confidentiality Archives

AppWizard

September 8, 2026

More Android apps could soon save you from sending accidental nudes

Google is enhancing Android's Photo Picker by integrating its on-device Sensitive Content Warning system, which aims to prevent users from unintentionally sharing explicit content like nudity through third-party applications. This system has already been implemented in Google Messages, where it detects and blurs explicit images and videos while keeping user data private. Recent code discoveries in the Android 17 QPR2 Beta 4 indicate that this feature will be integrated into the Photo Picker, allowing apps to check for nudity in selected media before sharing. This integration could help protect users, especially minors, from sharing inappropriate content and may include age-based restrictions for applications using the Photo Picker. However, users can still bypass these safeguards by sending images directly as files.

AppWizard

September 4, 2026

WhatsApp rolls out emergency fix for locked Android photo access bug

WhatsApp is rolling out a fix for a privacy vulnerability affecting Android users that could allow individuals with physical access to a locked device to view the owner's photos during a video call. The issue was identified by security researcher Jose Rodriguez, who demonstrated that an incoming WhatsApp video call could provide access from the lock-screen to the device's photo gallery without unlocking the phone. WhatsApp confirmed the implementation of a fix and noted that the issue is limited to situations where someone has physical access to the device. Rodriguez reported the vulnerability to both Meta and Google, receiving limited responses. Users are advised to update WhatsApp and adjust app permissions to enhance privacy.

AppWizard

September 2, 2026

Fully Playable Scream Game Found in Steam Leak [2026]

A horror game based on the Scream film franchise was discovered in the Steam data leak that occurred from August 29 to 31, 2026. The game, an unfinished multiplayer prototype created by Fatshark, was found by a Twitter user named Roly Poly Reaper, who managed to run it on their computer and enable online multiplayer. The prototype included several unfinished builds, with one featuring operational networking code that allowed players to take on the roles of survivors evading a player-controlled Ghostface. The project appears to have been a pitch build, never fully greenlit for production, and was stored in Valve’s old Steam2 backend for approximately 15 years before the leak. Roly Poly Reaper used the Goldberg Steam emulator and Radmin VPN to run the game, circumventing the need for a live connection to Valve’s servers. Fatshark, known for cooperative shooters, had reportedly built the Scream prototype around 2011, coinciding with the release of Scream 4. The prototype's existence predates the popularization of the asymmetric horror genre by several years. The Steam2 leak itself involved approximately 12 to 13 terabytes of data, including various internal builds and beta versions from Valve and third-party developers. Valve has not publicly commented on the leak.

Winsage

August 12, 2026

Microsoft Windows 0-Day Attack Deploys Lazarus Rootkit—Patch Now

Microsoft released a patch for a zero-day vulnerability, CVE-2026-68820, which is being exploited by cybercriminals, specifically the North Korean hacking group Lazarus. This vulnerability allows unauthorized attackers to elevate their privileges locally, posing a significant risk to affected systems. The August 2026 Patch Tuesday update addressed 421 vulnerabilities, including three zero-days, with CVE-2026-68820 being the only one confirmed to be actively exploited. The vulnerability's impacts on confidentiality, integrity, and availability are rated as High. Users of Microsoft Windows 10, Windows 11, and various versions of Windows Server should prioritize deploying the patch for this vulnerability.

AppWizard

July 7, 2026

Chat Control 1.0: EU Council forces messenger scans via fast-track

Member states of the European Union are seeking to reinstate a previously expired regulation concerning the monitoring of encrypted communications, known as Chat Control 2.0, which mandates suspicionless scanning of encrypted messages. The Council of Ministers has proposed to reactivate a transitional regulation that allowed voluntary monitoring by technology companies, which lapsed on April 3. This move aims to close a legal gap and pressure Members of the European Parliament (MEPs) to act quickly. The expiration of the previous regulation is viewed as untenable, as it is deemed crucial for identifying at-risk children and combating illegal content online. Critics argue that the approach undermines democratic oversight and lacks transparency. The draft regulation is set to be discussed as an urgent matter just before the summer recess, with potential voting occurring when many MEPs may be absent. The regulation requires that any processed content and traffic data be deleted within twelve months unless a specific suspicion is confirmed.

AppWizard

July 6, 2026

Epic settles with Fortnite leaker who shared South Park, Minecraft and Overwatch collabs

Epic Games has settled its legal dispute with former contractor Hayden Cohen, who was accused of leaking sensitive information about upcoming Fortnite skins and events. The settlement prohibits Cohen from possessing, accessing, using, or disclosing any of Epic's confidential or trade secret information. The case highlighted Epic's commitment to protecting its intellectual property and maintaining confidentiality in partnerships. The settlement does not involve financial compensation. Cohen had previously shared leaked information on social media before his account was deactivated.

AppWizard

June 25, 2026

This free Pixel app is the reason I canceled my AI note-taking subscription

Sanuj Bhatia from Android Authority highlights the capabilities of Google’s Pixel Recorder app, which he found effective enough to cancel his subscription to a paid AI note-taking service. The app, upgraded with Gemini Nano technology in the Pixel 9 series, can record audio and generate live transcripts with punctuation and grammar corrections, identifying multiple speakers during meetings. It integrates with a web application for easy access to recordings and transcripts on desktop devices. The app processes data on-device, ensuring privacy, which is advantageous for professionals handling sensitive information. While it has limitations, such as not being able to join meetings virtually and lacking collaborative features, it is considered a reliable and cost-efficient alternative to traditional AI note-taking tools.

Tech Optimizer

June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.

AppWizard

June 6, 2026

I thought text-only Grand Theft Auto roleplay sounded too intimidating—but GTA World is showing me why players are slowing things down

A man announces that someone has overdosed, prompting a visit to an infirmary where a distressed family is present. The importance of respecting their privacy is acknowledged. The text contrasts the spontaneous and dynamic nature of roleplaying in FiveM with the serious atmosphere of text-only servers. Players in FiveM engage in varied scenarios, allowing for casual participation, while text-only environments focus on deliberate storytelling and gradual plot development. The author reflects on their experiences in different gaming settings, noting a shift from chaotic gameplay in GTA Online to a more subdued existence in Los Santos, where they explore everyday roles and aspirations.

Winsage

June 4, 2026

ADCS Now Generates Post-Quantum Certificates For Windows

Active Directory Certificate Services (ADCS) now supports the generation of post-quantum certificates, enhancing quantum-safe cryptography within Windows' secure connection protocols. Microsoft has integrated PQ TLS hybrid key exchange into the Windows Transport Layer Security (TLS) stack, providing protection against "Harvest Now, Decrypt Later" attacks. The PQ TLS hybrid key exchange combines traditional cryptographic methods with the NIST ML-KEM algorithm, offering three hybrid combinations: X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1_MLKEM1024. This feature is available in preview via the Windows Insider Program and will be rolled out to Windows 11 and Windows Server. Additionally, Windows cryptography APIs now support composite ML-KEM and ML-DSA algorithms, which are NIST-approved standards for key exchange and digital signatures, enhancing security by requiring multiple components to be compromised. Microsoft emphasizes the importance of establishing new Certification Authorities (CAs) for implementing post-quantum certificate issuance, as existing CAs cannot be upgraded. The introduction of ML-DSA support within ADCS allows organizations to counter HNDL risks associated with long-lived data. Organizations are encouraged to inventory their use of public-key cryptography, prioritize systems protecting sensitive data, and test hybrid and composite approaches in non-production environments to facilitate a smooth transition to quantum-safe cryptography.