leaked Archives

Winsage

September 24, 2026

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers from Graz University of Technology in Austria have discovered significant vulnerabilities in the file notification systems of major operating systems: Android, Linux, macOS, and Windows. These flaws have existed for decades and can lead to the leakage of sensitive system information. The affected systems include inotify on Linux (since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), and FSEvents on macOS (since 2007). The vulnerabilities allow unprivileged users to monitor file events without explicit read permissions, enabling potential attacks such as inter-keystroke timing attacks and website fingerprinting. For example, on Linux, monitoring a readable directory can leak events on files that cannot be read, allowing attackers to achieve a 93.1% to 100% accuracy rate in monitoring keystrokes. Specific vulnerabilities include CVE-2025-68788 on Linux, which received a partial fix in December 2025, and issues on Android where FileObserver can bypass app storage isolation. On macOS, limited information is available due to a lack of bypasses for private directories, while on Windows, monitoring the root directory can reveal the full path of every accessed file, allowing real-time tracking of web activity with a 97.8% accuracy rate. Microsoft has described the issue as "by-design," which has faced criticism. The researchers propose stronger mitigations, such as disallowing monitoring of entire drives on Windows and introducing a permission system for file monitoring on Windows and macOS. Their findings will be presented at the ACM CCS 2026 conference in November in The Hague, Netherlands.

AppWizard

September 23, 2026

Optimus Gen 3 Leaked: 5 Details From the APK Images

Images of Tesla's next-generation Optimus robot, Gen 3, were leaked from the Tesla Android app APK by researcher @wholemars, showcasing design assets of both Gen 2.5 and Gen 3. The leak reveals significant design evolution, suggesting enhancements in aesthetics and functionality. Preliminary observations indicate that Gen 3 may feature advanced sensors and improved mobility, along with a more intuitive user interface. This model could position Tesla as a leader in the humanoid robot market and enable diverse applications, from personal assistance to industrial automation.

Winsage

September 19, 2026

We finally know how Windows XP’s infamous FCKGW product key ended up everywhere

Windows XP was released in two versions: Retail for individual consumers and Volume for Microsoft's partners and OEMs. The product key FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8 became widely recognized due to a potential leak by an insider at a major OEM, which was then spread by the pirate group Devils0wn. The Volume version's activation system required a unique key, but the FCKGW key was incompatible with the standard installation CD. To verify the legitimacy of Volume discs, the activation system searched for a secret 10MB binary blob exclusive to the Volume media. Microsoft blacklisted the FCKGW key with Service Pack 1 and implemented further security measures with Service Pack 2, restricting access to certain updates. Contrary to prior beliefs, the key's functionality was not due to a simple key generation algorithm but was designed by skilled engineers.

Winsage

September 17, 2026

Retired Microsoft Engineer details the story about the famous leaked FCKGW Windows XP key — copy protection used 10MB of encrypted Microsoft Bob for validation

The most recognized Windows XP product key is FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8. Windows XP was released in two formats: Retail for consumers and Volume for Microsoft partners and OEMs. The Volume discs were not intended for the general public and were designed for mass installations without individual activation. The final CD version, Release to Manufacturing (RTM), was completed on August 24, 2001, two months before the official launch on October 25. A leak of the Volume image and its Volume License Key (VLK) is believed to have originated from a major OEM, possibly Dell or Intel, which was exploited by the pirate group Devils0wn, allowing broader access to Windows XP.

Winsage

September 16, 2026

Ex-MS engineer reveals the story behind the infamous ‘FCKGW’ Windows XP key: ‘Pirates started baking the key into images or just writing it on the CD with a Sharpie’

David Plummer, a former Microsoft engineer, was the primary author of Windows XP's Product Activation system, which included the infamous product key FCKGW. This key became widely used on pirated copies of the operating system. Plummer created the activation system by compressing and encrypting disc data, ensuring its security. The FCKGW key was specifically tied to certain data configurations, making it ineffective on standard XP CDs. A piracy group, Devils0wn, leaked a complete Windows XP Pro Corporate ISO and the valid FCKGW key just five weeks before the official launch, allowing unauthorized installations. Microsoft responded by blacklisting product IDs associated with the compromised keys in Service Pack 1 and blocking updates for installations using the FCKGW key in Service Pack 2. Valid, un-leaked Volume License Keys (VLKs) remained functional for years after the incident. Plummer noted that the media and the key were leaked before the product reached stores, preventing the intended hardware-binding from functioning.

