NewApp Digest
search bot

enterprise networks

Windows 11 25H2 quietly brings behind-the-scenes upgrades across Wi-Fi and audio via new drivers
Winsage
January 18, 2026

Windows 11 25H2 quietly brings behind-the-scenes upgrades across Wi-Fi and audio via new drivers

The upcoming Windows 11 25H2 version introduces enhancements focused on drivers for Wi-Fi, audio, storage, and other hardware components. Only Original Equipment Manufacturers (OEMs) can implement these updates, and not all PCs will support them initially. Key improvements include enhanced Wi-Fi performance for users with Wi-Fi 7 adapters, which will improve compatibility and reduce connection failures in enterprise environments. Microsoft is also addressing "audio not found" errors, particularly for users of SoundWire and SDCA, with updated drivers that enhance multichannel audio support. All SDCA drivers are now integrated into Windows 11, reducing the chances of audio hardware failures. The update primarily targets enterprise users, with no specific consumer features. Windows 11 25H2 has begun its wide-scale rollout.
Microsoft Phases Out RC4 Encryption by 2026 to Bolster Windows Security
Winsage
December 19, 2025

Microsoft Phases Out RC4 Encryption by 2026 to Bolster Windows Security

Microsoft has announced the phased discontinuation of the RC4 encryption cipher, with full implementation expected by mid-2026. RC4, created in 1987, has been increasingly recognized as a vulnerability, exploited in various high-profile cyberattacks. Microsoft plans to disable RC4 by default in Windows Kerberos authentication, encouraging organizations to transition to more secure alternatives like AES-256. This decision follows years of warnings from the cybersecurity community and aims to eliminate long-standing cryptographic weaknesses. The transition will require organizations to audit and upgrade their infrastructures, as many legacy applications still depend on RC4. Disabling RC4 is expected to reduce the success rates of attacks exploiting weak encryption. Microsoft has introduced tools to help administrators identify hidden RC4 usage. The change reflects a commitment to zero-trust architectures and aligns with recommendations from organizations like NIST. Experts recommend a multi-step approach for organizations to navigate this transition effectively.
Microsoft Patches Widely Exploited Windows LNK Zero-Day
Winsage
December 4, 2025

Microsoft Patches Widely Exploited Windows LNK Zero-Day

Cybercriminals are exploiting a vulnerability in Windows LNK (.lnk shortcut) files, identified as CVE-2025-9491, to deliver malware in targeted attacks. This flaw allows attackers to hide malicious commands within shortcut files, which execute when a user opens the crafted shortcut, leading to malware installation. The vulnerability has been actively exploited by at least 11 threat actor groups, including Evil Corp and Mustang Panda, with malware such as Ursnif and Trickbot being delivered through this exploit. Microsoft released a patch for this vulnerability in November 2025 after initially delaying it, citing the need for user interaction to trigger the exploit. Security recommendations include avoiding suspicious .LNK files, implementing strict email filtering, and applying the latest security updates.
Android Photo Frame App Infects Devices With Malware, Allows Full Remote Takeover
AppWizard
November 14, 2025

Android Photo Frame App Infects Devices With Malware, Allows Full Remote Takeover

A recent investigation revealed significant security vulnerabilities in Android-powered digital photo frames, particularly those using the Uhale app (version 4.2.0). These vulnerabilities allow preinstalled applications to autonomously download and execute malware, granting remote attackers complete control of the device without user interaction. The malware is sourced from infrastructure linked to China, with domains like dc168888888.com and webtencent.com distributing malicious content. Many antivirus applications inadequately detect these threats. The Uhale app has high-risk vulnerabilities, including insecure HTTPS trust management and insufficient input validation, enabling remote code execution with root access. Brands associated with Uhale include BIGASUO, Canupdog, Euphro, and others. Exploits can lead to data exfiltration, access to private photos, and further attacks within home and enterprise environments. Technical oversights include outdated Android 6 firmware, disabled SELinux, weak cryptographic protections, and lack of authentication for incoming file transfers. Compromised frames can serve as surveillance tools or points for data exfiltration, posing risks to both home and enterprise networks. Users are advised to disconnect affected frames and monitor for unusual behavior.
Kaspersky Antivirus is Now Available for Linux. Will You Use it?
Tech Optimizer
November 12, 2025

Kaspersky Antivirus is Now Available for Linux. Will You Use it?

