classes Archives

AppWizard

July 22, 2026

Darkest Dungeon—the original—is getting surprise DLC in August

Darkest Dungeon is set to expand with a new DLC titled The Fire's Edge, releasing on August 18th. This DLC introduces two new hero classes, the Duelist and the Runaway, along with new Trinket mechanics and three additional districts. The Duelist is a complex damage dealer, while the Runaway features a new Burn damage type. Both heroes are re-envisioned from their appearances in Darkest Dungeon II. The game has received an 88% review score and won the "Best RPG" award in 2016.

Winsage

July 15, 2026

Windows 0-day drops the same day Microsoft releases record number of patches

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, discussed a vulnerability that allows attackers to gain administrator privileges by configuring a system to execute their code upon an admin user's login. This vulnerability enables non-admin users to modify the classes registry hive of an admin user, posing a significant risk. It could be exploited without user interaction and may be combined with another vulnerability that provides direct access to an administrative account. Microsoft is aware of the issue and is investigating it, encouraging coordinated disclosure from vulnerability reporters. Independent researcher Kevin Beaumont has created a detection script to help protect against this vulnerability, along with recommendations to restrict local non-user accounts, monitor the ProfSvc for unexpected hive loads, and track activity related to NTUSER.DAT and UsrClass.dat files.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Tech Optimizer

July 12, 2026

Running pgvector in production on Amazon Aurora PostgreSQL

Running pgvector on Amazon Aurora PostgreSQL-Compatible Edition offers a vector store with operational capabilities, high availability, and scalability. It is favored for Retrieval Augmented Generation (RAG) workloads transitioning to production, but increased traffic introduces challenges like query latency and memory management. Key operational practices for pgvector workloads include selecting the appropriate index type (HNSW or IVFFlat), establishing a baseline schema, choosing a suitable distance operator, scaling the index through quantization and partitioning, and preparing for churn and observability. The prerequisites for using pgvector include an Aurora PostgreSQL-Compatible cluster with specific PostgreSQL versions and the vector extension enabled. The embedding model used in examples is Amazon Titan Text Embeddings V2, which produces 1024-dimensional embeddings. pgvector supports two Approximate Nearest Neighbor (ANN) index types: HNSW, which is efficient for querying and allows for incremental insertions, and IVFFlat, which is less resource-intensive but requires rebuilding if data changes. There are scenarios where forgoing an index is beneficial, such as small datasets or partitioned datasets requiring 100% recall. A baseline schema for a multi-tenant document store includes creating a table for documents with an embedding vector and establishing indexes for tenant IDs and embeddings using HNSW. The recommended parameters for HNSW include m = 16 and ef_construction = 128. Scaling to millions of vectors involves quantization, tuning HNSW parameters, and partitioning. Aurora Optimized Reads can extend effective cache capacity, and managing index churn is crucial for maintaining performance. Observability metrics include query-level statistics, instance-level metrics, and custom application-defined metrics. To clean up after testing, it is advisable to drop the created indexes and tables, and delete the Aurora PostgreSQL-Compatible cluster and any manual snapshots taken during testing.

Winsage

July 9, 2026

Microsoft Details How It’s Using AI to Improve Windows Security

Microsoft has reaffirmed its commitment to security, focusing on enhancing protection for Windows users. The company is utilizing a multi-model agentic scanning harness (MDASH) that incorporates various AI models to identify Windows vulnerabilities earlier in the development process. This proactive approach allows security experts to detect potential issues before public releases. Microsoft is also investing in technologies that use AI to streamline the development of fixes while maintaining human oversight during code reviews. The company acknowledges the dual nature of AI in security, as it accelerates both the identification of vulnerabilities and the potential for exploitation. Microsoft aims to strengthen its systems to find vulnerabilities earlier and deliver timely security patches to customers.

AppWizard

July 5, 2026

Darktide’s new Skitarii class is its most unique yet, but it also advances our understanding of Warhammer 40k lore

Warhammer 40k features the Skitarii class, which is characterized as cyborg warriors devoted to a cult and communicates in binharic cant. They possess abilities such as delivering electric shocks, using a retractable claw arm for close combat, reviving allies, solving puzzles, and providing fire support through Servo-Skull minions. The Skitarii class emphasizes support and teamwork over individual prowess, offering a diverse skill tree and customization options that enhance the gameplay experience. Fatshark's introduction of this class in Darktide reflects a shift towards strategic collaboration rather than traditional aggressive playstyles.

