code Archives

Winsage

May 1, 2026

Microsoft CEO wants to win back lost Windows fans

Satya Nadella, CEO of Microsoft, announced the company's renewed focus on improving user engagement with Windows and its consumer offerings during the third quarter of fiscal year 2026. Microsoft is addressing issues in Windows 11 by enhancing speed and reducing bugs, with key objectives including improving performance on devices with lower RAM, simplifying the update interface, and focusing on core features. Notable updates include options to postpone or skip system updates, the removal of unnecessary applications like Copilot, and enhancements such as displaying NPU activity in Task Manager and a built-in Internet speed test. Microsoft is also transitioning to native frameworks like WinUI 3, redesigning the Start menu to function directly at the system level, which is expected to reduce RAM consumption and improve performance stability on lower-resource devices.

Winsage

May 1, 2026

Microsoft tests redesigned Windows 11 Run menu with dark mode and more

Microsoft is rolling out a significant update to the Windows 11 Run menu for users in the Experimental Channel, featuring a modern interface, improved speed, and dark mode support. The "Browse" button has been removed and replaced with a new command, “~,” which directs users to their user directory. The updated Run menu is developed using code from the Command Palette, and Windows 11 Insiders can activate it through Settings. An early version of this redesign was seen in preview builds last year. The update aims to enhance overall system performance and efficiency.

Tech Optimizer

May 1, 2026

Ghost: A Database for Our Times?

Ghost, developed by ghost.build, is an "agent-first" Postgres database platform designed for AI-related applications, allowing developers and AI agents to create, fork, inspect, query, manipulate, and delete databases easily. It is free to use and hosted on Ghost’s Cloud infrastructure, making it suitable for testing, prototyping, and disposable database environments. Users can create databases on demand, execute SQL queries, and discard them when finished, contrasting with traditional managed databases. Ghost integrates with AI tools like Codex and Claude Code, providing direct database management capabilities through its MCP server. To install Ghost, users need a supported coding agent and a GitHub account. Installation commands differ for Linux, macOS, and Windows. After installation, users can verify the Ghost MCP server and interact with it through their coding agents. Examples of using Ghost include creating a sales data database, utilizing Ghost CLI commands, and experimenting with databases through AI agents. Ghost allows for rapid database manipulation and is ideal for proofs of concept and experimentation, although caution is advised before using it for production data.

Winsage

May 1, 2026

Who needs ghost train scares when Windows is such a fright?

Andy Bailey, a reader of Register, describes a ride at Alton Towers, a UK theme park, that was formerly named Duel but has been changed to a ghost train experience. During the ride, he encountered a Windows error message stating "Memory could not be read" in explorer.exe, which he found unsettling. The error could be due to failing hardware, a problematic driver, or a code glitch. He reflects on how a truly frightening experience for IT professionals might include scenarios like encountering Windows' Clippy as an undead AI assistant or facing unexpected Windows Updates that disrupt the ride.

Winsage

May 1, 2026

Windows 11 KB5083631 update released with 34 changes and fixes

Microsoft has released the KB5083631 optional cumulative update for Windows 11, featuring 34 enhancements aimed at improving user experience and system performance. Key features include a new Xbox mode for immersive gaming, improved performance for startup applications, enhanced security for batch files and CMD scripts, haptic feedback on supported devices, improvements to Secure Boot, and updates to Kerberos authentication. The update also addresses issues with Windows Security event logging, eliminates a white flash in dark mode, and increases the reliability of explorer.exe processes. Users can install the update via Windows Settings under Windows Update. After installation, Windows 11 devices will be updated to builds 26100.8328 and 26200.8328. Additionally, updated Secure Boot certificates are being rolled out, and some Windows Server 2025 devices may require a BitLocker recovery key after the update.

Tech Optimizer

May 1, 2026

Backstage Ditches Postgres for Databricks Lakebase

The divide between operational and analytical databases is diminishing, as evidenced by Databricks integrating Spotify's Backstage with its Lakebase, transitioning from PostgreSQL to a unified data platform. Lakebase now offers a serverless PostgreSQL interface within Databricks, allowing Backstage to operate without awareness of the underlying changes. The integration involved updating configurations and addressing authentication challenges using OAuth JWTs. The integration transforms the database development lifecycle by enabling near-instant database branching through Lakebase's copy-on-write architecture, allowing developers to focus on testing changes rather than safety. Branching creates a pointer to existing data, making the operation instantaneous. Point-in-Time Recovery (PITR) allows for quick restoration of data, demonstrated by a recovery process that took less than four seconds. The goal is to integrate database branching into developer workflows seamlessly, making it automatic. This change could enhance developer productivity by allowing live data testing from the start, eliminating the need for mock objects, and resolving common issues related to staging environments. The traditional constraints of slow and costly database copies will become obsolete, prompting teams to reconsider how much time they spend on workarounds for now-nonexistent constraints.

