engineer Archives

Winsage

July 23, 2026

Windows 10 has almost three times as many active vulnerabilities as Windows 11, according to researchers

Windows 11 is installed on 78.8% of Windows computers, while 16.9% of users remain on Windows 10. Microsoft ended support for Windows 10 in October 2025, with an extension until 2027. Windows 10 has 1,903 active Common Vulnerabilities and Exposures (CVEs), 2.9 times more than Windows 11, which has 652 CVEs. Of the active CVEs on Windows 10, 66.6% are classified as high or critical risk, with 2.4% actively exploited. Small businesses show the most significant lag in upgrading, with 21.4% still using Windows 10, while two-thirds of large enterprises have moved to Windows 11. The cost of upgrading is a primary barrier for smaller companies.

Tech Optimizer

July 21, 2026

I Built My Second ETL Pipeline. This Time, I Started Thinking Like a Data Engineer

The author transitioned from a data analyst role to a data engineer, creating a 12-month self-study roadmap focused on learning by building projects. The first project was a GitHub ETL pipeline, which evolved from a simple Python script to a more complex system using SQLite and GitHub Actions for automation. The author realized that the challenges of data engineering lay in system design and orchestration rather than just writing ETL logic. For the second project, the author built an automated RSS ingestion pipeline to explore engineering decisions in creating a reliable data pipeline. The project emphasized the importance of separating application responsibilities from orchestration tasks, leading to the use of Docker for consistent execution environments and Kestra for orchestration. The author validated each component of the project incrementally: first the Python ETL, then PostgreSQL, followed by Docker, and finally Kestra. This approach ensured that each layer functioned correctly before adding complexity. The final architecture included distinct responsibilities for each component: Python for data processing, PostgreSQL for data storage, Docker for execution, and Kestra for orchestration. The author learned that effective engineering involves considering system reliability, error handling, and observability, shifting the focus from merely writing code to designing entire systems. The experience transformed the author's mindset, emphasizing the importance of incremental building and the separation of execution and orchestration responsibilities.

Winsage

July 18, 2026

I tried this Linux distro that looks like Windows, is made by a Microsoft engineer, and is based on Ubuntu

AnduinOS is a new Linux distribution created by a Microsoft engineer, based on Ubuntu, designed to provide a user experience similar to Windows 11. It offers both Long-Term Support (LTS) and short-term releases, with the latter featuring enhancements over its predecessor. Unlike Ubuntu, which uses Snap packages, AnduinOS utilizes Flatpak for software management, allowing access to a wider range of applications. The desktop environment closely resembles Windows 11, featuring a taskbar, Start menu, and other familiar elements, enhanced by GNOME extensions. Users can customize the taskbar and Start menu extensively, surpassing the customization options available in Windows. The integration of GNOME extensions, such as Clipboard History and Tiling Shell, further enhances productivity and user experience.

Winsage

July 17, 2026

The team behind Windows NT sent ‘black cardboard coffins’ and fake dog poop to their rivals back in the 90s, because nerds

Dave Plummer and Dave Cutler discussed a humorous incident from the late 1990s involving the rivalry between Microsoft and Sun Microsystems. Cutler recounted how they sent black cardboard coffins to Scott McNealy and Lee Reiswig as a playful gesture, accompanied by a birthday card that played the "Death March." They also included fake dog feces in the box as a response to Sun's advertising antics, where McNealy's dog urinated on a fire hydrant with the Microsoft logo. Cutler mentioned a third coffin intended for another tech figure, possibly Larry Ellison, which was never sent.

