infrastructure Archives

Winsage

May 1, 2026

Windows shell spoofing vulnerability puts sensitive data at risk

Erik Avakian, a technical counselor at Info-Tech Research Group, discussed the patching deadlines set by the Cybersecurity and Infrastructure Security Agency (CISA) under Binding Operational Directive (BOD) 22-01, which requires U.S. federal agencies to address vulnerabilities within 14 to 21 days. CISA can expedite patching to as little as three days for high-risk exploits. The vulnerability CVE-2026-32202, rated 4.3 on the Common Vulnerability Scoring System (CVSS), was actively exploited but did not qualify for an urgent patch cycle, resulting in a 14-day deadline. Avakian noted the debate over whether this timeframe is sufficient, suggesting that Microsoft’s rating and other factors influenced the decision not to escalate to an emergency directive requiring a 48 to 72-hour response.

Tech Optimizer

May 1, 2026

Ghost: A Database for Our Times?

Ghost, developed by ghost.build, is an "agent-first" Postgres database platform designed for AI-related applications, allowing developers and AI agents to create, fork, inspect, query, manipulate, and delete databases easily. It is free to use and hosted on Ghost’s Cloud infrastructure, making it suitable for testing, prototyping, and disposable database environments. Users can create databases on demand, execute SQL queries, and discard them when finished, contrasting with traditional managed databases. Ghost integrates with AI tools like Codex and Claude Code, providing direct database management capabilities through its MCP server. To install Ghost, users need a supported coding agent and a GitHub account. Installation commands differ for Linux, macOS, and Windows. After installation, users can verify the Ghost MCP server and interact with it through their coding agents. Examples of using Ghost include creating a sales data database, utilizing Ghost CLI commands, and experimenting with databases through AI agents. Ghost allows for rapid database manipulation and is ideal for proofs of concept and experimentation, although caution is advised before using it for production data.

Tech Optimizer

May 1, 2026

Backstage Ditches Postgres for Databricks Lakebase

The divide between operational and analytical databases is diminishing, as evidenced by Databricks integrating Spotify's Backstage with its Lakebase, transitioning from PostgreSQL to a unified data platform. Lakebase now offers a serverless PostgreSQL interface within Databricks, allowing Backstage to operate without awareness of the underlying changes. The integration involved updating configurations and addressing authentication challenges using OAuth JWTs. The integration transforms the database development lifecycle by enabling near-instant database branching through Lakebase's copy-on-write architecture, allowing developers to focus on testing changes rather than safety. Branching creates a pointer to existing data, making the operation instantaneous. Point-in-Time Recovery (PITR) allows for quick restoration of data, demonstrated by a recovery process that took less than four seconds. The goal is to integrate database branching into developer workflows seamlessly, making it automatic. This change could enhance developer productivity by allowing live data testing from the start, eliminating the need for mock objects, and resolving common issues related to staging environments. The traditional constraints of slow and costly database copies will become obsolete, prompting teams to reconsider how much time they spend on workarounds for now-nonexistent constraints.

AppWizard

April 30, 2026

LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection

Minecraft players are being targeted by a deceptive hacking tool called “Slinky,” which is actually an infostealer known as LofyStealer linked to the Brazilian cybercrime group LofyGang. The malware uses a Node.js-based loader and a C++ payload to extract sensitive browser data, disguising itself as a Minecraft hack. It primarily targets younger players who may unknowingly execute it. The malware operates through a two-stage architecture, with a 53.5 MB loader binary that injects a smaller 1.4 MB payload into browser processes, bypassing detection methods. It collects sensitive information such as cookies, passwords, and credit card details, compressing and encoding the data for exfiltration. The command-and-control (C2) infrastructure is hosted in Brazil, and the malware's design reflects advanced compilation techniques. The campaign is attributed to LofyGang, which has evolved into a more professional entity, posing severe risks to players who download cheats and cracked tools. Indicators of compromise include a specific C2 IP address and associated endpoints.

Tech Optimizer

April 30, 2026

Inside the Architecture of an MCP Server for PostgreSQL

The Model Context Protocol (MCP) serves as a standard interface between large language models (LLMs) and external systems like PostgreSQL, emphasizing the importance of control over mere connectivity. An MCP server must act as a mediation and policy layer, enforcing security boundaries and ensuring that connections default to read-only. It should validate AI-generated SQL as untrusted input, encapsulate queries within transactions, and apply execution-time controls. The server must separate query generation from execution approval to manage operational costs and enforce guardrails on query types, such as limiting the number of rows returned. Token efficiency is crucial, with design considerations for compact data representation and schema introspection. In production, connection management is vital to prevent data leakage among multiple AI agents, and observability through logging executed queries and metadata is necessary for debugging and compliance. Long-running sessions require support for paginated responses to manage context effectively. Overall, the MCP server must integrate security, query safety, token efficiency, and observability into its design from the outset.

