filesystem Archives

Tech Optimizer

July 28, 2026

ClamAV Setup: Linux Antivirus in 12 Steps [2026]

Malware can threaten Linux systems, which are often mistakenly believed to be immune to viruses. It can be introduced through email attachments, infected files, or compromised plugins, especially when Linux servers interact with Windows clients or handle internet uploads. ClamAV is an open-source antivirus engine maintained by Cisco Talos, designed for scanning mail traffic and file uploads. As of mid-2026, the stable release is ClamAV 1.5.x, with version 1.5.2 being the latest patch. To deploy ClamAV, users need root or sudo access on a compatible Linux machine, at least 2 vCPUs and 2GB of RAM, 5GB of free disk space, and outbound HTTPS access to ClamAV’s signature mirrors. The installation process involves several steps, including configuring freshclam for automatic updates, validating detection with the EICAR test file, and setting up cron jobs for regular scans. ClamAV can also be integrated with mail servers and a SIEM for enhanced security. Common pitfalls in deployment include skipping the initial freshclam run and using clamscan instead of clamdscan for repeated scans. ClamAV is free for commercial use and can also scan Windows systems, although it does not replace comprehensive endpoint protection solutions.

Tech Optimizer

July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.

Winsage

June 19, 2026

Windows Platform Security and the Race to Secure AI Agents

Microsoft has introduced the Microsoft Execution Containers (MXC) SDK to establish Windows as a reliable operating system for autonomous agents, focusing on containment, identity, and manageability. The MXC framework serves as a policy-driven execution layer for agents on Windows and Windows Subsystem for Linux (WSL), allowing developers to set access permissions using JSON or TypeScript. It employs process and session isolation for agent containment and identity. Future enhancements will include micro-VM support for high-risk tasks and integration with Windows 365 for cloud PC workloads. IT teams can manage MXC policies through Entra ID and Intune, while Defender and Purview provide protection and observability. The MXC framework is built on Microsoft's security initiatives, including Secure Boot and passwordless sign-in, allowing agents to inherit a secure foundation. However, early commentary expresses caution regarding MXC's perception as a comprehensive security solution, noting issues with overly permissive policies and the lack of outbound network filtering. Other platforms, such as Linux, are also enhancing security for agents with kernel-level isolation and secure environments like NVIDIA's OpenShell runtime. Various projects are focusing on agent sandboxes within Kubernetes, employing technologies like gVisor and Kata Containers for isolation. Overall, no singular dominant platform security model for AI agents has emerged, with Windows' MXC still considered nascent compared to existing solutions in Linux and Kubernetes ecosystems.

Tech Optimizer

June 13, 2026

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

On June 10th, Splunk released an advisory for CVE-2026-20253, a high-severity vulnerability with a CVSS score of 9.8 that requires no authentication. The vulnerability is associated with the PostgreSQL Sidecar Service Endpoint and affects Splunk Enterprise versions 10 and above. In default installations, the service is not installed on Windows but is installed and enabled by default on AWS. The vulnerability allows unauthorized users to create and truncate arbitrary files through an API that lacks authentication controls. Additionally, it enables the execution of SQL commands via a backup and restore mechanism, potentially leading to remote code execution (RCE). A Detection Artefact Generator has been developed to help organizations assess their vulnerability to this issue.

Winsage

June 10, 2026

Proton releases Proton Drive CLI for Windows, Mac, and Linux

Proton has released a new command-line interface (CLI) for Proton Drive, allowing users to manage encrypted files from a terminal on Windows, macOS, and Linux. The CLI includes features such as authentication via browser, uploading files while skipping existing ones, checking sharing status, and inviting collaborators to shared folders. Future updates will add capabilities for managing photos, sharing files through public links, creating custom albums, and switching between accounts. Installation on macOS and Linux involves downloading a pre-built binary or building from source. The release follows a significant performance upgrade of Proton Drive, which is now three times faster due to a unified Drive SDK that enhances cryptographic task execution and reduces battery drain on mobile devices.

