NewApp Digest
search bot

code

Inside the Architecture of an MCP Server for PostgreSQL
Tech Optimizer
April 30, 2026

Inside the Architecture of an MCP Server for PostgreSQL

The Model Context Protocol (MCP) serves as a standard interface between large language models (LLMs) and external systems like PostgreSQL, emphasizing the importance of control over mere connectivity. An MCP server must act as a mediation and policy layer, enforcing security boundaries and ensuring that connections default to read-only. It should validate AI-generated SQL as untrusted input, encapsulate queries within transactions, and apply execution-time controls. The server must separate query generation from execution approval to manage operational costs and enforce guardrails on query types, such as limiting the number of rows returned. Token efficiency is crucial, with design considerations for compact data representation and schema introspection. In production, connection management is vital to prevent data leakage among multiple AI agents, and observability through logging executed queries and metadata is necessary for debugging and compliance. Long-running sessions require support for paginated responses to manage context effectively. Overall, the MCP server must integrate security, query safety, token efficiency, and observability into its design from the outset.
Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection
AppWizard
April 30, 2026

Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection

A new infostealer malware called LofyStealer is targeting the gaming community, particularly Minecraft players, by disguising itself as a cheat tool named “Slinky.” It employs a two-stage attack to extract sensitive information from eight major web browsers, including Chrome and Firefox, while evading detection by security software. The malware siphons off cookies, saved passwords, payment card information, and session tokens. Researchers at Zenox.ai identified LofyStealer, linking it to the Brazilian cybercrime group LofyGang, which has been active since October 2022. The malware uses social engineering tactics to appear legitimate and operates as a Malware-as-a-Service platform, offering both Free and Premium tiers to buyers. Its technical sophistication is evident in its method of in-memory browser injection, which allows it to bypass security defenses. The stolen data is compressed and sent to a command-and-control server. Users are advised to avoid downloading unofficial game mods and enable multi-factor authentication to reduce the risk of credential theft. Security teams should monitor for specific behavioral indicators related to the malware's operations.
CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)
Winsage
April 30, 2026

CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)

Attackers are exploiting CVE-2026-32202, a zero-click vulnerability in Windows Shell, allowing authentication of victims' systems without user interaction. This vulnerability stems from an incomplete patch for CVE-2026-21510 and has been used by the APT28 group with weaponized LNK files to bypass Windows security. Although Microsoft addressed these vulnerabilities in February 2026, the risk remains as opening a folder with a malicious LNK file can still connect victims' machines to the attacker's server, initiating an NTLM authentication handshake that exposes the victim’s Net-NTLMv2 hash. This affects various versions of Windows 10, 11, and Windows Server. Microsoft released a patch for CVE-2026-32202 on April 14, 2026, but did not label it as actively exploited until more than two weeks later, leaving security teams unaware of its urgency. Organizations are advised to apply the patch and consider blocking outbound SMB traffic to mitigate risks.
S&box makes nearly $1 million on launch day, and yes there are problems but that's okay: 'We love it when things break because then we get to fix them'
AppWizard
April 29, 2026

S&box makes nearly $1 million on launch day, and yes there are problems but that’s okay: ‘We love it when things break because then we get to fix them’

The gaming community has mixed reactions to the release of S&box, the successor to Garry's Mod, with some players dissatisfied and others hopeful for improvement. Facepunch Studios, the developer, reported technical challenges during the launch, including backend issues and a self-inflicted DDoS. Despite these hurdles, they remain optimistic about S&box's future and the role of AI in programming education. The game will not include an AI Assistant button, but Facepunch aims to enhance the discovery algorithm for quality content. They have chosen a forward rendering technique for better visual performance. Financially, S&box generated nearly million on its first day, leading Facepunch to double its Play Fund to million. A patch for S&box has been released to improve the game based on player feedback.
Microsoft open-sources 86-DOS 1.00, the ancestor of Windows
Winsage
April 29, 2026

Microsoft open-sources 86-DOS 1.00, the ancestor of Windows

Microsoft has made the source code for 86-DOS 1.00 available on GitHub to celebrate its 45th anniversary. 86-DOS, developed by Tim Paterson, was foundational for MS-DOS and Windows. This release is part of Microsoft's effort to preserve historically significant software. Microsoft previously released the source code for MS-DOS versions 1.25, 2.11, and 4.0. A team of historians and preservationists has gathered and transcribed DOS-era source listings, including the 86-DOS 1.00 kernel and development snapshots of the PC-DOS 1.00 kernel. Microsoft acquired 86-DOS from Seattle Computer Products for approximately ,000 and modified it to deliver PC-DOS 1.0 in August 1981, which became known as MS-DOS for IBM-compatible computers.
"GitHub is failing me, every single day, and it is personal": After Xbox and Windows, now GITHUB is in crisis — Microsoft, what are you doing?
Winsage
April 29, 2026

“GitHub is failing me, every single day, and it is personal”: After Xbox and Windows, now GITHUB is in crisis — Microsoft, what are you doing?

Microsoft acquired GitHub in 2018 for .5 billion in stock. As of April 25, 2026, GitHub has failed to meet its service level agreements (SLAs), reporting an uptime of only 90.21%, significantly lower than the promised 99.9%. Developer Mitchell Hashimoto has documented these outages, which have led to user frustrations, including issues like disappearing code commits. GitHub's Chief Customer Officer, Kyle Daigle, acknowledged the concerns but failed to alleviate user dissatisfaction. Hashimoto announced his departure from GitHub, citing ongoing outages that hindered his work. Additionally, the programming language Zig has migrated to competitor Codeberg, criticizing GitHub's engineering culture. GitHub's struggles are linked to Microsoft's focus on artificial intelligence, which has diverted resources and raised concerns about service quality across Microsoft's products.
Coding Simulator 2 codes April 2026
AppWizard
April 29, 2026

Coding Simulator 2 codes April 2026

Coding Simulator 2 offers players codes that provide in-game rewards such as free diamonds, potions, and currency. The latest codes include: - 500kvisits: Grants a cash potion 3, a diamonds potion 3, an NFT luck potion 3, and a mining luck potion 3. - 1000diamonds: Provides 1,000 diamonds. To redeem these codes, players must be a member of the RoDark community group, launch the game, find the 'verify' NPC in the shop, enter the code, and submit it to receive rewards. New codes are typically released during significant milestones in the game. A Discord server for Coding Simulator 2 exists for players to connect, receive updates, trade items, and report bugs.
Denuvo has been cracked in all single-player games it previously protected — 2K Games and Denuvo reportedly retaliate with mandatory 14-day online checks
AppWizard
April 29, 2026

Denuvo has been cracked in all single-player games it previously protected — 2K Games and Denuvo reportedly retaliate with mandatory 14-day online checks

The skull-and-bones community has declared that there are no games utilizing Denuvo that remain uncracked or bypassed. The MKDev collective and DenuvOwO developed a hypervisor-based bypass (HVB) in late 2025, which intercepts Denuvo's verification checks. The cracker voices38 successfully removed Denuvo from several titles, including Resident Evil: Requiem. Denuvo has since implemented a 14-day mandatory online check for certain games, complicating the HVB method. The latest version of HVB requires users to disable Core Isolation and Driver Signature Enforcement to run games. The community includes notable figures like repacker FitGirl, who has acknowledged the collaborative efforts of DenuvOwO and voices38.
Search