leak Archives

AppWizard

May 26, 2026

Google ranks the best AI for building Android apps, and the winner isn’t Gemini

Google launched the Android Bench benchmarking portal in March to help software developers evaluate AI models for Android app development. The leaderboard was updated last week to include open-weight models and new metrics for latency, tokens, and cost. Matthew McCullough, Google's VP of Product for Android Development, stated that the goal is to provide a benchmark for evaluating large language models (LLMs) in Android development. As of May 18, GPT 5.5 is the top AI model for Android app development, with Gemini 3.1 Pro and GPT 5.4 ranked as joint leaders. Android Bench evaluates LLMs based on real-world challenges and tasks sourced from public GitHub repositories. Other benchmarking tools in the Android ecosystem include Jetpack Microbenchmark, Jetpack Macrobenchmark, Firebase Performance Monitoring, Android Vitals, Apptim, and Android Performance Analyzer. The overall benchmark score on Android Bench is calculated using four core values: Confidence Interval Range, Average Latency Score, Average Total Tokens Score, and Average Cost. The test harness for Android Bench is publicly available on GitHub.

BetaBeacon

May 22, 2026

AYANEO gives us a first official look at its Game Boy-like Pocket BLOCK

AYANEO has unveiled the KONKR Pocket BLOCK handheld, a pocket-friendly vertical device with a Game Boy-style design. It features a microSD card slot, a 3.5mm port, and will be available in grey and purple colors. The device is expected to be more affordable and compact, making it an attractive option for those looking for a pocket-friendly Android handheld.

Tech Optimizer

May 22, 2026

Threat Protection Pro: all you need to know about IPVanish’s anti-malware tool

Virtual Private Networks (VPNs) have evolved into comprehensive cybersecurity solutions, offering features like ad-blockers, antivirus software, and dark web monitoring. IPVanish offers a feature called Threat Protection Pro, available with the Advanced plan, which protects against malware, ads, and trackers. It enhances online security by blocking ads and tracking scripts, quarantining suspicious downloads, and preventing access to malicious websites. All IPVanish plans include core Threat Protection, utilizing DNS filters to combat trackers and malware across various platforms. Threat Protection Pro, launched in March 2026, provides 24/7 malware and antivirus protection, even when the VPN is not active. This feature is exclusive to Advanced-tier subscribers and currently supports Windows and Mac platforms. It employs VIPRE’s antivirus engine and initiates detailed measures to identify risks at multiple levels. Users can activate Threat Protection Pro through a straightforward setup process on Windows or MacOS. IPVanish allows unlimited devices per subscription and includes DNS and IPv6 leak protection, a kill switch, and a no-logs policy. Advanced users also have access to a Secure Browser for disposable browsing.

Tech Optimizer

May 20, 2026

PoC Exploit Released for 20-Year Old PostgreSQL RCE Vulnerability

A proof-of-concept exploit has been developed for CVE-2026-2005, a remote code execution vulnerability in the pgcrypto extension of PostgreSQL. This vulnerability, stemming from legacy code, allows attackers to trigger a heap-based buffer overflow through specially crafted PGP messages, enabling arbitrary memory read and write operations. Successful exploitation can escalate privileges to PostgreSQL superuser status and execute commands on the operating system. The exploit targets PostgreSQL instances compiled from a specific vulnerable commit and circumvents protections like Address Space Layout Randomization (ASLR). It involves corrupting heap memory structures, leading to a controlled pointer leak that reveals the heap layout. Security researcher Varik Matevosyan has published the PoC on GitHub, demonstrating the exploitation process. The exploit requires a compatible PostgreSQL binary and utilizes Python-based tools for interaction. Organizations are advised to review their PostgreSQL deployments, disable unnecessary extensions, and apply security updates to mitigate risks.

Tech Optimizer

May 19, 2026

20-Year-Old PostgreSQL Flaw Gets Public PoC Exploit for Remote Code Execution

A proof-of-concept exploit for CVE-2026-2005 has been released, highlighting a significant vulnerability in the PostgreSQL pgcrypto extension that allows for remote code execution (RCE). This flaw, rooted in legacy code for nearly 20 years, enables attackers to escalate privileges and execute arbitrary commands on compromised servers. The vulnerability is found in the PGP session key parsing logic of the pgcrypto module and involves a heap-based buffer overflow, granting attackers arbitrary read and write access to memory. The exploit, shared by researcher “var77” on GitHub, demonstrates a multi-stage process that bypasses modern security measures like Address Space Layout Randomization (ASLR) using specially crafted PGP messages. The attack involves several steps, including heap pointer leakage, arbitrary memory read, identification of executable memory regions, and privilege escalation to the PostgreSQL superuser level, ultimately allowing the execution of OS-level commands. The vulnerability affects PostgreSQL deployments with the pgcrypto extension enabled, particularly those using vulnerable code versions. Successful exploitation can lead to full database compromise, unauthorized data access or modification, and potential lateral movement within networks. Organizations are advised to update PostgreSQL, restrict pgcrypto usage, limit user privileges, and monitor for unusual activity to mitigate risks.

