NewApp Digest
search bot

initialization

Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign
Tech Optimizer
February 24, 2026

Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign

A cyber operation is targeting users of Huorong Security antivirus software through a typosquatted domain, huoronga[.]com, which mimics the legitimate site huorong.cn. Users who mistakenly visit the counterfeit site may download a file named BR火绒445[.]zip, which contains a trojanized installer that leads to the installation of ValleyRAT, a remote access trojan. The malware employs various techniques to evade detection, including using an intermediary domain for downloads, creating Windows Defender exclusions, and establishing a scheduled task for persistence. The backdoor facilitates activities such as keylogging and credential access while disguising its operations within legitimate processes like rundll32.exe. Attribution points to the Silver Fox APT group, and there has been a significant increase in ValleyRAT samples documented in recent months. Security measures include ensuring software downloads are from the official site and monitoring for specific malicious activities.
Why Windows 11 feels slower than Windows 10—and why it's not just in your head
Winsage
January 30, 2026

Why Windows 11 feels slower than Windows 10—and why it’s not just in your head

Windows 11 features a modern architecture with advanced schedulers and SSD support, but many users experience sluggishness, with delays in menus and dialog boxes. This perception of reduced responsiveness compared to Windows 10 has been linked to the use of XAML, which modernizes traditional desktop components but introduces performance issues due to added abstraction layers. Disabling animations does not resolve the delays, which are attributed to XAML's reliance on GPU acceleration for simple tasks, leading to inefficiencies. The cumulative effect of these micro-delays, measured in milliseconds, contributes to an overall feeling of sluggishness, regardless of high-end hardware. Microsoft's design choices prioritize visual consistency and modern UI technology, resulting in trade-offs in everyday responsiveness. The slower perception of Windows 11 compared to Windows 10 is rooted in these deliberate technical decisions.
AlloyDB managed connection pooling
Tech Optimizer
January 26, 2026

AlloyDB managed connection pooling

AlloyDB for PostgreSQL is a fully managed database service designed for enterprise workloads, combining PostgreSQL's strengths with Google Cloud technology for enhanced performance, scalability, and availability. A new feature, managed connection pooling, addresses the challenges of inefficient database connection management, which can lead to performance degradation, resource exhaustion, and reliability issues. Managed connection pooling maintains a cache of active database connections, allowing applications to reuse connections instead of creating new ones for each request, thus reducing latency and resource consumption. This feature is tightly integrated into AlloyDB, simplifying operations and optimizing performance and security. It offers two configurable pooling modes: transaction mode, which maximizes reuse for short transactions, and session mode, which maintains a connection for the entire session. Enabling managed connection pooling can increase transactions per minute by up to five times, support over three times more concurrent connections, decrease connection latency, and improve reliability during traffic spikes. UKG, a provider of HR solutions, has adopted this feature to enhance the performance and scalability of their applications. To enable managed connection pooling, users can activate it in the Google Cloud console and connect applications using standard PostgreSQL drivers to the designated port.
Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems
Tech Optimizer
December 3, 2025

Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

A malicious Rust package named "evm-units," uploaded by a user called "ablerust" to crates.io in mid-April 2025, poses a significant threat to developers on Windows, macOS, and Linux. It has over 7,000 downloads and is designed to execute its payload stealthily, depending on the victim's operating system and the presence of Qihoo 360 antivirus. The package disguises itself as a function that returns the Ethereum version number and can detect Qihoo 360 antivirus software. It downloads and executes different payloads based on the operating system: a script for Linux, a file for macOS, and a PowerShell script for Windows. If the antivirus is not detected, it creates a Visual Basic Script wrapper to run a hidden PowerShell script. The package targets the Web3 community, particularly developers, and is linked to the widely used "uniswap-utils" package. Both "evm-units" and "uniswap-utils" have been removed from the repository.
I gave Windows Command Prompt the "Pimp my Ride" treatment and it's so much fun now
Winsage
November 16, 2025

I gave Windows Command Prompt the “Pimp my Ride” treatment and it’s so much fun now

