execution Archives

Winsage

April 19, 2026

Copilot to Be Removed From These Windows Applications

Microsoft is phasing out Copilot from various applications in Windows 11, reducing the overall presence of AI in the operating system. In the latest version of Notepad (11.2512.28.0), the Copilot icon has been replaced with a traditional pencil icon, but the underlying functions remain unchanged, allowing users to disable AI features if desired. The Snipping Tool has completely removed Copilot integration, eliminating the AI button and any references to AI features. Microsoft previously indicated plans to streamline Copilot access points in applications like Notepad, Photos, Widgets, and the Snipping Tool. Despite these changes, Microsoft intends to integrate AI more subtly within Windows 11, keeping functionalities intact but positioning them discreetly.

AppWizard

April 18, 2026

Help! The Millennium Bug made all the robots in my mansion go berserk, and only Homer Simpson can save the day

Y2K: The Game is a PC game that pays homage to the Millennium Bug, reflecting the concerns of the late 1990s regarding technology. The game features a character named Buster, whose slow pacing has drawn criticism. Its soundtrack includes eclectic melodies, adding to its quirky charm. Despite not fully realizing its premise, the game is considered an intriguing relic of its time.

Winsage

April 18, 2026

Microsoft’s Patch Tuesday release for April is a whopper

A series of updates have been released, focusing on system integrity and performance. Users should perform verification tasks, including installing, uninstalling, and repairing MSI packages, connecting and disconnecting cloud sync providers, and enrolling devices in Intune or MDM solutions. The Common Log File System driver (clfs.sys) is receiving a follow-up patch, along with updates to Storage Spaces (spaceport.sys) and app isolation file system drivers (bfs.sys, wcifs.sys). Users should also run Windows Update installation and rollback cycles, install and uninstall applications, and verify data integrity through backup solutions. For Storage Spaces, creating a pool with mirrored and thin virtual disks and ensuring clean deletion is necessary. April's updates for Office target MSI editions, including Excel 2016 (KB5002860), PowerPoint 2016 (KB5002808), Office 2016 shared libraries (KB5002859), and SharePoint Server editions from 2016 to 2019. These updates do not apply to Click-to-Run deployments like Microsoft 365 Apps. Users should validate complex Excel workbooks, PowerPoint presentations, SharePoint document libraries, and the functionality of Office add-ins. Testing for two High Risk components is essential: changes to Kerberos may disrupt services using RC4 keytabs, and the Remote Desktop client update requires validation of clipboard functionality, printer redirection, and session reconnection. Validating Secure Boot and BitLocker is critical as CVE-2023-24932 key rolling progresses. Additionally, cloud sync testing is important due to five patches to the Projected File System driver, and regression testing is needed for dual afd.sys updates and VPN/IPsec patches across remote-access infrastructure. Office updates are limited to MSI editions.

Winsage

April 18, 2026

RedSun: Windows 0day when Defender becomes the attacker

A vulnerability has been discovered in Windows Defender that allows standard users to exploit a logic error in the file remediation process, enabling code execution with elevated privileges without administrative access. This flaw, identified by security researcher Chaotic Eclipse, occurs because Windows Defender does not verify if the restoration location of flagged files has been altered through a junction point. The exploit, named RedSun, takes advantage of a missing validation in the MpSvc.dll file, allowing attackers to redirect file restoration to the C:WindowsSystem32 directory. RedSun operates by chaining together four legitimate Windows features: Opportunistic Locks (OPLOCKs), Cloud Files API, Volume Shadow Copy Service (VSS), and Junction Points. The execution of the exploit involves monitoring shadow copies, triggering Defender's detection, synchronizing OPLOCKs, and ultimately writing malicious binaries to the System32 directory. The root cause is the lack of reparse point validation in the restoration process, and currently, no patch or CVE has been assigned for this vulnerability. It affects Windows 10, Windows 11, and Windows Server 2019 and later, and organizations are advised to implement behavioral detection strategies until a fix is available.

AppWizard

April 17, 2026

Android officially releases AI development skills, enabling you to build Android apps up to 3 times faster using AI agents.

Google has introduced a suite of AI skills and development tools for Android developers to enhance productivity, allowing them to build applications three times faster using any AI agent. The documentation has been restructured into a format called Agent Skills, providing clear, actionable steps for AI to follow, which eliminates the need for manual input from developers. Google plans to expand its offerings with more official Android skills compatible with community-developed skills. Additionally, a preview of the Android CLI has been released, enabling developers to perform tasks like environment setup and project creation directly from the terminal, significantly improving efficiency. Internal tests show that using the Android CLI with the new skills can reduce AI token usage for project setup by 70% and decrease task completion time to a third of traditional methods. The Android Knowledge Base has also been introduced to keep AI agents updated with current data, enhancing their effectiveness. Developers can transition from the Android CLI to Android Studio for advanced debugging, with new AI-powered project flows integrated into the IDE.

