false positives Archives

AppWizard

May 23, 2026

“Congrats to the owners of a brand new $6k paperweight”: Valorant dev Riot makes players think Vanguard anti-cheat will brick their PCs, causing uproar — here’s what’s really happening

Valorant's anti-cheat system, Vanguard, has been controversial due to its interference with DMA firmware devices, which are used to cheat in the game. Riot Games posted a message suggesting that Vanguard was making these devices unusable, leading to backlash from the gaming community. Riot clarified that Vanguard does not damage hardware or disable devices but prevents DMA cheat devices from functioning while IOMMU protections are enabled. Players not using DMA devices are not affected. The situation has sparked debate about the balance between anti-cheat measures and their impact on hardware.

Winsage

May 14, 2026

Microsoft unveils MDASH, its AI agent-driven security platform — and it’s already spotted a host of new Windows flaws

Microsoft has introduced MDASH, a platform that enhances vulnerability discovery using artificial intelligence, developed by the Autonomous Code Security Team and the Windows Attack Research and Protection group. MDASH has identified 16 previously unknown vulnerabilities in various Windows components, including four critical remote code execution vulnerabilities (CVE‑2026‑33827 and CVE‑2026‑33824). The platform achieved zero false positives during testing and is currently used internally at Microsoft and in a private preview for select partners.

Winsage

May 14, 2026

Microsoft MDASH finds Windows security flaws with AI | ETIH EdTech News

Microsoft has developed an AI security system called MDASH that has identified 16 vulnerabilities in Windows networking and authentication frameworks, with four classified as Critical, allowing for remote code execution. MDASH uses over 100 specialized AI agents to analyze code from multiple perspectives, improving the accuracy of vulnerability detection. The system has successfully detected all 21 planted vulnerabilities in a private testing environment without false positives, achieving a 96 percent recall rate against historical cases and an 88.45 percent success rate on the CyberGym benchmark. The identified vulnerabilities include issues in tcpip.sys and IKEEXT, which can be exploited remotely without needing credentials.

Tech Optimizer

May 8, 2026

CrowdStrike Falcon: What US Businesses Need to Know Right Now About the Security Platform

CrowdStrike Falcon is a cloud-native endpoint protection platform (EPP) and extended detection and response (XDR) solution used by many U.S. organizations to combat modern cyber threats such as ransomware and supply chain attacks. It utilizes behavioral analysis, machine learning, and real-time telemetry instead of traditional signature-based detection methods. Falcon features a lightweight agent that operates on various endpoints, collecting telemetry data for analysis. Key modules include Falcon Prevent for blocking malware, Falcon Insight for monitoring endpoint activity, and Falcon OverWatch for managed detection and response services. The platform also offers identity protection and cloud workload security, integrating telemetry from various environments for a comprehensive threat view. Falcon is particularly beneficial for medium to large-sized organizations with dedicated security teams and complex IT infrastructures. However, it may not be suitable for smaller businesses due to its licensing model and operational complexity. Its strengths include rapid deployment, scalability, and advanced detection capabilities, while its limitations involve reliance on proper configuration and cloud connectivity. Competitors include Microsoft Defender for Endpoint and SentinelOne. Organizations considering Falcon should evaluate their security needs, existing infrastructure, and budget, as well as the total cost of ownership.

Winsage

May 6, 2026

Defender Misflags DigiCert Root Certificates, Breaking Windows SSL Trust

On April 30, 2026, Microsoft Defender misclassified two legitimate DigiCert root certificates as a severe threat, specifically Trojan:Win32/Cerdigent.A!dha, leading to their quarantine and disrupting SSL/TLS validation across affected endpoints. This misclassification was a result of new malware detections introduced by Microsoft in response to concerns over compromised certificates from a DigiCert breach. The false-positive alerts were triggered by the registry entries of the two trusted root certificates, which are crucial for validating SSL/TLS sessions. Microsoft later acknowledged the error and adjusted the alert logic. There was no actual compromise of the DigiCert certificates, as administrators confirmed that the certificate hashes matched the official values. The misclassification stemmed from a failure to properly constrain the detection to only revoked end-entity signing certificates related to a separate incident. This incident follows a pattern of Microsoft Defender misidentifying legitimate software as malicious, as seen in a 2022 incident where Microsoft Office was flagged as a virus. Organizations with restrictive update policies may continue to face SSL/TLS validation failures until they deploy the corrective Security Intelligence version or manually restore the DigiCert roots.

Winsage

May 5, 2026

Defender yanks root certs as Windows updates blocks backups

Microsoft's Defender anti-malware tool update version 1.449.425.0 removed two DigiCert root digital certificates, leading to false positives that flagged them as severe malware (Trojan:Win32/Cerdigent.A!dha). This incident was later identified as a false positive, and updating to version 1.449.430.0 or later reinstates the certificates. The issue may be linked to a DigiCert employee encountering disguised malware. Additionally, Windows updates from April 14 caused third-party backup applications to malfunction due to the addition of vulnerable psmounterex.sys kernel driver versions to a blocklist. Users experienced difficulties with mounting backup image files, and Microsoft referenced a vulnerability rated 9.3 out of 10 in the driver. Other affected software includes Acronis Cyber Protect Cloud and UrBackup server. Microsoft has not explained the delay in adding the vulnerable driver to the blocklist, and other recent update-related issues have also been reported.

Tech Optimizer

May 4, 2026

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

Microsoft Defender mistakenly flagged legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, leading to their removal from Windows systems globally. This issue arose after a Defender signature update on April 30th, with affected certificates including 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4. The certificates were removed from the AuthRoot store under the Registry key HKLMSOFTWAREMicrosoftSystemCertificatesAuthRootCertificates. Microsoft has addressed the issue in Security Intelligence update version 1.449.430.0, which also restored the removed certificates. The false positives were linked to detections related to a recent DigiCert breach, where threat actors obtained valid code-signing certificates used for signing malware. DigiCert revoked 60 code-signing certificates, including those linked to the "Zhong Stealer" malware campaign. The malware utilized certificates issued to companies like Lenovo and Kingston, but the certificates flagged by Microsoft Defender are root certificates and do not correspond to the revoked code-signing certificates.