NewApp Digest
search bot

executable

Ex-Microsoft engineer rebuilds Notepad in 2.5KB using nothing but stuff Windows already had
Winsage
July 4, 2026

Ex-Microsoft engineer rebuilds Notepad in 2.5KB using nothing but stuff Windows already had

Dave Plummer, a retired Microsoft engineer, has developed TinyRetroPad, a Notepad-like application that is only 2.5 kilobytes in size. TinyRetroPad includes features such as Open, Save, Find and Replace, printing, font selection, word wrap, and an unsaved changes prompt. It is built on existing Windows components, allowing it to function efficiently without extensive resources. TinyRetroPad is based on Dave’s Tiny Editor and utilizes RICHEDIT50W for text handling. The application's file size increased incrementally with each feature added, with the final size being 2,476 bytes. Crinkler, a compression linker, was used to optimize the executable. TinyRetroPad is still in development, facing issues like high memory consumption and compatibility problems. In contrast, Windows 11's Notepad has become larger and more complex, weighing approximately 352KB and incorporating features that some users find unnecessary. Windows 11 LTSC retains the classic Notepad without modern features, while TinyRetroPad aims to demonstrate the potential for simplicity in application design.
silver Android smartphone
Winsage
July 4, 2026

Ex-Microsoft engineer rebuilds Notepad in 2.5KB using nothing but stuff Windows already had

Dave Plummer, a former Microsoft engineer, is recreating Notepad in 2.5 kilobytes with a project called TinyRetroPad, which includes features like Open, Save, Find and Replace, printing, font selection, word wrap, and unsaved changes prompt. TinyRetroPad leverages existing Windows infrastructure, utilizing built-in resources to function efficiently. It is based on Matt Power’s Dave’s Tiny Editor and operates as a wrapper around RICHEDIT50W. The size of TinyRetroPad increased with each feature added, reaching 2,476 bytes with printing. The project uses Crinkler, a compression linker, to optimize the executable. TinyRetroPad currently lacks a dedicated Releases page and may trigger false positives from antivirus software. Users have reported issues such as excessive memory usage and compatibility problems with older Windows versions. In contrast, the modern Notepad in Windows 11 has grown to approximately 352KB, with a total disk footprint nearing 5MB, leading to user backlash over its complexity. Windows 11 LTSC retains the classic Notepad, while TinyRetroPad aims to demonstrate the potential of leveraging existing OS capabilities rather than adding unnecessary features.
silver Android smartphone
Tech Optimizer
July 3, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are using a sophisticated method to bypass security measures by embedding malware within the VLC media player. This campaign exploits VLC to install ValleyRAT, a remote access trojan, through phishing emails that contain links to download a seemingly harmless file. Once the file is opened, it activates a hidden backdoor that evades detection by antivirus solutions. The malware has been active since 2023, with a significant increase in activity noted through 2025 and into 2026, particularly targeting Chinese and Japanese-speaking users. The infection process begins when a victim clicks a link in a phishing email, leading to a ZIP archive containing a disguised executable and a malicious DLL (libvlc.dll). The executable mimics a legitimate VLC file, and when executed, it loads the DLL, allowing the malware to run under the guise of VLC. The malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, such as performing checks on system behavior and using a fileless approach to inject its payload directly into memory, avoiding storage on disk. Researchers recommend training employees to recognize suspicious filenames and deploying endpoint detection tools to identify DLL sideloading behavior. For organizations affected by this campaign, isolating compromised systems and reviewing security logs are critical initial steps. Indicators of compromise include a malicious email domain, a ZIP archive containing a fake VLC executable, and a download URL for ValleyRAT.
На торрентах появилась взломанная версия игры 007 First Light
TrendTechie
July 2, 2026

На торрентах появилась взломанная версия игры 007 First Light

The hacker known as voices38 has breached the Denuvo protection system in the game 007 First Light, which was released on May 27, 2026, approximately two weeks before the hack was reported. Voices38's method is a conventional executable "crack" that does not require users to disable security mechanisms, making it more user-friendly than previous attempts by the group DenuvOwO. Voices38 has also successfully bypassed protections in other high-profile games, including Pragmata, Stellar Blade, Resident Evil: Requiem, and Mafia: The Old Country. The effectiveness of DRM solutions like Denuvo is being questioned as hackers develop more sophisticated methods to breach these systems.
Do you still need third-party antivirus on your Windows PC?
Winsage
July 1, 2026

Do you still need third-party antivirus on your Windows PC?