Winsage

April 16, 2026

Fake Proton VPN sites are pushing NWHStealer malware to Windows users

A malware campaign is utilizing counterfeit Proton VPN websites and other deceptive tactics to distribute a Windows infostealer known as NWHStealer. This malware extracts sensitive information, including browser credentials and cryptocurrency wallet details, and operates stealthily by injecting itself into legitimate processes. Two primary infection vectors have been identified: malicious ZIP archives on a free web hosting platform and trojanized installers from fake Proton VPN sites. The malware employs DLL hijacking and can exfiltrate data to a command-and-control server while ensuring persistence through scheduled tasks and disguising payloads as legitimate system processes. It also exploits the Windows cmstp.exe utility to bypass User Account Control. Users are advised to avoid downloading software from unofficial sources and to verify file signatures and publisher information.

Tech Optimizer

April 16, 2026

MiningDropper Android Malware Exploits Lumolight App

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered an Android malware framework called MiningDropper, which is being used in various campaigns to distribute malicious payloads such as cryptocurrency miners, infostealers, Remote Access Trojans (RATs), and banking malware. Over 1,500 MiningDropper samples were detected in one month, with many showing minimal antivirus detection. MiningDropper operates as a multi-stage delivery framework that employs techniques like XOR-based obfuscation and AES encryption to evade detection. A recent variant uses a trojanized version of the Lumolight application as the initial infection vector, often spread through phishing links and fraudulent websites. The malware executes a series of stages, starting with decrypting an embedded asset and loading additional payloads, including a counterfeit Google Play update interface to deceive users. Two main campaign clusters have been identified: an infostealer campaign targeting Indian users by impersonating trusted entities, and a global campaign distributing the BTMOB RAT, which enables credential theft and device takeover. The final payload capabilities include extracting sensitive data, enabling full device compromise, facilitating financial fraud, and unauthorized cryptocurrency mining. MiningDropper's modularity allows it to adapt and scale across various campaigns while maintaining low detection rates.

Winsage

April 16, 2026

Microsoft Overhauls Windows Update for First Time in 15 Years Starting April

Microsoft is transforming its Windows Update system, starting in April, marking the most significant overhaul in over 15 years. The new system will centralize the management of operating system patches, drivers, and application updates, aiming to enhance user experience by simplifying the update process and improving reliability. Users will experience fewer interruptions, as updates will be consolidated into a single restart cycle, and updates will be scheduled during idle times to minimize disruptions. The update system will also expand support for driver and hardware updates. This transformation aligns with Microsoft's long-term vision for AI-enhanced PCs and cloud-integrated systems, enabling scalable updates for AI features and improving compliance for enterprise users. The rollout will begin gradually in April to mitigate risks associated with compatibility and execution.

AppWizard

April 15, 2026

After 4 hours of pirate survival in Windrose, I’m reinstalling Sea of Thieves

After four hours of gameplay in Windrose, the player has engaged in activities such as felling trees, collecting seashells, and constructing grass huts, while also facing challenges from various creatures. The player is currently stranded on an archipelago and must rescue their crew from different islands. Windrose has seen nearly 70,000 concurrent players and received around 1,500 positive reviews on its first day on Steam, despite being in early access. The game lacks a wind system for sailing, and the player feels it resembles a survival game with pirate aesthetics rather than an authentic pirate experience. In contrast, Sea of Thieves is noted for capturing the essence of piracy through its multiplayer experience and physical gameplay mechanics. Sea of Thieves has evolved over time with new content and features, while Windrose has faced technical issues that hinder the experience. The player expresses skepticism about investing time into Windrose, despite the potential for building a pirate fortress.

Winsage

April 14, 2026

Windows 11 cumulative updates KB5083769 & KB5082052 released

Microsoft has released cumulative updates KB5083769 and KB5082052 for Windows 11 versions 25H2, 24H2, and 23H2, incorporating the April 2026 Patch Tuesday security patches. Users can install these updates automatically or manually via the Microsoft Update Catalog. The build numbers will be updated to 26200.8246 for 25H2, 26100.8246 for 24H2, and 22631.6936 for 23H2. Key features include the ability to modify Smart App Control without reinstalling Windows 11, improved Narrator functionality, enhancements in Account Settings for Microsoft 365 Family subscribers, refined Pen settings, a redesigned About page in Settings, and various reliability improvements across File Explorer, Display, Printing, Safe mode, Voice Access, Start menu, Remote Desktop, and Audio. No new issues have been reported from this update, and Microsoft is planning a significant quality update for Windows 11 in 2026.