domains Archives

Winsage

October 21, 2026

Windows AI agent security: how isolation works

Microsoft's AI agent security is structured around three execution boundaries: local process isolation, session isolation, and cloud-based Windows 365 for Agents. The introduction of Microsoft Execution Containers (MXC) on June 2, 2026, enhances local isolation through two methods: process isolation, which restricts an agent's access to specific files and networks, and session isolation, which separates an agent from the user's interactive environment. The MXC framework includes policies for filesystem access, network traffic, and user-interface controls, with an audit mode that disables sandbox security for analysis purposes. The choice between local isolation and Windows 365 for Agents depends on the agent's execution environment, with local isolation providing limited access and Windows 365 offering a completely separate cloud environment. MXC is in early preview, while Windows 365 for Agents is generally available.

TrendTechie

October 10, 2026

Болгары пользуются зарубежными торрент-сайтами

Following the closure of Bulgarian torrent sites Zamunda.net, ArenaBG, and Zelka.org, users in Bulgaria have shifted to international torrent platforms. This change was noted by Vladislav Todorov from the General Directorate for Combatting Organized Crime (GDBOC). The shutdown was part of a coordinated international effort involving Europol, GDBOC, the State Agency for National Security (DANS), and U.S. authorities, resulting in the confiscation of domain names after a U.S. court ruling. Four individuals have been arrested in Bulgaria as part of the investigation, but there has been no official communication regarding further steps. After the closures, Bulgaria was removed from the U.S. "301 List" monitoring intellectual property protection issues, while the European Union remains on the list. Todorov warned that downloading from torrent trackers poses cybersecurity risks.

Winsage

October 1, 2026

Windows 10 Users Face a $30 Choice as Microsoft Quietly Extends Security Support to 2027

Microsoft has extended the support cutoff for Windows 10 from October 13, 2026, to October 12, 2027, due to a one-year extension of the consumer security program. Devices enrolled in the Extended Security Updates (ESU) program will continue to receive updates automatically. Unenrolled devices can still enroll until October 12, 2027, to receive critical updates released since their support ended on October 14, 2025. Users in the European Economic Area can access ESU at no extra cost but must maintain a Microsoft account to avoid losing access to updates after 60 days. To qualify for ESU, devices must run Windows 10 version 22H2 in supported editions, have the latest updates, and meet specific criteria. Microsoft 365 Apps and OneDrive on Windows 10 will receive updates beyond ESU, but the operating system itself remains unprotected without ESU. As of August 2026, 25.15 percent of Windows desktops in Germany were still using Windows 10. Users can check their ESU status under Settings, Update & Security, Windows Update.

BetaBeacon

September 29, 2026

Proton finds Russian and Chinese trackers in popular Android games

A study by Proton found tracker code associated with companies in China and Russia in many of the most downloaded free Android games in the US and Europe.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 28, 2026

What Is Happening with PostgreSQL 19?

Postgres 19 is experiencing delays in its release schedule, with Beta 4 scheduled for September 24, 2026. The development team is prioritizing quality over timelines, leading to the reversion of 53 significant features during the beta phase. Notable feature reversions include SQL Property Graph Queries, ALTER TABLE MERGE/SPLIT PARTITION(S), UPDATE/DELETE FOR PORTION OF, GROUP BY ALL, a change to default TOAST compression, nontext output formats for pg_dumpall, JSON_TABLE ON ERROR cascading, fast defaults for domains with nonvolatile constraints, logical replication database-specific snapshots, nested query tracking, and online data checksums. The majority of these reversions are due to design flaws, incorrect results, or compatibility issues. There are also at-risk features identified, including RI fast-path FK checks, REPACK / REPACK CONCURRENTLY, and Postgres_fdw statistics import. Despite these challenges, promising features such as pg_plan_advice, parallel autovacuum, ON CONFLICT DO SELECT, and logical replication enhancements are still anticipated in PG19. AI tools are being utilized in the development process to identify bugs and create test cases. Postgres 18 remains a reliable upgrade target, while features like property graphs and GROUP BY ALL are now planned for PG20.

Tech Optimizer

September 28, 2026

Postgres Women India: Driving Diversity And Innovation In Open Source

Postgres Women India was launched in 2023 as a corporate social responsibility initiative under OpenSource DB, starting with 10 members and growing to over 2000 women across more than 70 countries. The community addresses the underrepresentation of women in open source and database conferences, aiming to empower, connect, and celebrate women in technology. Its core pillars include community building, nurturing future leaders, and advocating for education. The community organizes virtual and in-person meetups, mentorship programs, and collaborates with universities to enhance skills in database technologies. Key initiatives include a Career Connect Day, intensive upskill programs, and the Women for Data Summit. The community has recognized 18 women as ‘Postgres Women of the Month’ and highlighted emerging contributors. Partnerships with organizations like Google and YugaByteDB support its efforts, and it seeks further community involvement to establish local chapters and host events.

AppWizard

September 26, 2026

Five Ad Blocker Hacks Every Android User Should Know

Ads are prevalent on Android devices, leading users to choose between enduring them or paying for premium subscriptions. BlockAds is a free, open-source app that blocks ads on Android by creating a local VPN, filtering traffic without requiring device rooting. Users can also employ DNS filtering to block ads by changing their DNS server settings, with services like AdGuard and NextDNS available for this purpose. Firefox supports the uBlock Origin extension for ad-blocking on Android, while NewPipe allows users to watch YouTube videos ad-free and access premium features. The DuckDuckGo browser includes a built-in YouTube ad blocker, and the Brave browser automatically blocks ads and trackers without additional setup.

AppWizard

September 26, 2026

Google Calendar now shows three time zones at once

Google Calendar now supports the display of three time zones simultaneously on the web, allowing users to view them side by side in Day, Week, and Custom multi-day views. This feature began rolling out on September 25 and is available for Google Workspace, Workspace Individual, and personal Google accounts. The update includes enhancements to the Find a Time scheduling screen, where users can assign custom labels to each time zone. Rapid Release users will see the update within 15 days, while Scheduled Release domains will start on October 12. No admin switch is required to activate this feature.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.