disable Archives

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

AppWizard

July 9, 2026

This open-source app fixed my notification chaos when Android couldn’t

Megan Ellis shared her experience using the app DoNotNotify, which helped her manage and reduce the number of notifications on her smartphone. She found that many apps, including Pokémon Go and Temu, sent numerous vague notifications that were difficult to filter effectively. Despite Android's notification channels, she often had to disable notifications entirely for certain apps. DoNotNotify allowed her to customize her notification preferences without requiring personal data or account creation. The app features tabs for History, Rules, and Blocked notifications, enabling users to track and manage alerts. Ellis successfully used DoNotNotify to block unwanted notifications, particularly from games and shopping apps, and appreciated its privacy-focused design and adaptability to changes in notification content. She recommends the app for users overwhelmed by notifications.

Tech Optimizer

July 9, 2026

LG Monitors Allegedly Install Software Without User Consent

Certain LG monitors are reportedly installing software on Windows PCs without user consent, including unsolicited advertisements for McAfee antivirus. This was discovered by a Reddit user who found the "LG Monitor App Installer" in their Windows event log. The application may install itself automatically via the Microsoft Store or Windows Update and is difficult to remove. Users can disable the app's automatic startup or uninstall it, but it may reinstall in the future. Windows Pro users can use the Group Policy Editor to prevent automatic installations of manufacturer-specific applications. The incident raises concerns about user control and transparency regarding unsolicited software installations.

Winsage

July 9, 2026

Windows hides a secret identifier that Microsoft hands over to the FBI

19-year-old Peter Stokes, a member of the Scattered Spider group, was arrested by the FBI due to a unique number embedded in his Windows operating system known as the Global Device Identifier (GDID). This identifier, assigned during Windows installation, remains unchanged and can leak user information despite the use of VPNs. The FBI identified Stokes by obtaining a history of IP addresses linked to his GDID from Microsoft, which allowed them to trace his online activities across various platforms. Microsoft tracks over a billion devices with this permanent identifier, which cannot be disabled.

Winsage

July 9, 2026

GDID Windows – Cut the tracker that follows you even through a VPN

In April 2026, the FBI apprehended an individual associated with the Scattered Spider group, who had concealed his online activities using a VPN. His efforts were thwarted by the GDID, a 64-bit Persistent Unique Identifier assigned by Microsoft upon logging into Windows. The GDID is stored in plain text in the registry and is linked to Microsoft’s servers, remaining unaffected by changes to IP addresses or attempts to delete it. Disabling Windows telemetry does not prevent the GDID from being accessed, as it operates through other services. To mitigate its transmission, users can disable certain services and modify the hosts file, although the GDID itself remains stored on Microsoft’s servers. Scripts are available on GitHub to audit and implement changes regarding the GDID. Transitioning to a local account does not guarantee anonymity, and for sensitive activities, using a live Linux system is recommended for better data control.

Winsage

July 8, 2026

Microsoft flips Windows Backup to on by default unless you’re in the EU

Microsoft has enabled Windows Backup for Organizations by default in the 26H2 version of Windows 11, except in the European Union. This feature allows organizations to restore device settings and installed Microsoft Store applications easily during events like lost laptops or system resets. Devices running Windows 11 25H2 and earlier, as well as those with a backup policy that disables this setting, will not be included in the automatic backup initiative. Organizations can opt out of this feature if they have stringent privacy policies or data sovereignty concerns. Administrators must explicitly disable the policy if they do not wish to use the feature. Microsoft clarifies that this service is not a comprehensive backup solution but part of a broader Windows resiliency effort. Eligible devices with the backup policy in a Not Configured state will enable backup automatically when Windows 11, version 26H2 becomes generally available.

