NewApp Digest
search bot

Microsoft

Microsoft tightens Windows security with app transparency and user consent
Winsage
February 11, 2026

Microsoft tightens Windows security with app transparency and user consent

Microsoft is enhancing the security of its Windows operating system through two initiatives: User Transparency and Consent, and Windows Baseline Security Mode. The User Transparency and Consent initiative will notify users when applications request access to sensitive resources and log every permission granted, allowing users to review and modify their choices. Applications and AI agents will adhere to higher transparency standards. Windows Baseline Security Mode will enable runtime integrity safeguards by default, allowing only properly signed applications, services, and drivers to run. Users and IT administrators can approve exceptions for specific applications. These updates are part of Microsoft’s Secure Future Initiative, which aims to help organizations prevent, manage, and recover from security incidents. The rollout will occur in phases, with collaboration from developers, enterprises, and partners to ensure a smooth transition.
Microsoft fixes six actively exploited flaws in latest Windows 11 update
Winsage
February 11, 2026

Microsoft fixes six actively exploited flaws in latest Windows 11 update

Microsoft's February 2026 Patch Tuesday addressed 59 vulnerabilities in Windows 11, with six confirmed as actively exploited. The most critical vulnerability is CVE-2026-21510, a Windows Shell security feature bypass with a CVSS rating of 8.8, allowing attackers to evade warnings by tricking users into opening malicious files. Another significant vulnerability, CVE-2026-21513, also rated at 8.8, affects MSHTML and allows remote attackers to bypass execution prompts through malicious code in HTML or shortcut files. CVE-2026-21514 impacts Microsoft Word and enables adversaries to disable OLE mitigations, posing risks through document-based attacks. Two local privilege escalation vulnerabilities are CVE-2026-21519 in Desktop Window Manager and CVE-2026-21533 in Windows Remote Desktop Services, with CVSS scores of 7.8. CVE-2026-21525 is a denial-of-service vulnerability in Remote Access Connection Manager. The update includes 53 additional vulnerabilities across various Microsoft products and services, with CVE-2026-21531 in Azure SDK rated at 9.8 and CVE-2026-20841 affecting Windows Notepad rated at 8.8. The cumulative update for Windows 11 (KB5077181) also includes enhancements and resolves WPA3 Wi-Fi connectivity issues. Microsoft reminded users of the June 2026 expiration of Secure Boot certificates, which requires timely updates to ensure secure booting. Users can install the updates via Windows Update.
GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection
Tech Optimizer
February 10, 2026

GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection

GuLoader, also known as CloudEye, is a downloader malware that has been active since late 2019, primarily used to fetch and install secondary malware like Remote Access Trojans (RATs) and information stealers. It employs legitimate cloud services such as Google Drive and Microsoft OneDrive to host its malicious payloads, allowing it to evade detection by security tools. GuLoader utilizes advanced techniques including polymorphic code, which alters its appearance to avoid static detection signatures, and exception-based control flow to confuse analysis tools. Over the years, GuLoader has refined its tactics, including the use of software breakpoints and various exception types to redirect its operations. It also employs dynamic XOR encryption to obfuscate internal data, making it difficult for analysts to extract URLs. The malware's continuous evolution poses ongoing challenges for security researchers. Indicators of Compromise (IOCs) include specific hash values for different versions of GuLoader from 2022 to 2024.
Xbox Game Pass Could Be Merged with PC Game Pass and Expanded with More Third-Party Services
AppWizard
February 10, 2026

Xbox Game Pass Could Be Merged with PC Game Pass and Expanded with More Third-Party Services

Microsoft is reportedly considering merging the Xbox Game Pass Premium console subscription with the PC Game Pass. This information has been corroborated by multiple sources, indicating substantial interest in this direction. The current features of both subscriptions differ in price, platforms, first-party day-one access, EA Play inclusion, cloud gaming capabilities, online multiplayer options, and game library size. The potential merger could introduce a new subscription tier that includes cloud gaming, EA Play, and first-party day-one access, likely at a higher price point. Additionally, Microsoft is speculated to be exploring bundled third-party services to enhance Xbox Game Pass Ultimate. There are also rumors about a next-generation Xbox console launching in 2027, which may be a hybrid model capable of running PC applications.
Microsoft is keeping Secure Boot alive with Windows updates
Winsage
February 10, 2026

Microsoft is keeping Secure Boot alive with Windows updates

Microsoft is enhancing the security of Windows devices by replacing boot-level security certificates that are nearing expiration, with this initiative integrated into regular Windows platform updates. The original Secure Boot certificates from 2011 will expire between June and October 2026, prompting Microsoft to issue new certificates in 2023, which are included in many new Windows devices sold since 2024. Older hardware will require updates to remain compliant. Devices with expired certificates will continue to operate but will enter a "degraded security state," potentially hindering future updates and causing compatibility issues. The new Secure Boot certificates rollout began with the Windows 11 KB5074109 update. Most Windows 11 users will have the new certificates installed automatically, while specialized systems may have different update protocols. Windows 10 users must enroll in Microsoft’s Extended Security Updates to receive the new certificates.
Windows shortcut weaponized in Phorpiex-linked ransomware campaign
Winsage
February 10, 2026

Windows shortcut weaponized in Phorpiex-linked ransomware campaign

The Global Group has shifted to a local execution strategy for ransomware, complicating detection and response efforts. Their infection process begins when a user opens a shortcut file with a double extension (e.g., “Document.doc.lnk”), which appears as a legitimate document due to Windows' default settings that hide file extensions. The shortcut icon mimics that of a Microsoft Word file. When executed, the .lnk file activates Windows utilities like cms.exe and PowerShell to retrieve and execute the next-stage payload, effectively bypassing traditional security controls focused on malicious documents or executable attachments.
Search