driver Archives

AppWizard

June 25, 2026

Riot Vanguard finally drops its controversial always-on requirement for anti-cheat — new on-demand mode requires a strict Windows 11 security stack

Riot Games has introduced a new feature for its Vanguard anti-cheat system called Vanguard On-Demand, which allows the kernel driver to load only when a Riot game is launched and unload upon exit. This change ends the previous practice of loading the driver at Windows start-up, which has been in place since 2020. The new mode is supported by Windows 11 25H2 and requires specific hardware configurations, including UEFI Secure Boot, TPM 2.0, Virtualization-Based Security (VBS), Hypervisor-Protected Code Integrity (HVCI), and IOMMU. Approximately 35% of players currently meet these hardware requirements, while around 3% are using incompatible systems. Riot has created a checklist called Vanguard Pre-Check to help players determine if their systems qualify. The percentage of fully secured machines is estimated to be around 34.33% and is increasing monthly. Players whose systems do not meet the criteria will need to make manual adjustments in their BIOS. Vanguard On-Demand mode will be available for players on Windows 11 starting later today. The feature is based on Microsoft’s Runtime Driver Attestation Report, which tracks driver activity since boot and helps ensure no vulnerable drivers have been loaded while Vanguard is inactive. Riot Games has required TPM 2.0 and Secure Boot on Windows 11 since 2020 and has faced criticism for these requirements. Enabling VBS and HVCI may affect frame rates and could disable older peripheral drivers due to Microsoft's vulnerable driver blocklist.

AppWizard

June 25, 2026

GM is adding 200 new apps to its cars with Google built-in

General Motors is enhancing the digital experience in its vehicles by introducing support for over 200 new applications on its "Cars with Google built-in" platform, moving away from Android Auto and Apple CarPlay. The new apps will be available on select 2024 and newer models of Cadillac, Buick, Chevrolet, and GMC vehicles equipped with Google built-in. Driver-focused apps will be accessible only when the vehicle is parked, while passengers can enjoy games and streaming services during travel. The new offerings include games like basketball, chess, and solitaire for drivers, and streaming services such as Disney Plus, Hulu, Tubi, and YouTube for passengers. Music and podcast platforms like Spotify, SiriusXM, iHeartRadio, and Amazon Music will also be supported. The passenger and rear displays will support these apps in select 2025 and newer GM models, including the Chevy Tahoe, Suburban, Cadillac Escalade, and GMC Yukon. Users can find these applications under a “car compatible apps” section in Google Play. GM vehicle owners are encouraged to monitor their infotainment systems for the new apps.

AppWizard

June 25, 2026

You can finally turn Riot’s Vanguard anti-cheat off when you’re not playing a game

Riot Games is updating its Vanguard anti-cheat system to an "on-demand" model, which will only activate during gameplay and stop once the game ends. This change addresses concerns over Vanguard's previous persistent background operation and kernel mode access. Players must meet specific security criteria to use the new feature, including enabling pre-boot security mechanisms and Windows' native protection features. Approximately 35% of players already meet these conditions, while 3% using older hardware will not have access to the on-demand option until they upgrade. Vanguard will continue its current operation for those unable to meet the requirements. The update is influenced by advancements in Windows and PC hardware security and aims to enhance anti-cheat measures while keeping the process optional for most players.

Winsage

June 24, 2026

AMD releases hotfix for driver install issues on Windows 10 PCs

AMD released a graphics driver update, version 26.6.2, which added support for AMD FSR 4.1 to the Radeon RX 7000 series. Users reported installation issues on Windows 10, prompting AMD to release a hotfix, version 26.6.3, to address these problems. The hotfix is available for download and is compatible with all supported graphics cards on 64-bit Windows 10 and 11. AMD plans to release a WHQL driver update with necessary fixes the following week.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Winsage

June 23, 2026

AMD Tells Windows 10 Owners To Roll Back Their Drivers As Adrenalin 26.6.2 Triggers A Yellow Bang Error

Many users of Windows 10 are experiencing issues with the AMD Adrenalin Edition 26.6.2 graphics driver, which fails to launch properly and shows a yellow exclamation mark in Device Manager. AMD has acknowledged the problem, attributing it to an incompatibility with Windows 10, and has advised users to revert to the previous driver version, Adrenalin Edition 26.6.1. This earlier version does not support FSR 4.1 for RX 7000 series GPUs. There have also been rare reports of similar errors on RX 9000 series systems. AMD's engineers are investigating the issue and working on a solution.

AppWizard

June 22, 2026

The Steam Machine is the most ambitious game console I’ve ever played

The Steam Machine retails starting at ,049 without a gamepad and ,128 bundled with one. Its performance does not significantly exceed that of the 5.5-year-old PS5, which offers sharper visuals in certain games. The Steam Machine operates more like a console than previous iterations, featuring a compact design and compatibility with modern gamepads. Valve claims to sell its components at cost, having negotiated with suppliers during a memory supply crisis. Users have reported technical issues, such as problems with the Steam Controller, sound output, and game downloads. The device requires manual adjustments for settings, lacks user-friendly configurations, and has questionable reliability with its sleep function. Valve plans to support AMD’s FSR 4 upscaling and is working on graphics driver updates. The Steam Machine is positioned as a versatile gaming and computing solution, but its limitations highlight the need for further refinement.

Winsage

June 21, 2026

New DirectX Dump Files tool will make debugging crashes easier GPU + Windows

Microsoft has launched a public preview of DirectX Dump Files, designed to improve the debugging process for GPU crashes on Windows. The .dxdmp files are created when a hardware error is detected and contain hardware snapshots, driver data, Direct3D runtime context, and application user data. Developers need to meet specific requirements, including using Windows 24H2 or 25H2 with update KB5089573 or later, Windows 26H1 with update KB5089570 or later, Agility SDK Update Package 1.721.1-preview, and enabling developer mode. Additionally, AMD Software AgilitySDK Developer Preview Edition 26.10.07.02 is required for AMD graphics cards, along with compatible benchmark drivers from Intel, NVIDIA, and Qualcomm, and PIX version 2606.18-preview for analyzing dump files. The tool is currently focused on gathering developer feedback and is not intended for retail game integration. Developers can choose between three operational modes: NOOVERHEAD, MEDIUMOVERHEAD, and HIGH_OVERHEAD. The full launch is expected in fall 2026.

Winsage

June 19, 2026

Microsoft Announces New Insider Builds, a Bit of 26H2 News

Microsoft has released five new Windows Insider Preview builds and updates for Windows 11 version 26H2. Devices in the Experimental channel will soon update to version 26H2, which can be checked in Settings > System > About or using the winver command. Users in the Beta channel can switch to Experimental via Settings > Windows Update > Windows Insider Program, and can revert back to Beta without reinstalling Windows. PCs on Experimental for versions 24H2 or 25H2 will be upgraded to 26H2, with both versions currently supported. Snapdragon X2-based PCs running Windows 11 on Arm will remain on version 26H1 and will not receive an update to 26H2, but may have a future release potentially called Windows 12. The latest builds are: - Beta (25H2): Build 26220.8690, enhancing reliability of Start, Taskbar, Settings, and virtualization. - Experimental (24H2/25H2?): Build 26300.8697, updating to 26H2 with improvements to File Explorer Copy dialog in Dark mode and reliability enhancements. - Beta (26H1): Build 28020.2308, with minor bug fixes and improved HD Audio driver reliability. - Experimental (26H1): Build 28120.2315, offering similar improvements as the Beta update. - Experimental (Future Platforms, Including Canary 29600 series): Build 29613.1000, enhancing Settings > System > Sounds based on user feedback.

Winsage

June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.