communication Archives

AppWizard

August 16, 2026

Bumble Ends Its Signature Women-First Messaging Rule in Major Dating App Shakeup

Bumble has officially abandoned its women-first messaging rule, allowing either person in a heterosexual match to send the first message. This policy change eliminates the previous requirement for women to initiate conversations, which has been in place since the app's launch in 2014. Additionally, Bumble has extended the response window for initial messages from 24 hours to 72 hours to enhance user experience. The company had previously started easing its messaging framework in 2024 with the introduction of Opening Moves, allowing women to add conversation starters to their profiles. Reports indicate a growing demand for more flexibility in conversation initiation among users. Bumble's decision comes amid challenges in the online dating industry, including dating-app fatigue and evolving user habits. The change marks a significant shift in Bumble's operational ethos, moving away from a model that emphasized women's control in initiating conversations.

AppWizard

August 16, 2026

Windows 11 KB5121003 is triggering game crashes and other issues on some PCs

Windows 11 update KB5121003, released in August 2026, addresses over 400 vulnerabilities but has caused crashes in games like ARC Raiders and The Finals. The game studio Embark has confirmed that the crashes are linked to the inpoutx64.sys driver, which has compatibility issues due to the update. Users have reported errors such as “Hang detected on GameThread” and “EXCEPTIONACCESSVIOLATION” after installing the update. Embark has provided a workaround to stop and delete the inpoutx64.sys service to resolve the crashes. Uninstalling the update also appears to fix the issue. Additional reports indicate crashes in other games and graphics-related problems following the update.

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

AppWizard

August 14, 2026

Threema messenger says DDoS attacks disrupted its service for two days

Threema experienced significant disruptions due to large-scale DDoS attacks, rendering the service inaccessible for several hours on Tuesday and causing intermittent outages on Wednesday morning. The attacks targeted both Threema and its Swiss colocation partner, Nine, with service being unavailable from 7:30 p.m. to 11:30 p.m. CEST on Tuesday. By 12:23 p.m. on Wednesday, normal operations were restored. The security of Threema's systems and user data remained intact despite the service availability issues. The nature of the attacks made mitigation challenging, as attackers modified their methods rapidly. Threema's status page faced issues during the outage, and communication was conducted via email and social media. In response, Threema is implementing specialized upstream DDoS protection and plans to enhance its status page to provide monitoring for future disruptions.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

Winsage

August 13, 2026

Microsoft is cutting off new Office features on Windows 10 soon

Devices using Microsoft 365 Apps on Windows 10 will experience a significant transition with the rollout of version 2608, which will end feature enhancements for applications like Word, Excel, and PowerPoint. Security updates will continue until October 10, 2028. The OneDrive desktop app on Windows 10 version 22H2 will also receive updates until October 10, 2028, while older versions will not. Microsoft recommends transitioning to Windows 11 to avoid performance and reliability issues with Microsoft 365 Apps.

AppWizard

August 13, 2026

Spotify’s Android app is breaking down, and subscribers are reaching their limit

Spotify's Android users are experiencing significant performance issues, including UI lag, frozen playback, and unresponsive controls. The company acknowledged these concerns earlier this month but has not provided updates or timelines for resolution. Many subscribers are considering switching to alternatives like YouTube Music or Apple Music due to these ongoing problems. Complaints have surged on platforms like Reddit, detailing issues such as frozen screens and delayed button responses. Users feel neglected due to the lack of communication from Spotify regarding stability fixes. Currently, they are resorting to temporary measures like force-stopping the app and clearing cache files while awaiting a resolution.

AppWizard

August 13, 2026

Starship job simulation game Contact Protocol launches in spring 2027 for PS5, Xbox Series, Switch 2, and PC

Kinetic Publishing has partnered with Cold Zephyr Games to release the starship job simulation game Contact Protocol on PlayStation 5, Xbox Series, Switch 2, and PC via Steam, with a planned release in spring 2027. The game places players in the role of a security officer aboard the starship Pale Horse, requiring them to assess the intentions of approaching ships and make critical decisions that can have significant consequences. Key features include investigating incoming data, multitasking under pressure, and making choices that affect relationships and narratives. The game offers unique procedural encounters and a visually striking science-fiction world. A video and screenshots showcasing the game have been released.

AppWizard

August 12, 2026

Automattic has introduced the Mesh app for Android

Automattic has launched the Android version of its app, Mesh, which helps users manage personal and professional contacts with privacy. Mesh allows users to visualize their network, add notes, and set reminders. The Android version utilizes features like split-screen mode, pop-up windows, and supports keyboard shortcuts on foldable devices. It includes in-app search, home screen widgets, and real-time synchronization. Mesh partially integrates with Automattic’s Beeper messenger for streamlined communication. Currently in early access, Nexus AI enhances user experience by enabling intuitive queries about contacts. Mesh prioritizes user privacy and operates on a subscription model, offering a free version with a limit of 1,000 contacts and paid tiers for unlimited contacts. Approximately 70% of users utilize Mesh for business purposes. The app, formerly known as Clay, is available on Google Play and compatible with various devices.