AppWizard

June 8, 2026

NFCShare Android malware spreads via fake banking app updates on GitHub

New variants of the NFCShare Android malware are disguised as fake updates for legitimate banking applications and are targeting customers of various banks in Europe through a phishing campaign to steal sensitive payment card data. The malware prompts victims to place their cards near the NFC chip of their mobile devices, using Android’s IsoDep interface to read card information, including card number, type, expiry date, and a 4-digit PIN. The stolen data is exfiltrated to the attacker’s command-and-control host via a WebSocket channel. Recent attacks began on May 14, with victims directed to a phishing site that impersonates a legitimate bank and then to a GitHub repository hosting a malicious APK file. The repository has hosted 56 unique APKs impersonating banking applications primarily from Italy and Spain. The malware has evolved from initially targeting Deutsche Bank in Germany to a broader range of banks. The latest version features malformed APK packaging to complicate automated analysis. Users are advised to download banking applications only from Google Play and to be cautious of verification requests that ask for NFC card scans.

Tech Optimizer

June 6, 2026

PostgreSQL Dump and Restore: The Complete pg_dump Guide

pg_dump is a utility for exporting a PostgreSQL database into a file, which can be restored on the same or different servers. It exports a single database's tables, views, sequences, functions, indexes, triggers, and in-database grants but does not include roles, tablespaces, or server-level configurations. To capture global objects, pg_dumpall --globals-only should be executed prior to the per-database dump. pg_dump requires CONNECT and SELECT privileges on all tables and sequences within the target database, and a dedicated backup role is sufficient for single-database dumps, while superuser access is needed for global objects. pg_dump supports various output formats: plain SQL (.sql), custom binary (.dump), directory of files, and tar archive (.tar), each with different capabilities for restoration and compression. The custom format allows for selective and parallel restoration. For non-interactive use, credentials can be stored in a .pgpass file or passed via the PGPASSWORD environment variable. Restoration methods depend on the dump format: psql is used for plain SQL files, while pg_restore is used for custom and directory formats. The restoration process requires the target database to be created beforehand. Version mismatches between pg_dump and pg_restore can lead to failures, so it's essential to ensure that the binaries are version-matched. In Docker, pg_dump and pg_restore can be executed within containers, but care must be taken to manage credentials and ensure version compatibility. Exit codes from pg_dump should be checked to confirm successful operations.

BetaBeacon

May 28, 2026

The best Simpsons game just got (unofficially) ported to Android

A developer has created an Android port of The Simpsons: Hit & Run game, which requires the original game files to play. The port currently requires an external controller to play, but touch controls are being worked on. The game runs well on most phones from the last several years, and the developer has provided installation instructions on GitHub.

Winsage

May 8, 2026

Windows update is breaking backups, and here’s how you can fix it

A recent Windows update, KB5083769, released on April 14, 2026, blocks the psmounterex.sys driver, disrupting the functionality of third-party backup software like Acronis Cyber Protect Cloud, Macrium Reflect, and NinjaOne. This driver is essential for loading and mounting backup storage images. Users may encounter errors related to Microsoft VSS during backup attempts. The update is a security enhancement, not a bug, and users are advised to upgrade their backup software to versions that use a newer driver or temporarily uninstall the KB5083769 update. It is recommended to check for updates from the backup software provider and pause Windows Updates to prevent automatic reinstallation of the problematic update until a fix is available.

Tech Optimizer

May 3, 2026

TigerFS Mounts PostgreSQL As Transactional Filesystem

TigerFS is an open-source project introduced on April 4, 2026, by Michael Freedman, the CTO of TigerData. It allows users to mount a PostgreSQL database as a POSIX-like filesystem, storing database rows as individual files while ensuring ACID guarantees. Key features include an MIT license, support for both file-first and data-first workflows, mounting options using FUSE on Linux and NFS on macOS, and integration with standard Unix tools.