conduct Archives

Tech Optimizer

September 4, 2026

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

A significant vulnerability in PostgreSQL, tracked as CVE-2026-6471, has been identified by cybersecurity firm Cyera. This flaw, present since 2014, allows attackers with minimal privileges to potentially take control of databases and servers. The vulnerability, known as PostGREShell, has a CVSS score of 7.2 and can be exploited for remote code execution and privilege escalation due to a missing authorization in the database's logical decoding mechanism. Attackers with 'Replication' privileges can load arbitrary files through the logical decoding plugin, executing code with the privileges of the postgres system user. This can lead to the elevation of privileges to superuser status, granting unrestricted access to all tables and the ability to execute operating system commands. All PostgreSQL versions from 9.4 to 18 are affected, with a patch available in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their PostgreSQL instances and audit their Replication accounts.

Winsage

September 4, 2026

Microsoft warns fake CAPTCHA is tricking Windows users into running malware

Microsoft has identified a new malware campaign called TerminalFix that uses fake CAPTCHA prompts to trick Windows users into executing malicious commands. This campaign is a variation of ClickFix attacks and employs deceptive pages that impersonate reputable services like Cloudflare. Instead of traditional CAPTCHA challenges, users are instructed to open PowerShell or Command Prompt and paste in commands, allowing attackers to execute complex scripts more easily. TerminalFix initiates a multi-stage intrusion, granting attackers persistent proxy access to the infected machine, which can lead to further exploitation of the company's network. The campaign relies on social engineering tactics, requiring user compliance with counterfeit verification instructions. Microsoft has released mitigation guidance, recommending restrictions on PowerShell access, monitoring for DLL sideloading, blocking outdated Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The campaign poses significant risks to enterprise networks, but individual users should also be cautious about executing commands requested by websites.

Tech Optimizer

September 3, 2026

Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital's Avast Antivirus, allowing attackers with local execution access to extract the Windows Security Account Manager (SAM) database and execute a shell with NT AUTHORITYSYSTEM privileges. The flaw is located in the Avast Sandbox component and could enable a complete local takeover of the system. The PoC is compatible with any version of Avast Antivirus and has been tested on fully patched versions of Avast and Windows 11 25H2. The repository does not provide a formal release, CVE identifier, or patch details. The vulnerability may also affect other GenDigital products like AVG and Norton. Security teams are advised to monitor for suspicious activities related to Avast services and restrict local administrator access. Organizations should inventory their deployed versions and apply vendor-provided updates as they become available.

Winsage

September 3, 2026

Microsoft is auto-enabling Memory Integrity on Windows 11 PCs from October. Why you shouldn’t turn it off

Starting in October 2026, Microsoft will automatically activate memory integrity for eligible Windows 11 devices through the Patch Tuesday update on October 13. Memory integrity, or Hypervisor-protected Code Integrity (HVCI), protects the core of Windows by ensuring that kernel-mode drivers are verified before execution, preventing malware from exploiting vulnerable drivers. Eligible devices must have an Intel 8th-generation processor or newer, AMD Zen 2 or newer, Qualcomm Snapdragon 8180 or newer, at least 8GB of RAM, a 64GB SSD, virtualization enabled in firmware, and compatible drivers. Secured-core PCs already have this feature enabled. Windows will assess device readiness before activation and will respect user settings if memory integrity has been intentionally disabled. Users can check memory integrity status in Windows Security under Device security. Incompatible drivers may cause issues, and conflicts will be logged in the Event Viewer. Microsoft is pushing this update due to increased security threats and aims to protect users who have upgraded their systems without performing clean installs. If issues arise with memory integrity enabled, users can identify problematic drivers in the CodeIntegrity event log.

Winsage

September 3, 2026

Windows 11: Memory Integrity enabled automatically from October

Microsoft plans to automatically activate Memory Integrity on a broader range of eligible systems starting October 2026, rolling it out through standard Windows quality updates. Prior to activation, Windows will assess hardware, drivers, and performance to ensure compatibility. Memory Integrity, part of Virtualization-based Security (VBS), uses the Windows hypervisor to create a secure environment for integrity checks on kernel code. Compatibility with drivers is crucial, as many older applications may not meet the stricter standards required for HVCI. Potential compatibility issues may arise with anti-cheat solutions, third-party input methods, and banking protection programs, which could lead to software malfunctions or boot failures. A readiness check will evaluate hardware compatibility, with eligible systems including Intel processors from the 8th generation, AMD processors from Zen 2, and Qualcomm Snapdragon 8180 or newer, along with specific RAM and storage requirements. The rollout will be gradual, and users who previously disabled HVCI will not face unexpected reactivation. Microsoft recommends updating affected applications or drivers in case of compatibility issues.

