disable Archives

Winsage

September 24, 2026

Microsoft Ships September Preview Updates for Windows 11

Microsoft has released preview updates for Windows 11 versions 24H2, 25H2, and 26H1 as part of its Week D schedule. Users of versions 24H2 and 25H2 can install the preview cumulative update KB5124010, updating their systems to builds 26100.9550 and 26200.9550, respectively. Enhancements include refinements to File Explorer, support for Emoji 17.0, a new Tips widget, improved desktop backgrounds, enhanced Bluetooth functionality, upgrades to the Settings app, additional touchpad gesture controls, new key remapping options in Copilot, and Wi-Fi support in the Windows Recovery Environment. The final monthly update for Windows 11 version 24H2 will be shipped next month, with the version set to reach the end of its support lifecycle on October 13, 2026. Users of version 26H1 can install the preview cumulative update KB5124006 to upgrade to build 28000.3086. This update includes a resizable Taskbar, customizable Start menu, revamped Windows Search, improvements to File Explorer, enhanced progress indicators, and better app update support.

AppWizard

September 24, 2026

6 ways Android Enterprise is evolving for the modern workforce

In modern workplaces, the balance between innovation and security is crucial as employees seek access to advanced technology while IT departments protect sensitive data. Android is enhancing its tools for workers through Android Enterprise, with key advancements expected by 2026, including: 1. Advanced AI agents and controls: - Smarter workflows will introduce next-generation AI agents with enterprise-grade controls. - The evolution of Gemini will enable management of complex workflows using real-time context, eliminating manual app switching. - Built-in safeguards will ensure work profile isolation, preventing personal agents from accessing corporate data. - Administrators will have granular control to configure or disable AI automation through Android Enterprise. 2. Next-gen manageable XR devices: - New hardware like the XREAL Aura wired glasses will enhance workforce capabilities. - IT administrators will manage a range of XR devices alongside standard mobile fleets using Enterprise Mobility Management consoles. - Employees will benefit from hands-free productivity with integrated displays, audio, and AI assistance while connected to enterprise tools.

Tech Optimizer

September 23, 2026

BigDiskBuster PoC Blocks Windows Defender Updates

A new tool named BigDiskBuster has been released on GitHub, which disrupts Microsoft Defender Antivirus by preventing it from installing updates. It does this by consuming available disk space during the update process, causing Defender to remain on its current version and unable to receive new platform or signature updates. BigDiskBuster operates as a local denial-of-service technique and requires prior access to the target machine to execute. The tool was created by researcher Abdelhamid Naceri, known as Nightmare Eclipse, who has previously worked on similar projects. As of now, there is no CVE identifier, patch, or advisory from Microsoft regarding this issue.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 22, 2026

Windows has been so buggy I paused monthly updates, and now I wait for reports before installing anything

Users frequently express frustration with Windows updates due to unexpected restarts and frequent breakdowns, leading to a perception of being beta testers for Microsoft. Problems often arise with updates, including significant disruptions from routine maintenance updates. Recent issues included difficulties with the Windows Subsystem for Linux and copy-paste functionality in Microsoft Excel. In July, Microsoft paused an update due to unexpected shutdowns on some Dell PCs. Users are increasingly adopting a wait-and-see approach before installing updates, utilizing Windows 11's ability to pause updates for several weeks. Historically, Windows lacked robust update management, but recent changes have extended the pause period. There is a significant concern regarding the limited control users have over updates and the need for improved quality control from Microsoft.

Tech Optimizer

September 21, 2026

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

On September 17, researchers from LastPass and Delphos Labs discovered a counterfeit LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver designed to disable antivirus and steal passwords. The driver, named Alinubx.sys, was signed through Microsoft's hardware compatibility program and initially scored zero detections on VirusTotal. The fake installer is hosted on a fraudulent GitHub page that mimics a legitimate LastPass product page. When executed, the installer uses DLL side-loading to gain SYSTEM-level access and terminates security processes, allowing it to harvest saved passwords from various browsers and applications. The driver is a renamed variant of a known malicious driver, evading detection due to its new file hash. Delphos reported the driver to Microsoft, but it was not considered a security vulnerability. Users who executed the fake installer should treat their passwords and sensitive data as compromised and change them from a secure device. The malicious server has been linked to impersonation pages for multiple brands, and the loader was likely created using a specific crypter tool.

Winsage

September 21, 2026

7 Windows features I disabled after realizing nobody needs to use them

Windows 11 allows users to optimize their experience by disabling or uninstalling various features. 1. OneDrive: Users can unlink or uninstall OneDrive through File Explorer or the Settings app. 2. Copilot: Copilot can be uninstalled via the Settings app, and its keyboard shortcut can be customized. 3. Widgets: The Widgets board can be disabled or removed through the Settings app under Personalization. 4. Start Menu: Users can streamline the Start Menu by turning off pinned apps, recent items, and account notifications in the Settings app. 5. Phone Link: This feature can be minimized or uninstalled using the Settings app or Windows PowerShell. 6. Xbox Features: Xbox and Xbox Live can be uninstalled through the Settings app, and Game Mode can be toggled off. The Xbox Game Bar can be removed via PowerShell. 7. Search Results: To improve search efficiency, users can disable Bing and web results using Windows PowerShell.

Winsage

September 20, 2026

The hidden Windows feature quietly filling up your SSD—and how to rein it in

Microsoft introduced a feature called point-in-time restore in Windows 11, which creates snapshots of the system every 24 hours to enhance recovery options. This feature began rolling out in late June 2026 and is typically enabled by default for boot drives of 200GB or larger. It uses the Volume Shadow Copy Service to generate restore points that are available for 72 hours before being purged. The feature can consume significant storage space, initially occupying 3.9GB and potentially increasing to over 18GB within two months, reaching a maximum of 2% of the total disk space. Users can adjust the storage usage settings or disable the feature entirely to reclaim space. The default maximum usage can be modified to as low as 0.2%. There are concerns that this feature should have been opt-in rather than opt-out due to its storage implications.

Tech Optimizer

September 19, 2026

Windows 11’s Defender kept falsely saying your antivirus was off, and Microsoft just fixed it

For nearly two months, Windows 11 users received persistent notifications from the Windows Security app falsely indicating that Microsoft Defender was disabled, despite it functioning properly. This issue, which began in early August, has been addressed with a security update from Microsoft. The false alerts affected all versions of Windows 11, Windows Server, and Windows 10, and were linked to a bug introduced with a recent Defender security update. Microsoft confirmed that no manual action is required from users to resolve the issue, as the fix will be automatically deployed to all PCs with mandatory security updates enabled. The problem was resolved in the Microsoft Defender Antivirus update (version 4.18.26080.4), released on September 17, 2026. Users can verify the status of Defender by checking Windows Security or using a PowerShell command.