NewApp Digest
search bot

kernel

I spent an entire day with a fan-mod of North Korea's homegrown operating system, and I'm sorry to say it's not a Windows killer yet
Winsage
June 20, 2026

I spent an entire day with a fan-mod of North Korea’s homegrown operating system, and I’m sorry to say it’s not a Windows killer yet

RedStar OS 3.0 is a national Linux distribution from North Korea, designed primarily for the DPRK's intranet, Kwangmyong. The modified version, RedStar OS 3.5, claims to enhance the original by removing spyware and providing easier access to root privileges. The author faced challenges in accessing the system, implementing a 64-bit kernel, and connecting to the broader internet due to the OS's limitations. Attempts to run the game Tux Racer were unsuccessful due to compatibility issues, resulting in a system with only basic applications available. The overall experience highlighted the shortcomings of RedStar OS 3.5 in terms of practical usability, especially for gaming.
Windows Platform Security and the Race to Secure AI Agents
Winsage
June 19, 2026

Windows Platform Security and the Race to Secure AI Agents

Microsoft has introduced the Microsoft Execution Containers (MXC) SDK to establish Windows as a reliable operating system for autonomous agents, focusing on containment, identity, and manageability. The MXC framework serves as a policy-driven execution layer for agents on Windows and Windows Subsystem for Linux (WSL), allowing developers to set access permissions using JSON or TypeScript. It employs process and session isolation for agent containment and identity. Future enhancements will include micro-VM support for high-risk tasks and integration with Windows 365 for cloud PC workloads. IT teams can manage MXC policies through Entra ID and Intune, while Defender and Purview provide protection and observability. The MXC framework is built on Microsoft's security initiatives, including Secure Boot and passwordless sign-in, allowing agents to inherit a secure foundation. However, early commentary expresses caution regarding MXC's perception as a comprehensive security solution, noting issues with overly permissive policies and the lack of outbound network filtering. Other platforms, such as Linux, are also enhancing security for agents with kernel-level isolation and secure environments like NVIDIA's OpenShell runtime. Various projects are focusing on agent sandboxes within Kubernetes, employing technologies like gVisor and Kata Containers for isolation. Overall, no singular dominant platform security model for AI agents has emerged, with Windows' MXC still considered nascent compared to existing solutions in Linux and Kubernetes ecosystems.
NVIDIA's RTX Spark launch is huge, but Qualcomm and Microsoft built the Windows ARM foundation
Winsage
June 17, 2026

NVIDIA’s RTX Spark launch is huge, but Qualcomm and Microsoft built the Windows ARM foundation

Qualcomm announced the Snapdragon X Elite in 2023, an ARM-based processor that outperformed traditional x86 processors. The Snapdragon X Series featured a custom Oryon core design and was optimized for Windows through collaboration with Microsoft, including the introduction of the Prism emulation layer, which allows x86/x64 applications to run on ARM. Many applications, such as Adobe Illustrator and Discord, now run natively on ARM, showing significant performance improvements. By 2026, NVIDIA unveiled the RTX Spark, an ARM-powered system on a chip, developed with MediaTek, featuring an ARM Cortex CPU and a Blackwell RTX GPU. NVIDIA also announced improvements to Windows for better workload scheduling and support for kernel-level anti-cheat software on Windows ARM.
Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities
Winsage
June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.
A Brief History Of Unix Commands On Windows: CoreUtils (Again)
Winsage
June 16, 2026

A Brief History Of Unix Commands On Windows: CoreUtils (Again)

The interaction between Unix/Linux and Windows has historically been marked by significant differences in their architectures and philosophies. Unix uses a fork() function for process management, while Windows employs CreateProcess(), complicating the implementation of Unix-like tools on Windows. Early solutions to bridge this gap included the MKS Toolkit, which provided Unix-like commands for Windows, and UWIN from AT&T Bell Labs, which aimed to create a Unix interface layer on Windows. Cygwin offered a compatibility DLL to run Unix software on Windows, but required rebuilding from source. Microsoft's initiatives included POSIX, Interix, and later Services for UNIX. The introduction of the Windows Subsystem for Linux (WSL) allowed users to run a Linux userland directly on Windows, with WSL 2 incorporating a real Linux kernel. Recently, Microsoft released Coreutils for Windows, providing native builds of Unix-style tools to enhance cross-platform consistency.
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
Linux 7.2 To Better Communicate File-System Casefolding For Helping Windows NFS & More
Winsage
June 15, 2026