Winsage

July 7, 2026

Microsoft to enable Windows settings backup by default for orgs

Microsoft will enable the Windows settings backup and restore tool by default for enterprise systems joined to Microsoft Entra or operating in a hybrid environment with the upgrade to Windows 11 version 26H2. This tool, previously known as Windows Backup for Organizations, assists users in backing up and restoring Windows settings after events like device resets or upgrades. The tool debuted at the Microsoft Ignite conference in November 2024, became publicly available in August 2025, and requires the September 2025 Windows Monthly Cumulative Update for access. The default-on setting applies only to eligible devices where administrators have not set the policy otherwise, and IT administrators can manage this through mobile device management solutions. Restore functionality will not be enabled by default and requires administrative configuration. The default-on behavior will also be available in the Windows Insider Program Experimental channel starting July 2026.

Tech Optimizer

July 7, 2026

7 Habits That Are More Important Than Using Antivirus on Your Phone

Antivirus software was once standard on personal computers, but modern smartphones have evolved with enhanced security measures from Apple and Google, making them less vulnerable to traditional malware. Smartphones isolate applications, allowing them only to access user-permitted information, and if a malicious app infiltrates, it faces significant challenges due to built-in defenses. Apple requires thorough vetting of apps through the App Store, which enhances security but limits antivirus capabilities. Android allows sideloading apps from outside the Google Play Store, which introduces risks but also includes built-in security features like Google Play Protect and regular updates. Despite these advancements, smartphones can still be compromised, and cybercriminals increasingly target user accounts through phishing tactics rather than malware. Security experts recommend focusing on phishing awareness, strong passwords, and two-factor authentication. For enhanced security, users should keep devices updated, download apps from official sources, review app permissions, use strong passwords, utilize a password manager, enable two-factor authentication, and be cautious with unexpected communications. While most users may not need antivirus apps, those who frequently sideload or download from unfamiliar sites may benefit from additional security tools.

AppWizard

July 7, 2026

Why There’s A Briefcase Symbol On Your Android Phone’s Screen (And How To Turn It Off)

Android has introduced a feature called Work Profile that creates a dedicated workspace on devices, separating professional applications from personal ones. This allows users to maintain distinct versions of applications, such as having separate Gmail accounts for work and personal use. The data within the Work Profile is encrypted and accessible only to an organization's IT administrators, ensuring privacy for personal applications and data. Users can identify work apps by a briefcase icon in the status bar, which disappears when the app is closed. To temporarily pause the Work Profile, users can access the Quick Settings panel or navigate to the app drawer and select the Work tab. When paused, work apps will vanish from the app drawer, and notifications will cease. Users can reactivate the Work Profile through the same methods. Additionally, Android's Digital Wellbeing settings allow users to schedule the activation and deactivation of the Work Profile. To permanently disable the Work Profile, users must delete it from the device, which removes all associated work apps and data. This can only be done if the device was originally owned by the user or if ownership has been transferred. The steps include accessing the Settings app, selecting Passwords and accounts, navigating to the Work tab, and tapping on Remove work profile. A factory reset can also delete the Work Profile but will erase personal apps and data as well.

Tech Optimizer

July 7, 2026

PDO PostgreSQL Bug Triggers NULL Pointer Dereference and Crashes PHP Worker Processes

Researchers at Positive Technologies have identified two significant vulnerabilities in the PHP Data Objects (PDO) extension layer, both posing high severity risks. The first vulnerability (CVE-2025-14180) leads to a NULL pointer dereference, causing PHP worker processes to crash. It affects PHP versions 8.1.x prior to 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1. This issue occurs when the pdo_pgsql driver operates with PDO::ATTR_EMULATE_PREPARES enabled, allowing a remote attacker to exploit it without authentication by submitting malformed character sequences. The second vulnerability (CVE-2025-14179) allows for SQL injection and affects PHP versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6. It arises from a mishandling of NUL bytes in the Firebird driver during the PDO::prepare() process, despite the quoting routine functioning correctly. Additionally, the audit revealed an integer overflow in PostgreSQL’s libpq client library and an information disclosure flaw in Firebird 3’s fbclient.