Winsage

September 2, 2026

Microsoft will expand Windows 11 Memory Integrity feature to more PCs starting in October — security feature reduces gaming performance on some systems

Microsoft will automatically enable its Memory Integrity feature on more eligible Windows PCs starting in October 2026, enhancing kernel-level protection. PCs with Memory Integrity currently disabled will retain their settings. Windows will also activate Virtualization-based Security (VBS) where necessary, which supports Memory Integrity. An automatic assessment will determine device eligibility based on hardware capabilities and compatibility. The rollout applies to Windows 11 installations meeting specific hardware specifications, including an 8th Generation or newer Intel processor or AMD Zen 2 or newer processor, at least 8GB of RAM, an SSD with a minimum of 64GB, compatible drivers, and enabled hardware virtualization. Memory Integrity, also known as Hypervisor-Protected Code Integrity (HVCI), has been part of Windows since the Windows 10 era and is now more integral to Windows 11 security for new installations. However, it may impact gaming performance, leading some gamers to disable it, which Microsoft has acknowledged in its recommendations.

Tech Optimizer

September 2, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, mimicking a customer service representative. It features a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent can respond to customer queries, calculate service prices, manage acceptance or rejection of services, propose appointment time slots, and confirm booking details. The agent operates in two persistence modes: in-memory for quick testing and Postgres for durability. Testing can be conducted locally with Streamlit or using Docker to simulate a production environment. Docker allows the application to interact with a PostgreSQL server without local installation, enhancing reproducibility. The project includes a docker-compose.yml file to initiate a PostgreSQL container, and users can also utilize a cloud-based Postgres solution. The application behavior remains consistent regardless of the database setup. The complete source code is available on GitHub for testing and further enhancements.

AppWizard

September 2, 2026

MHA issues advisory on malicious Android apps used to steal money, take control of phones

Cybercriminals are increasingly using malicious Android applications disguised as pornography apps to take control of users' devices and conduct unauthorized financial transactions. The Indian Cyber Crime Coordination Centre (I4C) has issued a warning about this trend. These apps are often promoted on social media and require users to download APK files from outside the Google Play Store. The National Cybercrime Threat Analytics Unit (NCTAU) has reported a rise in financial fraud linked to these applications, which include names like “Night Play,” “Reloop,” and “Kyss.” Once installed, these apps request sensitive permissions, such as Accessibility access, allowing malware to read screen information, click buttons, enter OTPs or PINs, confirm transactions, and initiate fund transfers, leading to unauthorized access to bank accounts. Additionally, the malware may install secondary applications or a VPN to reroute internet traffic through attacker-controlled servers, exposing sensitive data. These apps may also prevent uninstallation through standard device settings. The NCTAU advises users to only install apps from trusted sources, avoid unknown APK files, refrain from granting Accessibility permissions to unfamiliar apps, regularly review installed applications, and keep their devices updated. Users should monitor bank accounts for suspicious activity and, if compromised, restart in Safe Mode to uninstall malicious apps. If removal is difficult, backing up data and performing a factory reset is recommended. Citizens are encouraged to report fraudulent applications or cybercrime incidents through the national cybercrime helpline 1930 or the government’s reporting portal.

Tech Optimizer

September 1, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, featuring a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent responds to customer queries, calculates service pricing, manages service acceptance, suggests time slots, and confirms appointment details. It operates in two modes: in-memory for rapid testing and Postgres for persistent storage. Testing can be done locally using Docker, which simulates a Postgres environment, or with a hosted Postgres instance. The project includes a docker-compose.yml file to initiate a PostgreSQL 16 container, allowing the application to connect to the database. Data persistence is ensured through Docker volumes, and the application can be run with specific commands after setting up the environment variables. The system has been tested successfully, demonstrating its ability to manage bookings and maintain data integrity across sessions. Future enhancements are planned to improve the booking workflow and integrate additional communication channels.

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.