AppWizard

September 15, 2026

Minecraft Dungeons II Xbox Release Date, Price, Game Pass

Minecraft Dungeons II is set to launch on September 29, 2026, as confirmed by Xbox Game Studios. It will be available on Xbox Series X|S, PlayStation 5, Nintendo Switch, Switch 2, and PC (via Steam and the Microsoft Store), and will be included in Xbox Game Pass from day one. The Standard Edition is priced at .99, while the Deluxe Edition costs .99 and includes future downloadable content. Pre-orders come with exclusive hero skins, the Twisted cape, and a Twisted chicken pet. The sequel features a larger campaign across two interconnected worlds, a new antagonist, an expanded gear and enchantment system, new enemy types, environmental challenges, and a returning four-player co-op mode.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

AppWizard

September 11, 2026

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware

The Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical vulnerability in NetScaler, identified as CVE-2026-19490, with a CVSS score of 9.3, which has been exploited and affects all NetScaler ADC and Gateway appliances. Citrix has patched this vulnerability as of August 19. AdaptHealth reported a data breach affecting over 4.1 million individuals, compromising personal, health, and insurance information, but not Social Security numbers or financial data. A new strain of Android malware, MantaxOtax, attributed to Indonesian threat actors, combines ransomware and spyware, stealing sensitive information and affecting older Android versions. The Gigabud banking trojan has evolved to evade detection by installing a secondary app that hides the malicious application. CISA acting director Nick Andersen emphasized the need for swift adaptation to cybersecurity threats and highlighted staffing improvements within CISA. Russian e-commerce giant Wildberries experienced disruptions from a DDoS attack affecting payments to sellers, following claims of a cyber operation by Ukraine's military intelligence. McKesson faced a cyberattack exposing sensitive data of 6.4 million individuals, with the ShinyHunters group releasing this data after a failed extortion attempt. IDScan confirmed a data breach affecting 150 million individuals, resulting in the theft of personally identifiable information and government-issued documents.

BetaBeacon

September 11, 2026

Modder Behind GTA 5’s Switch Port Is Now Bringing It to Android

- An unofficial Android port of Grand Theft Auto 5 is in development by M0jso of Paralympics Productions. - The port is being built to run GTA 5 natively on Arm, based on the same foundation as the Switch port. - Minimum requirements include a Snapdragon 865 processor, 8 GB of RAM, and 65 GB of storage. - The initial public build will only be compatible with Snapdragon chips.

AppWizard

September 10, 2026

How to Delete Your Digital Footprint From the Internet: A Complete Guide

Android privacy tools allow users to control camera access, microphone use, location permissions, and app activity, but they only protect information managed on the device or connected services. A digital footprint extends beyond the device, with personal information remaining accessible through search results, social media profiles, and data broker listings even after permissions are changed. To manage this footprint, users should identify publicly visible information, review old accounts, and delete unnecessary records. Simply deleting an Android app does not erase the associated account, which may retain personal data. Users should actively close unused online accounts to maintain digital hygiene. Data brokers publish personal information that cannot be removed through Android privacy settings, requiring users to follow an opt-out process to remove their data. While Android privacy settings are important, they do not eliminate external records. Data breaches require vigilance, including changing compromised credentials and monitoring for suspicious activity. Removing the source of information is more effective than just eliminating search results, and legal rights may exist in some regions for personal data removal. Completely erasing a digital footprint is rarely feasible due to public records and the persistence of past posts. The goal should be to minimize irrelevant content while retaining useful accounts. Users should begin by deleting information they control, then address data brokers and public profiles.