AppWizard

July 2, 2026

Windrose might get wind

Windrose features forgiving mechanics where players retain weapons and gear, and can easily replace lost pirate ships. Hunger and thirst are not factors, and the NPC pirate crew is immortal. The game allows for seamless sailing without wind. The studio announced a major update during early access, introducing a new biome called the Ashlands, new islands with unique enemies and resources, new building pieces, decorative options, new pirate ship classes, and improved NPC ship behavior. The studio is considering adding wind mechanics but aims to maintain a fun and simple gameplay experience. Further details on the update's release will be shared with the community.

Winsage

June 25, 2026

Introduction to COM usage by Windows threats

Component Object Model (COM) is a technology in Windows that enables object activation, inter-process communication, and automation across different programming languages. Malware exploits COM interfaces for activities such as lateral movement, execution, downloading, exfiltration, persistence, evasion, system discovery, and automation of Windows and Office functionalities. Reverse engineering COM-heavy binaries involves navigating GUIDs and indirect vtable calls to understand malware mechanics. Research at the AVAR 2025 conference and CARO 2026 workshop discusses methodologies for analyzing COM binaries and case studies of malware families that utilize COM. COM is an application binary interface (ABI) model that allows software components to be reused and enables interaction between different programming languages through interfaces defined at the binary level. Distributed COM (DCOM) allows clients to activate COM objects on remote systems. COM classes are identified by unique class identifiers (CLSIDs), and interfaces by interface identifiers (IIDs). The Windows registry stores COM registration data, with classes and interfaces located under specific keys. Malware often acts as a COM client, utilizing the COM runtime to instantiate classes and request interfaces. ProgIDs provide human-readable registry entries for COM classes. The CoCreateInstance function helps create class objects by resolving CLSID registrations. All COM interfaces derive from IUnknown, which manages object lifetimes and interface querying. COM has its own security model, and identifying classes and interfaces used by malware is crucial for threat researchers. Tools like ComView and OleView.NET assist in inspecting COM registrations. The analysis workflow includes identifying activation API calls, extracting CLSID and IID values, consulting registry definitions, and mapping vtable calls. Qakbot, a banking trojan, exemplifies the use of COM in malware, with its architecture enabling malicious activities like credential theft. Dynamic analysis tools can log COM-related calls in real-time to trace execution flow. Notable malware families that utilize COM include Gh0stRAT, which uses Task Scheduler COM interfaces, and the Attor platform, which employs BITS for file transfers. WarmCookie demonstrates the use of COM for persistence through Task Scheduler. Understanding COM's role in malware is essential for cybersecurity professionals.

AppWizard

June 19, 2026

Guild Wars 3 is ‘significantly more’ of an MMO than the first game, but that doesn’t mean it’s like GW2: ‘All three of our games can coexist as different experiences’

Guild Wars 2 is a significant title in the MMO genre, following the original Guild Wars, which is more accurately described as a mission-based action role-playing game (ARPG) with shared town hubs. ArenaNet's studio head, Colin Johanson, confirmed that the upcoming Guild Wars 3 will be an MMO, with some nuances. He categorized the original Guild Wars as a "cooperative online RPG" and noted that Guild Wars 2 was designed as a true MMO. Johanson's comments reflect on the challenges and emotional experiences associated with MMOs.

AppWizard

June 13, 2026

Alongside its new expansion, Warhammer 40K: Rogue Trader got a massive patch buffing its weakest classes and companion

Owlcat Games is developing multiple RPG projects, including The Expanse: Osiris Reborn and Warhammer 40K: Dark Heresy, while expanding its 2023 release, Rogue Trader. The latest update for Rogue Trader, titled The Infinite Museion, includes a significant patch that balances gameplay, particularly for the Operatives and Assassins classes, which have been underperforming compared to the Soldier and Executioner classes. Owlcat Games has a history of providing post-launch support, enhancing the longevity and player engagement of its titles, such as Pathfinder: Kingmaker and Pathfinder: Wrath of the Righteous.