NewApp Digest
search bot

confidentiality

silver Android smartphone
AppWizard
June 6, 2026

I thought text-only Grand Theft Auto roleplay sounded too intimidating—but GTA World is showing me why players are slowing things down

A man announces that someone has overdosed, prompting a visit to an infirmary where a distressed family is present. The importance of respecting their privacy is acknowledged. The text contrasts the spontaneous and dynamic nature of roleplaying in FiveM with the serious atmosphere of text-only servers. Players in FiveM engage in varied scenarios, allowing for casual participation, while text-only environments focus on deliberate storytelling and gradual plot development. The author reflects on their experiences in different gaming settings, noting a shift from chaotic gameplay in GTA Online to a more subdued existence in Los Santos, where they explore everyday roles and aspirations.
ADCS Now Generates Post-Quantum Certificates For Windows
Winsage
June 4, 2026

ADCS Now Generates Post-Quantum Certificates For Windows

Active Directory Certificate Services (ADCS) now supports the generation of post-quantum certificates, enhancing quantum-safe cryptography within Windows' secure connection protocols. Microsoft has integrated PQ TLS hybrid key exchange into the Windows Transport Layer Security (TLS) stack, providing protection against "Harvest Now, Decrypt Later" attacks. The PQ TLS hybrid key exchange combines traditional cryptographic methods with the NIST ML-KEM algorithm, offering three hybrid combinations: X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1_MLKEM1024. This feature is available in preview via the Windows Insider Program and will be rolled out to Windows 11 and Windows Server. Additionally, Windows cryptography APIs now support composite ML-KEM and ML-DSA algorithms, which are NIST-approved standards for key exchange and digital signatures, enhancing security by requiring multiple components to be compromised. Microsoft emphasizes the importance of establishing new Certification Authorities (CAs) for implementing post-quantum certificate issuance, as existing CAs cannot be upgraded. The introduction of ML-DSA support within ADCS allows organizations to counter HNDL risks associated with long-lived data. Organizations are encouraged to inventory their use of public-key cryptography, prioritize systems protecting sensitive data, and test hybrid and composite approaches in non-production environments to facilitate a smooth transition to quantum-safe cryptography.
CVE-2026-45585: YellowKey BitLocker Bypass
Winsage
May 23, 2026

CVE-2026-45585: YellowKey BitLocker Bypass

BitLocker, a security feature for data protection, has a vulnerability identified as CVE-2026-45585, also known as YellowKey, which allows unauthorized access to encrypted data on Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025. This flaw does not compromise BitLocker’s encryption but affects the recovery environment supporting it. The vulnerability can be exploited locally through the Windows Recovery Environment (WinRE) by an attacker with physical access, who can trigger an unrestricted shell and access the BitLocker-protected volume. Microsoft has provided two mitigation strategies: modifying the WinRE image to remove the autofstx.exe entry and transitioning from TPM-only protection to a TPM+PIN requirement at startup. The exploit poses challenges for detection, as it occurs pre-boot and currently lacks vendor-published indicators of compromise. Organizations using BitLocker for unattended devices are particularly at risk, as the vulnerability can lead to loss of confidentiality if an attacker gains access before the legitimate user.
CVE-2026-9082: Critical Drupal Core SQLi Flaw
Tech Optimizer
May 23, 2026

CVE-2026-9082: Critical Drupal Core SQLi Flaw

Drupal has issued critical security updates for a vulnerability in Drupal Core, identified as CVE-2026-9082, which affects sites using PostgreSQL databases. This flaw allows anonymous attackers to exploit the system through arbitrary SQL injection, posing risks such as sensitive information disclosure, privilege escalation, and remote code execution. The vulnerability is rated 20 out of 25 by Drupal and 6.5 out of 10 by CVE.org. It specifically impacts the database abstraction API, which fails to properly sanitize queries. The fixed versions include 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10, with best-effort patches available for unsupported versions 9.5 and 8.9. Organizations are advised to inventory their Drupal installations, verify PostgreSQL usage, and prioritize patching for public-facing sites.
Windows DNS Client Security Flaw Exposes Systems to Remote Code Execution
Winsage
May 15, 2026

