kernel Archives

Winsage

August 27, 2025

Happy birthday Windows 95: the system that changed PCs forever!

On August 24, 2025, the 30th anniversary of Windows 95 was marked. Windows 95 was Microsoft’s first mass-market 32-bit consumer operating system, which sold one million copies in the first four days and approximately 40 million within a year. It aimed to unify MS-DOS and Windows into a single user experience with low minimum requirements: a 386DX processor, 4 MB of RAM, and 50-55 MB of disk space. Key innovations included the Start button, a unified interface, a full 32-bit Win32 API, and multitasking support for software from three generations. Official support for Windows 95 ended in December 2001, but its influence persists in modern operating systems. The launch featured the Rolling Stones’ song “Start Me Up,” which became iconic in tech marketing, despite initial challenges in securing the rights. The advertising campaign included celebrity appearances and contributed to Windows 95's cultural phenomenon status.

Winsage

August 23, 2025

Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection

A new method allows attackers to extract Windows secrets and credentials without being detected by most Endpoint Detection and Response (EDR) solutions. This technique enables individuals with access to a Windows machine to gather credentials for lateral movement within a network. The Local Security Authority (LSA) manages sensitive information through two in-memory databases: the SAM database, which stores user credentials, and the Security database, which holds LSA secrets. Access to these databases requires interaction with the SAM and SECURITY registry hives, protected by Discretionary Access Control Lists (DACLs) that limit access to SYSTEM privileges. Attackers typically face detection when accessing the lsass.exe process memory, as EDR solutions monitor high-risk activities. Researcher Sud0Ru has introduced a method that bypasses these defenses by using the undocumented API NtOpenKeyEx with the REGOPTIONBACKUPRESTORE flag, allowing attackers to read the SAM and SECURITY hives without SYSTEM-level privileges. To avoid detection, attackers use the RegQueryMultipleValuesW API, which is less monitored by EDRs, to extract encrypted secrets from the hives. This approach allows the operation to occur entirely in memory, leaving no on-disk artifacts and evading typical security alerts.

Tech Optimizer

August 23, 2025

How to load test PostgreSQL database and not miss anything

Practitioners face challenges during load testing of Tantor Postgres databases using pgbench, primarily due to insufficient documentation of the testing environment, leading to non-representative results and the need for repeated tests. The pg_perfbench tool has been developed to address these issues by ensuring repeatability, safeguarding data, and simplifying result comparisons through a cohesive template. It automates pgbench execution, collects metadata about the testing environment, and generates structured reports. pgbench operates on a TPC-B model, providing performance metrics such as transactions per second (tps), average latency, and the number of processed and failed transactions. A Bash script can be used to automate pgbench tests with varying client numbers, logging results into separate files. The pg_perfbench tool captures extensive data regarding the database environment and generates reports that include system properties, common database information, benchmark details, and test results. It facilitates the comparison of multiple load test results and ensures that environments being compared are consistent in terms of PostgreSQL versions and system parameters. The tool also allows for the evaluation of performance impacts from changes to PostgreSQL settings by generating separate reports for different configurations. It verifies compliance of specified parameters before joining reports, ensuring accurate comparisons. The final reports are structured in JSON and HTML formats, enhancing analysis and collaboration efforts.

Winsage

August 18, 2025

Windows 11 Latest Update: More Critical Issues Now Emerging, Report Claims

The Windows 11 update (KB5063878) released on August 12 has caused significant issues, particularly with solid-state drives (SSDs) failing after large data writes. Initially, installation errors were reported mainly among enterprise users, but concerns have since spread to home users as well. An emergency update was issued to address the problems. Users have experienced SSDs becoming non-functional during substantial file transfers, with reports of drives disappearing from the operating system and SMART data becoming unreadable. Experts suggest the failures may be linked to a storage driver or kernel-level regression in the update that mishandles long sequential writes, potentially causing controller lock-ups. Users are advised to avoid long sequential write operations, especially on affected drives.

AppWizard

August 18, 2025

Steam’s new Performance Overlay is more accurate than Task Manager, says Valve — GPU utilization monitoring comes directly to Steam in latest client beta

Valve's latest Steam Client Beta enhances GPU monitoring capabilities, providing more accurate utilization readings compared to the Windows Task Manager, which often under-reports GPU usage. The updated in-game overlay captures all related processes, reducing sampling errors and aligning statistics with third-party tools like MSI Afterburner. It aggregates GPU usage across multiple processes, offering a comprehensive view of a game's GPU demands. The overlay also distinguishes between native frames and those generated by technologies like DLSS and FSR, and provides real-time readings of CPU load, RAM usage, clock speeds, and frame timing graphs. Additionally, it includes a CPU temperature display on both Windows and Linux, enabled by a trusted CPUID-derived kernel driver. Users are cautioned about the stability of the updated GPU metrics, as this feature is currently in beta and may not be suitable for general use.