Winsage

May 1, 2026

Windows Weekly 981: Semi-Sophisticated

Leo, Richard, and Paul discussed developments in the Windows Insider Program, Snapdragon X2 gaming, artificial intelligence, and Xbox. Two changes in the Insider Program were noted. Microsoft has open-sourced early MS-DOS source code. Intel reported a .7 billion loss, which Paul attributes to 'collusion.' Microsoft and OpenAI are revising their partnership, with Microsoft 365 Copilot gaining enhanced AI features in Word, Excel, and PowerPoint, and GitHub Copilot moving to a usage-based billing model starting June 1. OpenAI is reportedly entering the mobile phone market, while Adobe's Firefly AI Assistant is in preview, and Anthropic is increasing its creator space involvement. Microsoft Gaming has rebranded to Xbox, with new leadership focused on future plans, including a mobile game store pending changes in Apple's policies. Valve will release its Steam Controller next week. A listener inquired about purchasing Windows 11 on Arm for Mac virtualization, leading to suggestions for cost-saving options. PowerToys 0.99 introduces new utilities and improvements. This week’s episode of RunAs Radio compares M365 Copilot and Claude Cowork. Reifel Rye is recommended as the brown liquor of the week.

AppWizard

April 30, 2026

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign

A Brazilian cybercriminal group known as LofyGang has re-emerged after three years, targeting Minecraft players with malware called LofyStealer, also known as GrabBot. This malware is disguised as a Minecraft hack named 'Slinky' and uses the official game icon to attract young users. The group has been active since late 2021 and previously leaked thousands of Minecraft accounts. The attack begins with the 'Slinky' hack, which deploys LofyStealer (identified as "chromelevator.exe") to harvest sensitive information from web browsers, including cookies, passwords, and credit card information, sending this data to a command-and-control server. ZenoX reports a shift in LofyGang's tactics from JavaScript supply chain attacks to a malware-as-a-service model, offering both free and premium tiers. Cybercriminals are increasingly exploiting trusted platforms like GitHub to distribute malware through bogus repositories and various deceptive tactics, including fake security alerts and counterfeit accounts. This trend highlights a strategy focused on volume targeting rather than precision, prompting cybersecurity experts to prioritize threats from GitHub-hosted downloads that appear legitimate.

AppWizard

April 30, 2026

LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection

Minecraft players are being targeted by a deceptive hacking tool called “Slinky,” which is actually an infostealer known as LofyStealer linked to the Brazilian cybercrime group LofyGang. The malware uses a Node.js-based loader and a C++ payload to extract sensitive browser data, disguising itself as a Minecraft hack. It primarily targets younger players who may unknowingly execute it. The malware operates through a two-stage architecture, with a 53.5 MB loader binary that injects a smaller 1.4 MB payload into browser processes, bypassing detection methods. It collects sensitive information such as cookies, passwords, and credit card details, compressing and encoding the data for exfiltration. The command-and-control (C2) infrastructure is hosted in Brazil, and the malware's design reflects advanced compilation techniques. The campaign is attributed to LofyGang, which has evolved into a more professional entity, posing severe risks to players who download cheats and cracked tools. Indicators of compromise include a specific C2 IP address and associated endpoints.

AppWizard

April 30, 2026

LofyStealer Uses Node.js Loader Against Minecraft Gamers

Cybersecurity threat hunters have discovered an active infostealer campaign targeting the gaming community, involving malware called LofyStealer (or GrabBot) that disguises itself as a Minecraft hack named “Slinky.” The attackers use the official game icon to trick young gamers into executing the malware. The Brazilian cybercrime group LofyGang has enhanced its technical capabilities, utilizing a sophisticated two-stage modular architecture. The initial stage features a 53.5 MB loader file named load.exe, which is a Node.js runtime environment that obscures malicious signatures. The loader connects to the attacker’s server and decrypts a 1.4 MB C++ payload, chromelevator.exe, which targets eight web browsers to extract sensitive information like cookies and passwords. The stolen data is compressed, encrypted, and sent to the attacker’s server. LofyGang has evolved into a Malware-as-a-Service platform, offering a web panel for operators to monitor victims and generate custom executables. The campaign highlights the increasing threats to the gaming community, with advanced evasion techniques being employed by cybercriminals. Security professionals are advised to monitor network traffic and conduct audits for suspicious activities.