Windows DNS Client Security Flaw Exposes Systems to Remote Code Execution

Windows systems are threatened by a vulnerability in the Windows DNS Client, identified as CVE-2026-41096, which allows remote code execution without user intervention. It has a CVSS base score of 9.8, indicating high severity. The flaw is a heap-based buffer overflow in the dnsapi.dll component, enabling unauthenticated remote attackers to execute arbitrary code. Exploitation requires sending a specially crafted DNS response to a vulnerable system, potentially leading to complete control over the host. Affected systems include supported versions of Windows 11 and Windows Server 2022/2025. Microsoft released security updates on May 12, 2026, and administrators are advised to apply these patches and reboot systems. Despite the severity, Microsoft currently classifies exploitation as “Exploitation Unlikely,” with no known public exploits or in-the-wild attacks.
Signal isn’t broken — so how are hackers targeting the world’s ‘most secure’ chat app?
AppWizard
April 27, 2026

Signal isn’t broken — so how are hackers targeting the world’s ‘most secure’ chat app?

On April 26, hackers allegedly linked to Russian groups targeted the Signal messaging app with phishing attacks aimed at senior politicians. These attacks did not compromise Signal's end-to-end encryption; rather, they deceived users into providing access to their accounts through fake messages. Signal is operated by the non-profit Signal Foundation, founded in 2012 by Moxie Marlinspike with funding from Brian Acton, a co-founder of WhatsApp. Signal distinguishes itself by rendering metadata invisible to its operators, unlike WhatsApp, which shares user data with its parent company. Signal's president, Meredith Whittaker, advocates for data privacy.
If you ever need truly private photos on Android, this is the camera app to use
AppWizard
April 14, 2026

If you ever need truly private photos on Android, this is the camera app to use

Smartphone manufacturers have focused on improving megapixels and zoom capabilities in camera technology while neglecting user security features. Major camera apps from companies like Google and Samsung lack immediate methods to protect sensitive information at the point of capture. A recent poll indicated that 71% of respondents believe privacy-focused features are necessary in camera apps. SnapSafe is an application designed to enhance privacy by operating without internet permissions, allowing for encrypted image capture, editing, and storage. Users must set a PIN to secure the app, and it includes features like a "Poison Pill" for deleting images with a secondary PIN, decoy photographs for security, and automatic face obfuscation. Despite some shortcomings, such as delays in image capture and limited image management features, SnapSafe is recognized as a leading private camera app for Android, highlighting the demand for privacy-centric technology in photography.
Guardian source messaging tech bringing in 'much higher quality' of tips
AppWizard
March 27, 2026

Guardian source messaging tech bringing in ‘much higher quality’ of tips

The Guardian's secure messaging technology, launched in June, has significantly improved the quality of tips from sources, utilizing advanced encryption techniques to ensure confidentiality. The app allows messages to vanish after 14 days and is designed to protect sources' anonymity better than many other encrypted services. It has been recognized as a finalist for a major award and has led to a notable increase in story tips, particularly from the U.S. and Australia, despite its primary user base being in the UK and Europe. The app operates independently of The Guardian's paywall, enabling non-paying users to submit tips freely. The platform encourages contributions from users who may have felt intimidated by other secure methods. The technology enhances communication quality and allows sources to provide context to existing stories. As of September, the app has one million daily active users, with features that obscure genuine communications among automated messages, contributing to source protection. The Guardian has invested in guiding sources on crafting effective tips and has made the secure messaging technology open source for other newsrooms to adopt, aiming to improve source protection across the industry. Collaborations with organizations like The Signals Network and the University of Cambridge are ongoing to gather feedback and enhance the technology further.
Search