enhancements to the anti-malware client, engine, and signature versions, with platform version 4.18.26070.9, engine version 1.1.26070.7, and security intelligence version 1.455.50.0. The previous security intelligence update was version 1.447.236.0, which introduced detections for various malware types. The most recent intelligence update is version 1.457.181.0.

Winsage

August 11, 2026

Microsoft PowerToys will soon take full advantage of the same AI that powers Copilot+ PCs

Microsoft PowerToys has introduced on-device support for Phi Silica, a small language model, in its latest preview version, enhancing the Advanced Paste feature for clipboard management. Advanced Paste can format clipboard content in various formats, extract text from images using OCR, and transcode audio and video files. It now supports multiple AI models, including local options like Foundry Local and Ollama. The latest version, PowerToys v0.101.2211.0, includes improvements such as enhanced AI customization for Advanced Paste, better dialog handling in the Command Palette, and improved window management features. Mouse Jump has transitioned to the newer WinUI app architecture, and new settings have been added for update channel selection and bug reporting.

Winsage

August 2, 2026

Microsoft released Windows 11 KB5102117 update for OS recovery

Microsoft released a Windows 11 preview update, KB5101684, which improves RAM consumption and addresses performance issues on minimum-spec PCs. Alongside this, a dynamic update was introduced to enhance the Windows Recovery Environment (WinRE) and improve the installation experience. The dynamic update packages are meant for existing Windows images before deployment, preserving essential components during upgrades. The specific recovery update, KB5102117, enhances WinRE for Windows 11 versions 24H2 and 25H2, with the WinRE version post-installation being 10.0.26100.8971. Both updates will be automatically downloaded and installed via the Windows Update channel.

Tech Optimizer

July 28, 2026

ClamAV Setup: Linux Antivirus in 12 Steps [2026]

Malware can threaten Linux systems, which are often mistakenly believed to be immune to viruses. It can be introduced through email attachments, infected files, or compromised plugins, especially when Linux servers interact with Windows clients or handle internet uploads. ClamAV is an open-source antivirus engine maintained by Cisco Talos, designed for scanning mail traffic and file uploads. As of mid-2026, the stable release is ClamAV 1.5.x, with version 1.5.2 being the latest patch. To deploy ClamAV, users need root or sudo access on a compatible Linux machine, at least 2 vCPUs and 2GB of RAM, 5GB of free disk space, and outbound HTTPS access to ClamAV’s signature mirrors. The installation process involves several steps, including configuring freshclam for automatic updates, validating detection with the EICAR test file, and setting up cron jobs for regular scans. ClamAV can also be integrated with mail servers and a SIEM for enhanced security. Common pitfalls in deployment include skipping the initial freshclam run and using clamscan instead of clamdscan for repeated scans. ClamAV is free for commercial use and can also scan Windows systems, although it does not replace comprehensive endpoint protection solutions.

Tech Optimizer

July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.

Winsage

July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.