NewApp Digest
search bot

exploiting

Do you still need third-party antivirus on your Windows PC?
Winsage
July 1, 2026

Do you still need third-party antivirus on your Windows PC?

In April, a statement on the Windows Learning Center claimed that Microsoft Defender Antivirus is sufficient for many Windows 11 users, leading to brief attention before the article was removed a month later without explanation. The link now redirects to the homepage, but the content is still accessible via the Internet Archive. Microsoft has not clarified the removal, and speculation suggests backlash from the third-party security industry may have influenced this decision. Research indicates that the infection rate for consumer PCs in 2023-2024 was 3.07%, lower than the 2.39% for business PCs, suggesting that risks may not be as widespread as often claimed. The 2025 Cybersecurity Threat Report noted that 56% of consumer endpoints that faced an infection in 2024 experienced subsequent infections, with user behavior playing a significant role. A survey found that 54% of Americans rely on default device protection, while 46% use third-party antivirus solutions. Modern antivirus solutions, including Microsoft Defender, achieve protection rates of 99% or higher, with Defender specifically reaching a 99.0% protection rate without false positives. This performance indicates that Defender is adequate for most consumers. Default security measures on platforms are generally effective, with modern antivirus applications blocking 99.2% of threats that bypass other protections. Consequently, 97% of PCs remain free from malware infections, suggesting that improving user training may be more beneficial than investing in superior software. In contrast, businesses face different challenges, as attacks are often executed by sophisticated criminal organizations targeting vulnerabilities in third-party software. Enterprise administrators typically use specialized endpoint security products for centralized management and continuous monitoring, which are essential for protecting business environments.
Steam Machine reservations are already being resold on Ebay for up to $2900
AppWizard
June 29, 2026

Steam Machine reservations are already being resold on Ebay for up to $2900

Valve's Steam Machine has faced challenges due to scalpers exploiting its limited availability. Despite measures like a randomized queue and one-unit purchase limits, resellers have listed the device at inflated prices on platforms like eBay. For example, a 2TB Steam Machine bundled with a controller is priced at ,899.99, over double its retail cost of 8. Listings for 2TB models range from ,700 to ,899.99, while a 512GB model without a controller is offered for ,800. Resale practices mirror those seen during the Steam Controller launch, where buyers could purchase multiple units for resale. The Steam Machine's higher starting price of ,049 makes reselling less feasible for many. Valve has indicated that as they process reservations, cancellations may open opportunities for others on the waiting list. Additionally, there is speculation about the demand for Valve's upcoming VR headset, the Steam Frame, amid existing competition.
Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service
Tech Optimizer
June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.
Path of Exile 2 director says players exploiting system to become in-game millionaires 'ruined Christmas for me' and joked that he's 'lost all sympathy' for everyone who took advantage of it
AppWizard
June 20, 2026

Path of Exile 2 director says players exploiting system to become in-game millionaires ‘ruined Christmas for me’ and joked that he’s ‘lost all sympathy’ for everyone who took advantage of it

The player trading economy of Path of Exile 2 experienced turmoil due to a new loot-gathering technique that allowed players to quickly accumulate in-game wealth. This led Grinding Gear Games to interrupt their holiday break to address the issue. The introduction of the "temple" feature enabled players to construct dungeons and exploit the system for excessive rewards by locking characters in the campaign and resetting levels. Mark Roberts, co-director of PoE 2, expressed frustration over the need for emergency patches and highlighted ongoing player exploits related to the temple. A patch was released to mitigate a temple strategy that threatened the game's economy. Roberts indicated a lack of sympathy for the temple due to the critical nature of the exploits. Players often aim to accumulate wealth for upgrading builds, but solo self-found mode limits access to rare items. The incident raises questions about future league launches during the holiday season.
Светлогорский хакер зарабатывал на скрытом майнинге, заражая компьютеры через торрент-раздачи
TrendTechie
June 20, 2026

Светлогорский хакер зарабатывал на скрытом майнинге, заражая компьютеры через торрент-раздачи

Cybercrime prevention officers in the Grodno region arrested a 35-year-old resident of Svetlogorsk for profiting from modified malware known as a "cryptojacker." This malware was embedded in free torrent downloads, activating on users' computers to mine cryptocurrency, which degraded the machines' performance. The suspect earned approximately one thousand Belarusian rubles monthly and was exploiting over 500 computers at the time of his arrest, affecting users in Belarus and neighboring countries. An investigation is underway to identify the victims, and criminal charges have been filed against him.
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
New Windows Zero‑Day Flaws Target Defender and BitLocker
Winsage
June 15, 2026

New Windows Zero‑Day Flaws Target Defender and BitLocker

A cybersecurity researcher known as “Nightmare Eclipse” has revealed two zero-day exploits threatening Windows systems: RoguePlanet and GreatXML. RoguePlanet targets Microsoft Defender, allowing attackers to execute privileged actions and gain SYSTEM-level access on Windows machines. It is a local privilege escalation vulnerability that remains effective on fully updated systems. GreatXML claims to bypass BitLocker disk encryption by manipulating the Windows Recovery Environment, potentially granting access to protected files. However, its effectiveness may be overstated, as it might require administrator-level access. Microsoft advises organizations to implement security updates, treat lost or accessible devices as high-risk, enforce stricter policies, and monitor threat intelligence to mitigate exposure to these vulnerabilities.
Your inbox might finally get quieter now that Google is taking down a major AI scam ring
AppWizard
June 15, 2026

Your inbox might finally get quieter now that Google is taking down a major AI scam ring

Google has filed a lawsuit against the alleged China-based "Outsider Enterprise" network for using Gemini AI to conduct extensive phishing scams. The company is working with the FBI and major telecommunications carriers, including AT&T, T-Mobile, and Verizon, to intercept scam messages. Investigators have linked the operation to over 9,000 counterfeit websites and more than one million malicious URLs, primarily targeting Android users. The "Outsider" phishing platform offered over 290 website templates for mimicking banks and other entities, utilizing AI-generated code. Google is also supporting seven bipartisan bills aimed at combating AI-driven fraud and has implemented AI-driven defenses that block over 10 billion malicious messages each month.
Search