AppWizard

April 29, 2026

New Android spyware Morpheus linked to Italian surveillance firm

Morpheus is a new spyware identified by the nonprofit organization Osservatorio Nessuno, which spreads through counterfeit Android applications that appear as legitimate updates. Attackers use SMS messages to direct victims to a fraudulent website mimicking an Internet Service Provider (ISP). The spyware installs a dropper app that deploys a concealed payload, which disguises itself as legitimate system components and manipulates users into granting dangerous permissions, including Accessibility access. Once granted, Morpheus initiates a Permission Workflow that creates a fake update overlay, disabling the touchscreen to prevent user interaction. It ensures persistence by restarting after device reboots and can request device administrator privileges. The spyware exploits overlay windows and Accessibility features to gain control of the device and bypass security measures, including disabling antivirus solutions without requiring root access. Analysis suggests Morpheus has Italian origins, with connections to an Italian firm, IPS Intelligence, known for lawful interception technologies. The spyware is capable of invasive actions such as recording audio and video, linking to WhatsApp, and compromising device security. The report highlights a network of dubious companies and shared contacts linked to the spyware's distribution.

Winsage

April 28, 2026

I investigated Windows 11’s massive 5GB monthly .msu updates. AI is only part of the problem.

Windows 11 updates have significantly increased in size, with monthly cumulative updates often exceeding 4GB and some approaching 5GB. One update can expand to nearly 9GB when extracted. Microsoft has shifted to delivering Latest Cumulative Updates (LCUs), which include all previous fixes, leading to larger update sizes over time. The introduction of Checkpoint Cumulative Updates aims to reduce this growth by establishing periodic baselines, but the effectiveness has been mixed. The May 2025 cumulative update saw a size increase from approximately 6.5GB to nearly 9GB, with new MSIX files related to semantic search and on-device AI contributing to this growth. Windows Update uses applicability logic to minimize download sizes for users, but enterprises must download full packages, resulting in increased storage costs. The average yearly storage cost for enterprises rose from about 11 GB in 2024 to 52 GB by 2026. Users can check their actual download sizes through the Windows Update settings and Event Viewer logs.

Tech Optimizer

April 28, 2026

Constructive Open Sources Agentic DB, the Postgres Memory Layer for AI Agents

Constructive has released agentic-db, an open-source Postgres database aimed at improving AI agents with features like persistent memory, structured knowledge, and hybrid retrieval. This database allows for efficient searching, filtering, and ranking of information, addressing inefficiencies associated with traditional markdown file storage. Key features of agentic-db include long-term memory, conversation tracking, a versioned registry for skills and tools, rules and policies for governance, task orchestration, and runtime observability. It is delivered as a single installable Postgres schema, indexed for multiple retrieval modes, and supports integration with various AI assistants through generated Agent Skills and CLIs. agentic-db is available under the MIT license for local use, with a cloud offering in development for secure, scalable solutions. Developers can access it on npm and GitHub.

Tech Optimizer

April 27, 2026

The Best Internet Security Solutions Out There Right Now

Mysterium VPN offers a decentralized infrastructure with over 7,500 residential IPs across 100 countries, ensuring user privacy without requiring contributions of personal IPs. It features DNS and IP leak protection, a kill switch, ChaCha20 encryption, and a no-logs policy, complying with GDPR. Mysterium supports up to 15 devices simultaneously and is priced at .59 per month with a 7-day money-back guarantee. Bitdefender Total Security provides comprehensive antivirus protection, including malware detection, ransomware protection, firewall management, and device optimization tools, along with webcam protection and anti-phishing features. Kaspersky Premium delivers real-time antivirus protection, identity theft monitoring, secure payment tools, and parental controls, maintaining high threat detection capabilities. Proton VPN, based in Switzerland, emphasizes privacy and transparency, offering a solid free tier and premium features like Secure Core routing, although its speeds may vary. Malwarebytes Premium focuses on detecting newer or less common threats, evolving from a malware removal tool to a comprehensive security platform. Avast One integrates antivirus protection, VPN services, and performance optimization tools, providing identity monitoring and breach alerts, while working to enhance transparency after past scrutiny. 1Password specializes in secure password storage, generation, and autofill capabilities, along with features to alert users to compromised credentials and secure document storage.

Tech Optimizer

April 27, 2026

Why developers are betting on Postgres for AI

Organizations are intensifying the development of AI applications and agents, which rely on access to existing enterprise data to avoid inaccuracies in responses, a phenomenon known as "hallucination." Jensen Huang, CEO of Nvidia, and Phillip Merrick, co-founder of pgEdge, emphasize that structured data is essential for AI effectiveness. PostgreSQL is highlighted as a preferred database for AI applications, with 66% of respondents in the Stack Overflow 2025 Developer Survey indicating they wish to continue using it. Merrick notes PostgreSQL's advantages, including its open-source model, scalability, and ability to handle both structured and unstructured data. The pgEdge toolkit supports the entire lifecycle of AI application development, including document ingestion and vector embedding generation. PostgreSQL offers deployment flexibility and robust security features, making it suitable for critical sectors like finance and healthcare.