filesystem Archives

Winsage

June 19, 2026

Windows Platform Security and the Race to Secure AI Agents

Microsoft has introduced the Microsoft Execution Containers (MXC) SDK to establish Windows as a reliable operating system for autonomous agents, focusing on containment, identity, and manageability. The MXC framework serves as a policy-driven execution layer for agents on Windows and Windows Subsystem for Linux (WSL), allowing developers to set access permissions using JSON or TypeScript. It employs process and session isolation for agent containment and identity. Future enhancements will include micro-VM support for high-risk tasks and integration with Windows 365 for cloud PC workloads. IT teams can manage MXC policies through Entra ID and Intune, while Defender and Purview provide protection and observability. The MXC framework is built on Microsoft's security initiatives, including Secure Boot and passwordless sign-in, allowing agents to inherit a secure foundation. However, early commentary expresses caution regarding MXC's perception as a comprehensive security solution, noting issues with overly permissive policies and the lack of outbound network filtering. Other platforms, such as Linux, are also enhancing security for agents with kernel-level isolation and secure environments like NVIDIA's OpenShell runtime. Various projects are focusing on agent sandboxes within Kubernetes, employing technologies like gVisor and Kata Containers for isolation. Overall, no singular dominant platform security model for AI agents has emerged, with Windows' MXC still considered nascent compared to existing solutions in Linux and Kubernetes ecosystems.

Tech Optimizer

June 13, 2026

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

On June 10th, Splunk released an advisory for CVE-2026-20253, a high-severity vulnerability with a CVSS score of 9.8 that requires no authentication. The vulnerability is associated with the PostgreSQL Sidecar Service Endpoint and affects Splunk Enterprise versions 10 and above. In default installations, the service is not installed on Windows but is installed and enabled by default on AWS. The vulnerability allows unauthorized users to create and truncate arbitrary files through an API that lacks authentication controls. Additionally, it enables the execution of SQL commands via a backup and restore mechanism, potentially leading to remote code execution (RCE). A Detection Artefact Generator has been developed to help organizations assess their vulnerability to this issue.

Winsage

June 10, 2026

Proton releases Proton Drive CLI for Windows, Mac, and Linux

Proton has released a new command-line interface (CLI) for Proton Drive, allowing users to manage encrypted files from a terminal on Windows, macOS, and Linux. The CLI includes features such as authentication via browser, uploading files while skipping existing ones, checking sharing status, and inviting collaborators to shared folders. Future updates will add capabilities for managing photos, sharing files through public links, creating custom albums, and switching between accounts. Installation on macOS and Linux involves downloading a pre-built binary or building from source. The release follows a significant performance upgrade of Proton Drive, which is now three times faster due to a unified Drive SDK that enhances cryptographic task execution and reduces battery drain on mobile devices.

AppWizard

June 8, 2026

NFCShare Android malware spreads via fake banking app updates on GitHub

New variants of the NFCShare Android malware are disguised as fake updates for legitimate banking applications and are targeting customers of various banks in Europe through a phishing campaign to steal sensitive payment card data. The malware prompts victims to place their cards near the NFC chip of their mobile devices, using Android’s IsoDep interface to read card information, including card number, type, expiry date, and a 4-digit PIN. The stolen data is exfiltrated to the attacker’s command-and-control host via a WebSocket channel. Recent attacks began on May 14, with victims directed to a phishing site that impersonates a legitimate bank and then to a GitHub repository hosting a malicious APK file. The repository has hosted 56 unique APKs impersonating banking applications primarily from Italy and Spain. The malware has evolved from initially targeting Deutsche Bank in Germany to a broader range of banks. The latest version features malformed APK packaging to complicate automated analysis. Users are advised to download banking applications only from Google Play and to be cautious of verification requests that ask for NFC card scans.