Tech Optimizer

May 19, 2026

PoC Released for 20-Year Old PostgreSQL RCE Flaw

A public proof-of-concept exploit has been released for CVE-2026-2005, a critical heap-based buffer overflow vulnerability in PostgreSQL's pgcrypto extension, allowing full remote code execution and privilege escalation to the database superuser level. This vulnerability has existed since 2005 and was discovered by an AI-powered security tool during the ZeroDay.Cloud 2025 event in December 2025. An upstream patch was committed on February 8, 2026, and released on February 12, 2026. The vulnerability has a CVSS score of 8.8 and affects approximately 80% of cloud environments using PostgreSQL, with 45% accessible via the internet. The flaw is in the pgp_parse_pubenc_sesskey() function, which lacks bounds checking, allowing attackers to manipulate session key lengths. The pgcrypto extension can be installed by any database role with CREATE privileges, increasing the risk of exploitation. The proof-of-concept exploit involves an information leak, arbitrary write, and privilege escalation to remote code execution. The vulnerability affects all major versions of PostgreSQL prior to the February 2026 releases, which include versions 18.2, 17.8, 16.12, 15.16, and 14.21. Mitigation steps include upgrading to patched versions, restricting CREATE privileges, blocking direct internet exposure, rotating database credentials, auditing the usage of COPY FROM PROGRAM, and verifying patched engine versions for cloud-managed PostgreSQL users.

Tech Optimizer

May 19, 2026

Critical PostgreSQL Vulnerabilities Enables Code Execution and SQL Injections

The PostgreSQL Global Development Group has released security updates for versions 18.4, 17.10, 16.14, 15.18, and 14.23, addressing 11 vulnerabilities, including critical issues related to arbitrary code execution and SQL injection flaws. All supported branches from 14 through 18 are affected by vulnerabilities, necessitating updates. Database administrators can perform in-place upgrades without needing a dump/restore. Key vulnerabilities include: - CVE-2026-6637: Stack buffer overflow in the refint module allowing arbitrary code execution. - CVE-2026-6472: Privilege bypass and arbitrary SQL execution. - CVE-2026-6473: Potential remote code execution and memory corruption. - CVE-2026-6474: Server memory information leak. - CVE-2026-6475: Arbitrary file overwrite vulnerability. - CVE-2026-6476: SQL injection with superuser execution. - CVE-2026-6477: Client-side code execution risk. - CVE-2026-6478: MD5 credential timing leak. - CVE-2026-6479: SSL/GSS denial-of-service flaw. - CVE-2026-6575: Limited memory disclosure issue. - CVE-2026-6638: SQL injection in logical replication. Organizations using PostgreSQL 14 should upgrade to version 14.23 and plan migration to a newer version before the end-of-life on November 12, 2026. The updates are urgent for deployments exposed to the internet or in multi-tenant environments.

AppWizard

May 18, 2026

Here’s your first look at more of Google’s new 3D emojis for Android 17

Google's upcoming Android 17 update will introduce approximately 250 redesigned Noto 3D emojis, featuring a more pronounced 3D depth effect compared to older versions. These new emojis include various faces, animals, food, and drink icons. The rollout is expected to begin with Pixel phones later this year, although testing on Android 17 beta devices has not yet started.

AppWizard

May 18, 2026

Google’s new gradient icons for Gmail, Calendar, Drive and more are finally rolling out

Google has started rolling out new gradient icons for its Workspace applications, including Gmail, Drive, Docs, Calendar, and others. These icons feature a more fluid and colorful gradient aesthetic, moving away from the traditional four-color scheme. The new designs are visible in Google's web app launcher, but older versions will still appear in the applications for now. The redesign marks a significant shift towards gradients and blended colors, with the Google Drive icon showcasing shades of green, yellow, and blue, and the Google Calendar icon returning to a predominantly blue design. Gmail's logo retains its envelope shape but now includes gradients, while the Google Meet icon has adopted a yellow-centric gradient style. Keep and Tasks icons have also been simplified for a softer look. The new icons are expected to roll out more broadly during Google I/O week or shortly thereafter.

AppWizard

May 16, 2026

How Poppy Playtime made ‘free game, paid DLC’ work on PC

GameDiscoverCo held its annual offsite gathering, discussing various industry developments. Footprints.gg reported significant buzz for Forza Horizon 6 ahead of its launch, with GTA 6 also trending due to trailer speculation. Xbox plans include Project Saluki, a new Game Pass tier for the Chinese market, and Positron, potentially introducing a disc-to-digital entitlement program. Steam's bundle discounting interface has sparked discussions about pricing strategies. The PlayStation Plus Game Catalog for May includes Star Wars Outlaws and Red Dead Redemption 2. Roblox is experiencing shifts in user-generated content rights and cost models. The Source 2-powered s&box has launched on Steam, but interest is waning. Hushcrasher's analysis indicates rising game production costs are due to project scope rather than base costs. Concurrent user metrics suggest week one sales can reach 20 times peak concurrent users. Poppy Playtime, a horror puzzle game, has expanded from a free title to four paid chapters, with Huggy Wuggy becoming a popular character. Mob Entertainment, founded by brothers with a background in 3D animation, has seen Poppy Playtime Chapter 5 sell 408,000 copies on Steam and 19,000 on Epic Games Store. The free base game has 2.76 million downloads on Steam since the chapter's release. The franchise's revenue from four DLCs exceeds a million on Steam, with potential total revenue approaching 100 million when including console and mobile sales. The development team employs a parallel strategy for annual chapter releases, with varying DLC structures across platforms. The pricing of DLC has increased over time, reflecting greater ambition in production. Game director Bryce Clark emphasizes balancing puzzles and chase sequences to enhance player experience.