deployment Archives

Winsage

September 28, 2026

Windows 11 preview update causes black screen after sign-in; Microsoft publishes workaround

On September 24, Microsoft reported an issue affecting devices that installed the August 27 preview update for Windows 11, causing a black screen after sign-in and preventing the desktop from loading correctly. This issue primarily impacts Azure Virtual Desktop (AVD) hosts using FSLogix with existing user profiles. The affected OS versions are Windows 11 versions 26H1, 25H2, and 24H2, and the causal update is KB5120998. Microsoft has issued interim workarounds, including a manual desktop launch and a Known Issue Rollback (KIR), which will be automatically delivered to non-enterprise devices. Affected enterprise-managed devices require manual deployment of the KIR policy. The black screen issue is part of a series of update-related problems for Windows 11 in 2026, while Windows 10 has experienced fewer issues during the same timeframe.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 28, 2026

What Is Happening with PostgreSQL 19?

Postgres 19 is experiencing delays in its release schedule, with Beta 4 scheduled for September 24, 2026. The development team is prioritizing quality over timelines, leading to the reversion of 53 significant features during the beta phase. Notable feature reversions include SQL Property Graph Queries, ALTER TABLE MERGE/SPLIT PARTITION(S), UPDATE/DELETE FOR PORTION OF, GROUP BY ALL, a change to default TOAST compression, nontext output formats for pg_dumpall, JSON_TABLE ON ERROR cascading, fast defaults for domains with nonvolatile constraints, logical replication database-specific snapshots, nested query tracking, and online data checksums. The majority of these reversions are due to design flaws, incorrect results, or compatibility issues. There are also at-risk features identified, including RI fast-path FK checks, REPACK / REPACK CONCURRENTLY, and Postgres_fdw statistics import. Despite these challenges, promising features such as pg_plan_advice, parallel autovacuum, ON CONFLICT DO SELECT, and logical replication enhancements are still anticipated in PG19. AI tools are being utilized in the development process to identify bugs and create test cases. Postgres 18 remains a reliable upgrade target, while features like property graphs and GROUP BY ALL are now planned for PG20.

Winsage

September 28, 2026

Windows 11 26H2 releases any day now, and here’s who gets it and when

Windows 11 26H2 is expected to begin public rollout around the week of September 28 or early October. Microsoft has released evaluation ISOs for enterprise users to assess compatibility before broader deployment. The release of these ISOs indicates that the public rollout is imminent. Windows 11 26H2 is built on the same platform as versions 24H2 and 25H2, which allows for a smoother upgrade experience. Support for Windows 11 25H2 ends on October 12, 2027, and for 24H2 even sooner, prompting the introduction of 26H2 to provide users with a new support window. Windows 11 26H2 will be available as an optional feature update and will take about five minutes to install for users with up-to-date systems running 24H2 or 25H2. Eligibility for the update includes any PC currently running Windows 11 24H2 or 25H2. The rollout is expected to occur on a Tuesday, with potential dates of September 29 or October 6. Not all eligible PCs will receive the update simultaneously, and users can manually check for updates or download ISOs as needed.

AppWizard

September 27, 2026

AnyPS5 Reaches PS5 Game Menu on PC, No Emulator [2026]

A developer named boykopovar has created an open-source tool called AnyPS5 on GitHub, which aims to convert PlayStation 5 games to run natively on Windows and Linux systems. AnyPS5 can load a PS5 game's logo and reach its main menu on PC hardware but crashes before the menu becomes interactive. The tool uses a method called relinking, which reformats PS5 executables into native Windows or Linux files and provides replacement libraries to mimic PS5 system libraries. There is currently no public build available, and the developer has stated that a public release will only occur after a successful game launch. Sony has not made any public statements or taken legal action regarding AnyPS5. The project operates under the GPL-2.0 license, but the legal implications of using it with actual PS5 games remain unclear. Historical trends suggest that console emulation projects typically take years to mature, but AnyPS5's shared architecture with PCs may offer a potential shortcut.

AppWizard

September 27, 2026

Android Auto 17.8 Now Available for Download for All Users

Google has begun rolling out Android Auto 17.8 for production devices, which will be available gradually through the Google Play Store. Users may receive updates in waves, and some may find their version already current. A stand-alone APK installer is also available for those seeking immediate access. The update introduces a new full-screen GameSnacks experience and restores signal bars for some users. Additionally, Google Maps has added new pop-ups for stop signs and traffic lights to enhance navigation. The full build number for this update is 17.8.6638.

Tech Optimizer

September 25, 2026

This Mac malware is somehow using iCloud calendar invites to try and steal your data

Cybercriminals have developed an infostealer called MacSync, targeting Mac devices by using iCloud calendar events and cloud storage. This malware disguises itself as fake cryptocurrency wallets and pirated software. It begins with a loader that retrieves instructions from calendar entries and deploys malware to exfiltrate sensitive information, including credentials and cryptocurrency wallets. Recent versions have introduced an Objective-C backdoor that mimics Finder. Victims are often tricked into downloading these malicious applications, and effective antivirus solutions can prevent damage. Cybercriminals use tactics like SEO poisoning and phishing to direct victims to fraudulent websites or social media promoting pirated software. In one case, the loader was marketed as a cryptocurrency wallet, and victims encountered a misleading ClickFix error message that prompted them to execute a command in the Terminal.

Winsage

September 25, 2026

Microsoft plans to deprecate Windows Deployment Services

Microsoft has announced that Windows Deployment Services (WDS) will be deprecated in the upcoming Windows Server release, marking a significant change for IT administrators who have used WDS for remote Windows installations. Active development of WDS will cease after the next Windows Server version, and the service will eventually be retired. This follows previous deprecations, including the removal of boot.wim support in 2021 and the disabling of hands-free deployment in January 2026 for certain updates. WDS will continue to operate on currently supported Windows Server versions, but standard desktop operating systems are no longer supported through its native setup engine since Windows 11. The deprecation includes the entire WDS ecosystem, but Microsoft Configuration Manager's deployment capabilities will remain unaffected. Users are encouraged to plan their migration away from WDS dependencies.

Winsage

September 24, 2026

Microsoft: September Windows updates break Always On VPN connections

Microsoft has informed IT administrators about potential connection challenges with the Always On VPN after the September 2026 Windows 11 security updates. Users may face difficulties connecting to their organization's network, particularly if the VPN is set to automatically attempt an alternative connection method upon failure. Symptoms include connections remaining in a 'Connecting' state or displaying the error message: 'The specified port is already in use.' Affected versions include Windows 11, version 26H1 (KB5124012), version 25H2 (KB5124008), and version 24H2 (KB5124008). A temporary workaround involves adjusting the Always On VPN profile from automatic protocol selection to a single protocol (SSTP or IKEv2). Microsoft is also addressing various other issues related to Hyper-V, Remote Desktop Services, USB audio, and the File History backup feature.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.