Tech Optimizer

June 6, 2026

PostgreSQL Dump and Restore: The Complete pg_dump Guide

pg_dump is a utility for exporting a PostgreSQL database into a file, which can be restored on the same or different servers. It exports a single database's tables, views, sequences, functions, indexes, triggers, and in-database grants but does not include roles, tablespaces, or server-level configurations. To capture global objects, pg_dumpall --globals-only should be executed prior to the per-database dump. pg_dump requires CONNECT and SELECT privileges on all tables and sequences within the target database, and a dedicated backup role is sufficient for single-database dumps, while superuser access is needed for global objects. pg_dump supports various output formats: plain SQL (.sql), custom binary (.dump), directory of files, and tar archive (.tar), each with different capabilities for restoration and compression. The custom format allows for selective and parallel restoration. For non-interactive use, credentials can be stored in a .pgpass file or passed via the PGPASSWORD environment variable. Restoration methods depend on the dump format: psql is used for plain SQL files, while pg_restore is used for custom and directory formats. The restoration process requires the target database to be created beforehand. Version mismatches between pg_dump and pg_restore can lead to failures, so it's essential to ensure that the binaries are version-matched. In Docker, pg_dump and pg_restore can be executed within containers, but care must be taken to manage credentials and ensure version compatibility. Exit codes from pg_dump should be checked to confirm successful operations.

BetaBeacon

May 28, 2026

The best Simpsons game just got (unofficially) ported to Android

A developer has created an Android port of The Simpsons: Hit & Run game, which requires the original game files to play. The port currently requires an external controller to play, but touch controls are being worked on. The game runs well on most phones from the last several years, and the developer has provided installation instructions on GitHub.

Winsage

May 8, 2026

Windows update is breaking backups, and here’s how you can fix it

A recent Windows update, KB5083769, released on April 14, 2026, blocks the psmounterex.sys driver, disrupting the functionality of third-party backup software like Acronis Cyber Protect Cloud, Macrium Reflect, and NinjaOne. This driver is essential for loading and mounting backup storage images. Users may encounter errors related to Microsoft VSS during backup attempts. The update is a security enhancement, not a bug, and users are advised to upgrade their backup software to versions that use a newer driver or temporarily uninstall the KB5083769 update. It is recommended to check for updates from the backup software provider and pause Windows Updates to prevent automatic reinstallation of the problematic update until a fix is available.

Tech Optimizer

May 3, 2026

TigerFS Mounts PostgreSQL As Transactional Filesystem

TigerFS is an open-source project introduced on April 4, 2026, by Michael Freedman, the CTO of TigerData. It allows users to mount a PostgreSQL database as a POSIX-like filesystem, storing database rows as individual files while ensuring ACID guarantees. Key features include an MIT license, support for both file-first and data-first workflows, mounting options using FUSE on Linux and NFS on macOS, and integration with standard Unix tools.

Tech Optimizer

April 26, 2026

CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister

On April 21, 2026, compromised versions of pgserve (1.1.11, 1.1.12, and 1.1.13) were published on npm, containing a 1,143-line credential-harvesting script that executes during the postinstall phase of npm install. The malware functions as a supply-chain worm, reinjecting itself into other packages if it finds an npm publish token. Stolen credentials are encrypted using RSA-4096 and AES-256 and exfiltrated to a decentralized Internet Computer Protocol (ICP) canister. The last legitimate release was v1.1.10, published on April 17, 2026. The malware was detected by StepSecurity AI Package Analyst and Harden Runner, which flagged the compromised versions as Critical / Rejected and confirmed live exfiltration during analysis. The injected script performs operations such as harvesting environment variables, collecting filesystem secrets, encrypting payloads, and propagating to other npm packages and Python packages if a PyPI token is detected. The exfiltration domains have been added to a global block list.

Winsage

April 18, 2026

RedSun: Windows 0day when Defender becomes the attacker

A vulnerability has been discovered in Windows Defender that allows standard users to exploit a logic error in the file remediation process, enabling code execution with elevated privileges without administrative access. This flaw, identified by security researcher Chaotic Eclipse, occurs because Windows Defender does not verify if the restoration location of flagged files has been altered through a junction point. The exploit, named RedSun, takes advantage of a missing validation in the MpSvc.dll file, allowing attackers to redirect file restoration to the C:WindowsSystem32 directory. RedSun operates by chaining together four legitimate Windows features: Opportunistic Locks (OPLOCKs), Cloud Files API, Volume Shadow Copy Service (VSS), and Junction Points. The execution of the exploit involves monitoring shadow copies, triggering Defender's detection, synchronizing OPLOCKs, and ultimately writing malicious binaries to the System32 directory. The root cause is the lack of reparse point validation in the restoration process, and currently, no patch or CVE has been assigned for this vulnerability. It affects Windows 10, Windows 11, and Windows Server 2019 and later, and organizations are advised to implement behavioral detection strategies until a fix is available.