The Linux ecosystem is facing increased threats from sophisticated cybercriminals targeting critical infrastructure. Kaspersky, a Russian cybersecurity firm, has launched antivirus protection specifically for home Linux users following a ban on its products in the U.S. as of July 2024. This marks the first time Kaspersky's home user products officially support Linux, with compatibility for major 64-bit distributions like Debian, Ubuntu, Fedora, and RED OS. The software includes features such as real-time monitoring, behavioral analysis, automatic scanning of removable media, anti-phishing alerts, online payment protection, anti-cryptojacking capabilities, and AI-powered scanning. However, Kaspersky for Linux is not GDPR-ready, which may concern EU users regarding data protection compliance. Users need an active paid subscription to download the software, but a 30-day free trial is available. Installation is straightforward, with DEB and RPM packages provided.
When the Patches Stop: Protecting Your (Windows 10) Environment with CDR
Winsage
October 29, 2025

When the Patches Stop: Protecting Your (Windows 10) Environment with CDR

Microsoft has ceased providing free security updates for Windows 10 as of mid-October 2025, marking the end of support for the operating system. Organizations can purchase Extended Security Updates (ESUs) to extend support temporarily, but these do not protect against zero-day vulnerabilities. Transitioning to Windows 11 presents challenges, including hardware incompatibility and the need for extensive planning and validation in regulated industries like healthcare and finance. Many businesses rely on Windows 10 systems that are integral to their operations and cannot easily be replaced. Cybercriminals exploit unpatched systems, with approximately 70% of successful breaches stemming from zero-day attacks. Traditional defenses are ineffective against undisclosed vulnerabilities, and human behavior remains a significant risk factor. Votiro offers a proactive solution through Content Disarm and Reconstruction (CDR), which sanitizes files in real-time to eliminate malware before it reaches unpatched systems, providing a protective barrier for organizations still using Windows 10.
silver Android smartphone
Winsage
October 16, 2025

Microsoft October 2025 Security Update Causes Active Directory Sync Issues on Windows Server 2025

Microsoft's security updates have caused synchronization failures in Active Directory environments on Windows Server 2025, acknowledged on October 14, 2025. The issue stems from the September 2025 security update KB5065426, affecting applications like Microsoft Entra Connect Sync, which struggle to replicate AD security groups with over 10,000 members. This problem leads to incomplete synchronization, particularly impacting large enterprises in sectors like finance and healthcare, resulting in access denials and compliance risks. A registry tweak can temporarily disable the problematic feature, but Microsoft warns of potential risks in modifying the registry. The company is investigating the issue and plans to release a fix in a future update, with client platforms remaining unaffected. IT teams are advised to monitor updates and test changes in staging environments before applying them in production.
CISA Warns of Active Exploits in Critical Windows Flaw
Winsage
October 8, 2025

CISA Warns of Active Exploits in Critical Windows Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert about a significant vulnerability in Microsoft Windows, identified as CVE-2021-43226. This flaw allows attackers to elevate their privileges to SYSTEM level, threatening enterprise networks. It exists within the Common Log File System (CLFS) driver, enabling local, privileged attackers to bypass security measures and gain unauthorized control over systems running various Windows versions, including Windows 10, 11, and Server 2016, 2019, and 2022, as well as legacy systems like Windows 7 SP1 and Server 2008 R2 SP1. The vulnerability arises from improper validation of user-supplied data, leading to buffer overflow and arbitrary code execution without user interaction. It has a CVSS score of 7.8, indicating high severity, and proof-of-concept exploit code is already circulating in underground forums. CISA has set a remediation deadline of October 27, 2025, mandating federal agencies and critical infrastructure operators to implement patches. Recommendations for mitigation include immediate patching, strengthening endpoint controls, implementing layered defenses, continuous monitoring, regular vulnerability management, and maintaining a robust incident response program.
Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control
Tech Optimizer
October 6, 2025

Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control

Modern ransomware operations have evolved into complex, multi-stage campaigns that utilize legitimate Remote Access Tools (RATs) to maintain stealth and persistently dismantle organizational defenses. Ransomware encrypts critical data and demands ransom for restoration, with current operations being highly targeted compared to earlier mass phishing attacks. Attackers exploit trusted administrative software like AnyDesk, UltraViewer, RustDesk, and Splashtop to establish backdoors, escalate privileges, and deploy payloads across networks, moving laterally and evading detection. The ransomware kill chain consists of several stages: 1. Initial Access: Attackers gain access through credential compromise, often targeting administrator accounts. 2. Remote Tool Abuse: Attackers deploy RATs either by hijacking existing tools or performing silent installations. 3. Persistence & Privilege Consolidation: They maintain persistence using registry keys and scheduled tasks while escalating privileges. 4. Antivirus Neutralization & Anti-Forensics: Attackers stop antivirus services, manipulate policies, and clear logs to evade detection. 5. Payload Deployment & Execution: Ransomware is delivered and executed within remote sessions to avoid suspicion. Commonly abused RATs include AnyDesk, UltraViewer, AppAnywhere, RustDesk, Splashtop, and TightVNC, which have been associated with various ransomware campaigns. Understanding the tactics and techniques used by adversaries is crucial for effective defense, as they exploit legitimate tools to bypass security measures. Emerging trends include AI-driven RAT deployment, cloud-based RAT abuse, and the integration of RATs in ransomware-as-a-service offerings. A comprehensive defense strategy involves multiple layers of security, including virus protection, behavior-based detection, and application control, to counter the risks posed by RAT abuse in ransomware attacks.
Search