Linux 7.2 To Better Communicate File-System Casefolding For Helping Windows NFS & More

The Linux 7.2 kernel has introduced enhancements for reporting case-folding behavior in local file systems, allowing file servers to accurately convey their case sensitivity capabilities. Linus Torvalds merged Virtual File System (VFS) related pull requests that enable local file systems to report case-folding behavior, benefiting services like NFSD and KSMBD, particularly for Microsoft Windows NFS clients. Filesystems can now report case-insensitive and case-nonpreserving behavior through new filekattr flags in their fileattrget implementations. Supported filesystems include FAT, exFAT, NTFS3, HFS, HFS+, XFS, CIFS, NFS, VBoxSF, and ISOFS, with others defaulting to POSIX behavior. NFSd uses this information to report case folding via NFSv3 PATHCONF and implement NFSv4 attributes for case insensitivity and case preservation. The enhancements aim to improve interoperability, allowing Windows NFS clients to function correctly by reporting case-insensitivity, which streamlines operations and avoids unnecessary requests. The Linux NFS client has previously supported case-insensitive shares, requiring adjustments to caching behavior. Accurate case folding reporting is crucial for servers operating in multi-protocol environments to maintain interoperability.
Microsoft patches a record 206 flaws—and one is already being exploited
Winsage
June 11, 2026

Microsoft patches a record 206 flaws—and one is already being exploited

Microsoft patched 206 vulnerabilities during June's Patch Tuesday, surpassing the previous record of 175 vulnerabilities patched in October 2025. Among the patched vulnerabilities, 118 are related to different versions of Windows, including Windows 10, Windows 11, and Windows Server. One critical vulnerability, CVE-2026-41091, in Microsoft Defender is actively being exploited, prompting an update to the Malware Protection Engine. Microsoft also addressed ten vulnerabilities in the Security Feature Bypass category due to the expiration of old Secure Boot certificates. Of the 118 Windows vulnerabilities, 19 are classified as critical Remote Code Execution (RCE) vulnerabilities, including CVE-2026-47288 and CVE-2026-47291. In Microsoft Office, 54 vulnerabilities were patched, including 25 RCE vulnerabilities, with nine classified as critical. Microsoft patched eight vulnerabilities in Exchange Server, including CVE-2026-45583, which can be exploited in a man-in-the-middle scenario. Additionally, the update for Edge addressed 74 Chromium vulnerabilities, including a zero-day vulnerability (CVE-2026-11645).
ReactOS Runs Half-Life Natively: Open-Source Windows NT Clone Clears 3D Graphics Bar
Winsage
June 11, 2026

ReactOS Runs Half-Life Natively: Open-Source Windows NT Clone Clears 3D Graphics Bar

ReactOS has successfully executed Valve's original Half-Life on consumer hardware, marking a significant milestone in open-source software development. This achievement was announced on June 10, 2026, after three decades of effort to reimplement Microsoft Windows. The game was run on a Dell OptiPlex desktop with an Intel Core i5 2400 processor and an NVIDIA GeForce 8400GS graphics card, demonstrating ReactOS's capability to handle real-time 3D applications without compatibility shims. ReactOS operates independently from Microsoft, sharing no code, and can execute a real-time 3D graphics workload natively. It has achieved approximately 90 percent GPU driver compatibility for Windows XP and Server 2003-era hardware through the implementation of the Kernel-Mode Driver Framework and Windows Display Driver Model subsystems. ReactOS is still in alpha stage, with limitations in application support and driver gaps for modern hardware. The project is working towards a new release, version 0.4.16, to enhance user experience.
Search