Winsage

August 18, 2025

Microsoft’s Windows Update ‘Failure’—Do Not Save These Files

Microsoft's recent Windows 11 update has been linked to multiple SSD failures, particularly during large data writes, causing drives to become non-functional. Users have reported that affected drives "disappear from the OS," making SMART data unreadable, and leading to potential file corruption due to a suspected malfunction in the drive cache. SSDs with over 60% usage may be particularly susceptible after about 50GB of continuous writing, with issues also observed in some HDDs. SSDs utilizing Phison NAND controllers, especially DRAM-less models, are noted to be more prone to these problems. The affected SSDs include Corsair Force MP600, Phison PS5012-E12 controller-equipped SSD, KIOXIA EXCERIA PLUS G4, Fikwot FN955, and SanDisk Extreme PRO M.2 NVMe 3D SSD. The root cause may be a storage driver or kernel-level regression introduced with the update, which mishandles long sequential writes. Users are advised to avoid executing long sequential write operations until Microsoft provides official guidance.

AppWizard

August 18, 2025

My favorite new desktop buddy on Steam is a cat that goes fishing

Fischer's Fishing Journey is a virtual game featuring a cat named Fischer who enjoys fishing. Players can engage in fishing adventures with charming visuals and changing backgrounds throughout the day. The game includes surprise catches and serves as both a desktop wallpaper and an idle game. It is available on Steam for a modest price.

Winsage

August 17, 2025

Windows 11’s Latest Security Update Is Reportedly Causing Several SSD Failures When Writing a Large Number of Files at Once

The latest Windows 11 update, specifically the 'KB5063878' security update, has caused significant issues for solid-state drives (SSDs) with Phison controllers, rendering them non-functional after large data writes. Users have reported that after approximately 50GB of continuous writing, the operating system fails to recognize the SSD, making the drive's partition inaccessible upon reboot. Affected SSD models include Corsair Force MP600, Phison PS5012-E12, KIOXIA EXCERIA PLUS G4, Fikwot FN955, and SanDisk Extreme PRO M.2 NVMe 3D SSD. Preliminary analysis suggests that a storage driver or kernel-level regression introduced with the update may be mishandling long sequential writes, leading to controller lock-ups. Users are advised to avoid long sequential write operations, especially if their drives are among those listed or utilize Phison controllers.

AppWizard

August 14, 2025

Surge in Android Malware Targets Banking Apps with NFC Fraud

A new wave of Android malware is targeting banking applications, utilizing techniques such as NFC relay fraud, call hijacking, and root-level exploits. Variants like PhantomCard, SpyBanker, and KernelSU are designed to infiltrate devices and manipulate transactions in real time. PhantomCard mimics legitimate NFC payment processes, SpyBanker hijacks calls from financial institutions, and KernelSU exploits kernel vulnerabilities for persistent access. This malware has affected thousands of devices, with attackers using disguises on the Google Play Store and phishing campaigns. A related variant, Anatsa, impacted over 90,000 users through fake PDF applications. The rise of such malware correlates with the increasing adoption of contactless payments, particularly in Europe and Asia. Experts recommend that banks enhance their defenses with behavioral analytics and that users enable app verification. Additionally, malware like KernelSU allows evasion of detection by operating at the system's core. Cybersecurity firms suggest a multi-layered security approach, including device encryption and AI-driven threat detection, to combat these evolving threats.

AppWizard

August 13, 2025

Battlefield 6 open beta won’t run if you have Valorant installed, thanks to Riot’s anti-cheat — uninstall if you plan to joint the second open beta this weekend

EA will launch a free open beta for Battlefield 6 from August 14 to August 17, featuring the new "Empire State" map and introducing Rush and Squad deathmatch modes. Players can earn free rewards during the beta. However, players with Valorant installed may face issues launching Battlefield 6 due to a "security violation" error caused by Riot Games' anti-cheat software, Riot Vanguard, which operates at the kernel level. This integration can lead to conflicts between the two games' anti-cheat systems, prompting players to uninstall Valorant to avoid compatibility issues.