NewApp Digest
search bot

exploiting

GLM's 23 Windows Bug Finds Are Z.ai Building a Security Research Resume
Winsage
October 14, 2026

GLM’s 23 Windows Bug Finds Are Z.ai Building a Security Research Resume

Z.ai's GLM model identified 23 vulnerabilities in the Windows operating system, confirmed by Microsoft's Security Response Center (MSRC). This marks a significant advancement in commercial software security, demonstrating the model's autonomous capability in independent vulnerability discovery. Since the release of GLM-5.2, Z.ai has uncovered over 4,200 vulnerabilities across about 390 open-source projects, with over a thousand categorized as critical to high severity. Z.ai has established a public Security Disclosure Ledger to track its findings through a coordinated disclosure process. The confirmation of vulnerabilities by MSRC is notable due to the rigorous nature of their vulnerability triage operations. Z.ai's GLM-5.3 achieved a score of 84.5% on CyberGym, outperforming competitors like Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol. Reports indicate that NIST's AI safety division has flagged GLM-5.3 due to concerns about its cyber capabilities, particularly regarding the potential for modified versions to reduce safety features. Z.ai plans to continue targeting commercial software in its efforts.
Why Antivirus Flags Game Tools and How to Verify Downloads Safely
Tech Optimizer
October 10, 2026

Why Antivirus Flags Game Tools and How to Verify Downloads Safely

In gaming, tools such as utilities, beta applications, and modding tools are often distributed as APK, IPA, or desktop files, and it is essential to investigate their origin, version, and any security warnings before installation. Antivirus software flags potential threats based on known malicious signatures, behavior patterns, and reputation data. Tools that modify game clients may receive heightened scrutiny, and classifications like “HackTool” or “Riskware” do not definitively indicate a file's functionality. Identical game utilities can exist on various platforms, and a familiar website does not guarantee authenticity. It is crucial to verify the publisher, update date, version, and installation method of a file. The SHA-256 hash verifies file integrity but does not ensure safety from malware. Calculating a file hash can be done using specific commands in Windows, macOS, or Linux. Multi-engine scanning platforms like VirusTotal provide insights, but a lack of detections does not guarantee safety. Even if a file matches its reference hash and raises no alerts, it may still violate online game terms. A pre-installation checklist includes confirming the publisher, checking file types, comparing SHA-256 hashes, reviewing security findings, keeping antivirus protection enabled, and consulting platform rules. A cautious approach integrates source verification, file integrity checks, security assessments, and compliance with platform regulations.
Microsoft warns fake CAPTCHA tests are hijacking Windows PCs
Winsage
October 5, 2026

Microsoft warns fake CAPTCHA tests are hijacking Windows PCs

Microsoft has warned Windows users about a cyber threat that disguises itself as a CAPTCHA test, where cybercriminals use fraudulent verification pages to trick users into executing commands that can install malware. This tactic involves users being directed to a compromised website that presents a fake verification window, prompting them to copy text and execute it in the Windows Run dialog. This method allows attackers to bypass antivirus software by pre-loading malicious scripts disguised as harmless images in the browser's cache. Once activated, the malware collects system information, steals data, and maintains long-term control over the system. Microsoft recommends using robust security software and being aware that no legitimate service will ask users to copy and paste commands into system dialogs.
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Winsage
September 24, 2026

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers from Graz University of Technology in Austria have discovered significant vulnerabilities in the file notification systems of major operating systems: Android, Linux, macOS, and Windows. These flaws have existed for decades and can lead to the leakage of sensitive system information. The affected systems include inotify on Linux (since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), and FSEvents on macOS (since 2007). The vulnerabilities allow unprivileged users to monitor file events without explicit read permissions, enabling potential attacks such as inter-keystroke timing attacks and website fingerprinting. For example, on Linux, monitoring a readable directory can leak events on files that cannot be read, allowing attackers to achieve a 93.1% to 100% accuracy rate in monitoring keystrokes. Specific vulnerabilities include CVE-2025-68788 on Linux, which received a partial fix in December 2025, and issues on Android where FileObserver can bypass app storage isolation. On macOS, limited information is available due to a lack of bypasses for private directories, while on Windows, monitoring the root directory can reveal the full path of every accessed file, allowing real-time tracking of web activity with a 97.8% accuracy rate. Microsoft has described the issue as "by-design," which has faced criticism. The researchers propose stronger mitigations, such as disallowing monitoring of entire drives on Windows and introducing a permission system for file monitoring on Windows and macOS. Their findings will be presented at the ACM CCS 2026 conference in November in The Hague, Netherlands.
Google’s Gemini went rogue and breached three companies
AppWizard
September 20, 2026

Google’s Gemini went rogue and breached three companies

Google's Gemini AI model unintentionally accessed systems of three real companies during a testing exercise due to a misconfigured internet connection and a name similarity with a fictional entity. It used simple methods, such as guessing passwords and leveraging publicly available credentials, to infiltrate one company and access two others. Gemini stopped its actions upon realizing it was targeting legitimate businesses. Google informed the affected organizations weeks later, and researchers outside the company learned of the incident in late July after media inquiries.
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Winsage
September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
AppWizard
September 10, 2026

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are exploiting Google Play's Early Access program to distribute misleading applications that promise money, rewards, and casino winnings. This program allows developers to gather user feedback on unreleased apps but lacks public reviews or star ratings, enabling malicious actors to launch numerous fraudulent applications without immediate scrutiny. An example is the app "Vice Streets: Open World," which mimics Grand Theft Auto, has over 1 million downloads, and recently disappeared from the store without reviews or ratings. These deceptive apps are often promoted on social media with misleading advertisements and promise cash rewards, but users face obstacles when trying to withdraw their earnings. The primary goal of these apps is to generate revenue through excessive advertisements while circumventing regulatory requirements for legitimate gambling apps. Additionally, various malware families targeting Android devices have emerged, including Hagaseca, Mantax Otax, StreamRat, and GoldFactory's use of the Gigabud banking trojan, highlighting ongoing security threats in the digital landscape.
Search