In April, a statement on the Windows Learning Center claimed that Microsoft Defender Antivirus is sufficient for many Windows 11 users, leading to brief attention before the article was removed a month later without explanation. The link now redirects to the homepage, but the content is still accessible via the Internet Archive. Microsoft has not clarified the removal, and speculation suggests backlash from the third-party security industry may have influenced this decision. Research indicates that the infection rate for consumer PCs in 2023-2024 was 3.07%, lower than the 2.39% for business PCs, suggesting that risks may not be as widespread as often claimed. The 2025 Cybersecurity Threat Report noted that 56% of consumer endpoints that faced an infection in 2024 experienced subsequent infections, with user behavior playing a significant role. A survey found that 54% of Americans rely on default device protection, while 46% use third-party antivirus solutions. Modern antivirus solutions, including Microsoft Defender, achieve protection rates of 99% or higher, with Defender specifically reaching a 99.0% protection rate without false positives. This performance indicates that Defender is adequate for most consumers. Default security measures on platforms are generally effective, with modern antivirus applications blocking 99.2% of threats that bypass other protections. Consequently, 97% of PCs remain free from malware infections, suggesting that improving user training may be more beneficial than investing in superior software. In contrast, businesses face different challenges, as attacks are often executed by sophisticated criminal organizations targeting vulnerabilities in third-party software. Enterprise administrators typically use specialized endpoint security products for centralized management and continuous monitoring, which are essential for protecting business environments.
Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service
Tech Optimizer
June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.
4 security upgrades in Android 17 you didn't know about, but will be glad to have
AppWizard
June 19, 2026

4 security upgrades in Android 17 you didn’t know about, but will be glad to have

Google's Android 17 update is being deployed to Pixel devices, introducing new features such as multitasking bubbles, expanded dark theme controls, and a revamped screen recording interface. Key user preferences from a poll indicate that 32% favor multitasking app bubbles, while other features received varying levels of support. The update includes App Memory Limits to prevent excessive RAM usage by apps, enhancing performance. It also restricts apps from scanning local networks without explicit permission, improving user privacy. Additionally, Android 17 tightens restrictions on dynamic code loading to strengthen malware protection and implements Certificate Transparency protections by default for secure HTTPS connections. Overall, these changes aim to enhance performance, security, and user experience.
Microsoft and Adobe team up and make Photoshop 20% faster on Windows
Winsage
June 19, 2026

Microsoft and Adobe team up and make Photoshop 20% faster on Windows

Microsoft is collaborating with Adobe to enhance the performance of Photoshop, a widely used image editing software. The partnership focuses on optimizing operations within Photoshop, which is primarily developed in C++ and compiled using Microsoft’s Visual C++ (MSVC) compiler. Microsoft aims to improve performance for CPU-intensive tasks, particularly those that are latency-sensitive, such as brush responsiveness and file-opening tasks. The engineering team activated MSVC’s "peak-performance" compilation mode and explored profile-guided optimization (PGO) to refine executables. However, due to the complexity PGO introduced, they shifted to Sample-based Profile Guided Optimizations (SPGO), which uses hardware performance samples from actual release binaries. This method allows for greater flexibility in data collection and typically yields performance improvements of 5% to 15%. By combining MSVC’s peak-performance mode with SPGO, the teams achieved a 20% performance boost on x64 Windows systems and a 13% enhancement on Arm architecture. These optimizations resulted in improved responsiveness for critical tasks in Photoshop, enhancing the user experience in professional creative workflows.
Windows devs rerolled old code to save precious bytes
Winsage
June 17, 2026

Windows devs rerolled old code to save precious bytes

Veteran Microsoft engineer Raymond Chen shared a story about the development of an x86-32 emulator that utilized binary translation, significantly improving performance compared to traditional emulation methods. During the project, the team faced an issue where a function allocated 64 KB of memory but was optimized by a compiler into 65,536 instructions, leading to 256 kilobytes of code being used to initialize the data. In response to this inefficiency, the engineers modified the translator to replace the inefficient function with a more compact loop, highlighting their commitment to memory efficiency during a time when operating systems prioritized resource conservation.
Search