Oh My Posh is a customization tool for command-line interfaces that allows users to enhance their terminal experience by displaying relevant information, such as Git repository status and real-time updates from applications like Spotify. To set it up, users need to customize their Color Scheme in the Windows Terminal and install a Nerd Font for displaying glyphs. The installation of Oh My Posh can be initiated with the command PLACEHOLDER5dee3f180dc01d05, and users can verify the installation by running PLACEHOLDERc79b60db6f07f844. To further enhance the terminal, users can install Winfetch with the command Install-Script -Name pwshfetch-test-1 and add an alias for easy access to system stats. Overall, Oh My Posh provides flexibility for users to tailor their terminal to their workflows and preferences.
Microsoft raises the security standard for next major Windows Server release - Microsoft Windows Server Blog
Winsage
November 10, 2025

Microsoft raises the security standard for next major Windows Server release – Microsoft Windows Server Blog

Microsoft plans to elevate the security standards for Windows Server hardware certification in its next major release, mandating that TPM 2.0 is installed and enabled by default and that Secure Boot is activated by default on systems pre-installed with the upcoming Windows Server. These requirements will apply to all servers running Windows Server, including bare metal setups, virtual machines on Hyper-V, and third-party hypervisors approved through the Server Virtualization Validation Program (SVVP). Secure Boot ensures that only trusted operating systems are loaded during the boot process, mitigating risks from malware. TPM 2.0 provides hardware support for secure measurements and key storage, enhancing security further by allowing secure capture and storage of the boot sequence. BitLocker leverages TPM 2.0 to ensure volumes are decrypted only if the system booted correctly. The enforcement of these requirements will apply to new server platforms introduced after January 1, 2021, while existing platforms will receive Additional Qualification certification to help customers identify compliant systems.
New GDI Flaws Could Enable Remote Code Execution in Windows
Winsage
November 3, 2025

New GDI Flaws Could Enable Remote Code Execution in Windows

A series of vulnerabilities within the Windows Graphics Device Interface (GDI) has been discovered, potentially allowing for remote code execution and information disclosure. These vulnerabilities are linked to malformed enhanced metafile (EMF) and EMF+ records, leading to memory corruption during image rendering. Three specific vulnerabilities were analyzed and included in Microsoft's Patch Tuesday updates released in May, July, and August of 2025. They are cataloged as: - CVE-2025-30388: Rated important and more likely to be exploited. - CVE-2025-53766: Rated critical, enabling remote code execution. - CVE-2025-47984: Rated important, associated with information disclosure. All three involve out-of-bounds memory access triggered by crafted metafiles. Microsoft has released patches for GdiPlus.dll and gdi32full.dll to address these vulnerabilities, including validation checks and corrections in memory handling. These vulnerabilities also affect Microsoft Office for Mac and Android platforms.
Microsoft frightful Patch Tuesday: 175+ CVEs, 3 under attack
Winsage
October 15, 2025

Microsoft frightful Patch Tuesday: 175+ CVEs, 3 under attack

Microsoft's October Patch Tuesday addressed 175 vulnerabilities, including 21 non-Microsoft CVEs. Among these, three vulnerabilities are under active attack: 1. CVE-2025-24990: An elevation of privilege bug in the Agere Modem driver (rated 7.8) that allows attackers to gain administrator privileges on supported Windows versions. The driver has been removed in the update. 2. CVE-2025-59230: An elevation of privilege vulnerability in the Windows Remote Access Connection Manager (rated 7.8) that could grant SYSTEM privileges to attackers. 3. CVE-2025-47827: A Secure Boot bypass flaw (rated 4.6) in the IGEL OS that allows attackers to bypass Secure Boot. Three publicly known vulnerabilities include: 1. CVE-2025-0033: A critical vulnerability affecting AMD EPYC processors with SEV-SNP, requiring a patch that is still in development. 2. CVE-2025-24052: An elevation of privilege vulnerability in the Agere Modem driver (rated 7.8) that is publicly known but not yet exploited. 3. CVE-2025-2884: An out-of-bounds read vulnerability in the TCG TPM2.0 reference implementation's CryptHmacSign function. Additionally, 16 other critical-severity flaws were highlighted, including CVE-2025-59287, a 9.8-rated vulnerability in Windows Server Update Services that allows unauthenticated remote attackers to trigger unsafe object deserialization, leading to remote code execution. Adobe released 12 updates for 36 vulnerabilities, including critical CVEs in Substance 3D Stager, Dimension, Illustrator, and FrameMaker. SAP issued 13 new security notes, with four rated critical, including a fix for an OS command execution flaw in Netweaver. Ivanti provided advisories for vulnerabilities in Endpoint Manager Mobile and Neurons for MDM, which have not yet been exploited.
Search