Winsage

July 16, 2026

Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]

CVE-2026-41089 is a critical vulnerability in the Windows Netlogon service, rated 9.8 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on domain controllers. It affects all supported versions of Windows Server configured as domain controllers, from Windows Server 2012 R2 to the latest release. Microsoft addressed this vulnerability on May 12, 2026, during a broader update that included 138 fixes, but it went largely unnoticed until early June when active exploitation was confirmed. The vulnerability is characterized as a stack-based buffer overflow and is considered "wormable" due to its ability to self-propagate across systems without user intervention. Organizations are advised to patch all domain controllers and audit network access to mitigate exposure.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

AppWizard

July 15, 2026

Ramp’s billionaire CEO ignores résumés and Ivy League degrees—he’s more interested in engineers who built Minecraft servers as teens

Eric Glyman, cofounder and CEO of Ramp, advocates for a hiring philosophy that prioritizes "proof of work" and exceptional drive over traditional qualifications and résumés. He believes valuable hires often come from unexpected backgrounds, citing Ramp engineers who demonstrated dedication through their involvement in Minecraft. Ramp actively seeks talent on platforms like GitHub and through referrals from individuals who know candidates well. Glyman emphasizes the economic advantages of hiring younger talent before they accumulate extensive experience, which can inflate their market value. He also focuses on candidates' long-term motivations and alignment with the company's mission. Glyman's approach aligns with other influential CEOs, such as Elon Musk, who also prioritize tangible evidence of a candidate's abilities over résumés.

Winsage

July 13, 2026

A Microsoft engineer revealed Windows 95’s smart way for spotting installers: It just guessed

Developers of Windows 95 faced the challenge of preventing software installers from overwriting existing files with older versions. They implemented a heuristic approach that identified running setup programs by scanning the program's name for specific "magic words." These included "setup," "inst," "imposta," "ayarla," and "felrak." The word "install" was considered redundant since variations like "inst" could also be detected. If a program's name did not contain these magic words, Windows 95 would check the executable path for matches and perform post-installation verification to ensure newer files were not replaced by older versions.

Winsage

July 12, 2026

Windows 95 didn’t detect installers, it ‘guessed’ based on the file name, says veteran dev — it simply checked for words like setup, install, inst, or localized equivalents

Raymond Chen, a Microsoft engineer, revealed that Windows 95 identified installation programs by analyzing executable filenames against a list of keywords, including "setup," "install," and "inst." The system would then initiate a routine to repair any compromised system files. The list included six terms: setup, install, inst, imposta, ayarla, and felrak. Chen noted redundancy in the list, suggesting "install" was unnecessary since it included "inst." For executables not matching the terms, Windows 95 scanned the executable's path for "Setup." The system maintained backup copies of frequently overwritten files in a hidden directory at C:WindowsSYSBCKUP and would restore correct versions after installers completed. File verification was often postponed until the next system boot, especially for installers that reverted to MS-DOS for file replacements. This file repair mechanism continues to influence modern operating systems, including Windows 11.

Winsage

July 11, 2026

AI Threat Forces Microsoft To Update Windows Patch Guidance

Microsoft is advocating for a reevaluation of Windows patch management practices due to the rapid evolution of artificial intelligence (AI) impacting cybersecurity. The company emphasizes that traditional timelines for patch deployment, typically spanning several weeks after the monthly Patch Tuesday, are inadequate against modern cyber threats. Microsoft recommends organizations shorten deployment windows to under three days for quality updates, with immediate installation deadlines and minimal user grace periods. To support these changes, Microsoft is enhancing Windows Autopatch with a new reporting dashboard for patch compliance and security insights. The company is promoting cloud-managed deployment through Microsoft Intune and Windows Autopatch while continuing to support legacy tools. Additionally, Microsoft is introducing Windows Hotpatch technology, allowing security updates to be installed without immediate reboots, and advocating for the use of identity-based access controls to isolate unpatched devices. The guidance reflects a shift from scheduled patching to continuous risk management, encouraging organizations to prioritize high-risk assets and automate update deployments. Microsoft is also investing in AI-assisted vulnerability discovery and automated code analysis to improve defensive capabilities. The overarching message is that enterprises must adapt their update strategies to address the accelerated pace of AI-driven exploitation.