command-line Archives

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 20, 2026

July 2026 Patch Tuesday: KB5101650 Windows 11 Update

On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11 versions 25H2 and 24H2, addressing OS Builds 26200.8875 and 26100.8875. This update includes essential security fixes, updates to Secure Boot certificates, and enhanced Remote Desktop Protocol (RDP) defenses against phishing attacks. It consolidates July 2026's security content, addressing known vulnerabilities and introducing functional improvements. The update is critical for minimizing exposure to identified threats and is prioritized for systems managing remote access or nearing certificate expiration. The update enhances Remote Desktop security by supporting SHA-2 certificate thumbprints while retaining SHA-1 for legacy compatibility. It includes new Group Policy options to mitigate phishing risks associated with malicious .rdp files. The curl upgrade to version 8.21.0 incorporates security patches for command-line tools in Windows environments. Secure Boot certificates are automatically updated through Windows updates, ensuring boot security across various hardware. KB5101650 installs primarily through the Windows Update interface, requiring a restart to activate changes. Enterprise environments can use the Microsoft Update Catalog for manual distribution. A temporary restriction affects certain Dell devices with Intel Innovation Platform Framework drivers, which Microsoft plans to address in a future update. The cumulative update resolves a total of 622 Microsoft CVEs, including 416 affecting Windows components. Users are advised to verify and install the update promptly to secure the full suite of improvements.

Winsage

July 19, 2026

How to install apps on your Windows 11 PC with Windows Package Manager (winget)

Windows 11 users can download applications using the Windows Package Manager (winget) via the command line, bypassing traditional web browser navigation. Winget is integrated into Windows 11, modern Windows 10, and Windows Server 2025, simplifying application management. To use winget, users can open the Command Prompt, check for installation with "winget --version," search for applications with "winget search [app name]," and install them using "winget install [app name]." Users can also specify installation directories and utilize commands to list installed applications, show details about specific apps, and uninstall applications.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Tech Optimizer

July 12, 2026

What Is Serverless PostgreSQL?

Serverless PostgreSQL is a fully managed cloud database model that separates compute and storage, allowing them to scale independently and automatically based on demand. It eliminates the need for manual infrastructure provisioning and capacity planning, charging only for active usage. Unlike traditional PostgreSQL setups, which require continuous resource allocation and manual scaling, serverless PostgreSQL provisions resources on demand and can scale down to zero during idle periods. Serverless PostgreSQL integrates with serverless compute platforms, enabling analytical queries to access the same data within a unified architecture. Key differences between traditional and serverless PostgreSQL include manual versus automatic provisioning and scaling, fixed versus usage-based billing, and high versus reduced operational overhead. Lakebase architecture is an emerging model that combines transactional databases with lakehouse foundations, allowing operational and analytical workloads to coexist on a single platform. This architecture minimizes data duplication and simplifies access, enhancing data management and analysis. Serverless PostgreSQL operates on a cloud-native architecture that enhances efficiency by allowing compute and storage to scale autonomously. It features scale-to-zero behavior, where compute resources are suspended when inactive and reactivated upon new queries. Major providers include Databricks Lakebase, Amazon Aurora Serverless v2, and Neon, each offering varying capabilities and integrations. Pricing for serverless PostgreSQL typically includes charges for compute resources, storage, and data transfer, with costs fluctuating based on workload activity. Cold start latency is a performance consideration, as reactivating compute resources can introduce delays. Strategies to mitigate this include keeping resources partially active or selecting providers with minimal cold start impacts. Serverless PostgreSQL is well-suited for OLTP workloads, while lakebase architecture is better for AI development, variable workloads, and environments requiring rapid iteration. Setting up serverless PostgreSQL involves choosing a provider, creating a database instance, and configuring access settings. It can also be used alongside serverless compute platforms for analytics, further extending its capabilities.

Winsage

July 1, 2026

Your Microsoft Store Office apps are losing security updates this year

By December 2026, support for Microsoft Store versions of Office applications will cease, and they will no longer receive security updates. New feature updates for Microsoft 365 Apps installed via the Microsoft Store stopped in October 2025. Users are encouraged to transition to Click-to-Run versions to maintain access to updates and security features. Click-to-Run allows for immediate application usability while downloading in the background and updates automatically. The Office Deployment Tool (ODT) can assist users in transitioning to Click-to-Run versions.

Winsage

June 30, 2026

Microsoft reveals why Windows 11 keeps saying a file is in use after you close the app, plus the fix

The 'file in use' error in Windows indicates that a file is currently being accessed by a program, preventing deletion or renaming to avoid data corruption. This error can persist even after closing an application due to reasons such as antivirus software scanning the file, network references from other devices, or files loaded as Dynamic Link Libraries (DLLs) that remain in memory. To identify the process causing the error, Mark Russinovich developed the command-line tool Handle, which shows all open file handles, and Process Explorer, which provides a graphical interface to find and manage these handles. Microsoft is integrating Sysinternals tools into PowerToys for easier access, including the File Locksmith tool that allows users to unlock files directly. A recommended workaround for the error is to rename the file instead of deleting it, as Windows permits renaming even when a file is open.

Winsage

June 28, 2026

Microsoft denies WSL 3 exists, reveals Windows 11’s WSL Containers ship next week

Microsoft has clarified that there is no WSL 3 in development, as stated by Craig Loewen, the Product Manager for the Windows Subsystem for Linux (WSL). The confusion arose from articles discussing a new feature called WSL Containers, which will be launched soon. WSL allows users to run Linux environments on Windows without dual-booting, while WSL Containers enable the creation and management of Linux containers directly within Windows, eliminating the need for third-party tools like Docker Desktop. WSL 1, introduced in 2016, served as a translation layer for Linux system calls, and WSL 2, launched in 2019, included a full Linux kernel in a lightweight virtual machine. WSL Containers is an enhancement to WSL, allowing developers to build, run, and deploy containers directly from Windows using the wslc.exe command. This feature is part of Microsoft's strategy to make Windows a more accessible platform for running Linux workloads, helping to retain developers who might consider switching to other operating systems.

Winsage

June 25, 2026

Making Windows a developer platform, again

Setting up a PC with the base Dev Config has been streamlined for developers, utilizing the Winget configuration service to install applications, execute updates, and apply developer settings on Windows. Users can access setup scripts by cloning a GitHub repository or downloading a zip archive, with clear instructions provided by Microsoft. The installation may require a reboot during the Windows Subsystem for Linux (WSL) installation, but the script resumes automatically afterward. The process installs applications such as PowerShell, Git, GitHub command-line interfaces, Windows App SDK, Visual Studio Code, and language support for Node.js, Python, and .NET. It also includes developer-friendly fonts and a theme engine for Windows Terminal, along with options for customizing File Explorer and the Windows Task Bar. After WSL installation, developers can use WSL Comfort scripts to install additional tools and personalize their Windows Terminal experience. This utility has two phases: the Windows component configures WSL and Ubuntu, while the Linux component fine-tunes the WSL environment, allowing for zsh and starship terminal display tools. It also integrates popular command-line interfaces and supports the Homebrew package installer, targeting existing Ubuntu instances without needing a new Linux distribution installation.