Microsoft Archives

Winsage

July 15, 2026

Windows 11 finally gets an undo button for your entire PC

Microsoft unveiled its July 2026 Patch Tuesday update, identified as KB5101650, for Windows 11 versions 25H2 and 24H2. The update introduces the Point-in-Time Restore (PITR) feature, allowing users to take full backups and create snapshots every 4 to 24 hours, with snapshots retained for a maximum of 72 hours. PITR can restore local files and applications. Users can now pause Windows updates for up to 35 days. Other enhancements include discreet widget operation, optimized taskbar notifications, faster File Explorer startup, quicker disk image mounting, improved Bluetooth functionality, reduced eye strain through screen tinting, and enhancements in voice control and input capabilities. Not all features will be available immediately after installation, with security-related improvements being deployed universally.

Winsage

July 15, 2026

Microsoft patches record 570 Windows security bugs with two exploited zero days

Microsoft released its July Patch Tuesday updates, addressing 570 security vulnerabilities in Windows, a record number for the company. This update includes three zero-day vulnerabilities, two of which have been exploited in real-world attacks, affecting Microsoft’s Active Directory and SharePoint, while the third concerns BitLocker encryption. The update also enhances Windows features, including changes to the Widgets app, improvements in File Explorer speed, refined Bluetooth connectivity, and a new feature allowing users to pause updates until a specific date. However, the update has been temporarily halted for certain Dell computers due to compatibility issues, with Microsoft working on a fix.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 15, 2026

Here’s how to update every app on your Windows PC with a single command

Updating Windows applications is important for accessing the latest features and protecting against vulnerabilities. Many users neglect this due to forgetfulness or the time-consuming nature of the process. The Microsoft Store and Windows Update usually provide updates for native Windows applications, but a unified method for updating all programs is lacking. Windows includes a command called winget (Windows Package Manager) that allows users to update all applications simultaneously via the command line. The command to update all apps is:


winget upgrade --all

This command updates both traditional installers and Microsoft Store apps. Users can also update individual apps by specifying the app ID, for example:


winget upgrade "Chrome"

To view all applications managed by winget, the command is:


winget list

To skip confirmation prompts during updates, users can use:


winget upgrade --all --accept-source-agreements --accept-package-agreements

For complete automation, users can create a task in Task Scheduler to run at startup with the following setup: 1. Open Task Scheduler and create a basic task named "Winget Auto Update." 2. Set the trigger to run when the computer starts. 3. Choose to start a program, entering PLACEHOLDER216a2cf34dab649d in Program/script and PLACEHOLDERbe861b18048fd836 in Add arguments. 4. Set the task to run with the highest privileges and add a 1-minute delay to ensure network connectivity. While winget does not cover every Windows application, it effectively manages most mainstream applications.

Winsage

July 15, 2026

Windows 0-day drops the same day Microsoft releases record number of patches

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, discussed a vulnerability that allows attackers to gain administrator privileges by configuring a system to execute their code upon an admin user's login. This vulnerability enables non-admin users to modify the classes registry hive of an admin user, posing a significant risk. It could be exploited without user interaction and may be combined with another vulnerability that provides direct access to an administrative account. Microsoft is aware of the issue and is investigating it, encouraging coordinated disclosure from vulnerability reporters. Independent researcher Kevin Beaumont has created a detection script to help protect against this vulnerability, along with recommendations to restrict local non-user accounts, monitor the ProfSvc for unexpected hive loads, and track activity related to NTUSER.DAT and UsrClass.dat files.

Winsage

July 15, 2026

Windows 11’s 500GB storage bug is fixed. How to check if you’re good

Microsoft's July Patch Tuesday update addressed a significant storage issue for Windows 11 users related to the CapabilityAccessManager.db-wal file, which had been consuming excessive storage space, with reports of usage reaching up to 500 GB. The bug originated from the Capability Access Manager service, which normally allows the file to occupy only a few megabytes. Update KB5101650 was released to fix this issue, improving disk space usage for the file. However, it is unclear if existing oversized WAL files will automatically resize. Users are advised to check the size of their WAL file using the Command Prompt or third-party tools, and if it remains large, to delete it following the update documentation.

Winsage

July 15, 2026

Dark patterns in Windows are steering users to Edge: Mozilla-commissioned report

A report by Mozilla, titled "Over The Edge 2.0," reveals that Microsoft is using various tactics to promote its Edge browser, including misleading banners on Bing and pre-pinning Edge on the Windows taskbar. The report indicates that Microsoft hinders users' ability to download or set alternative browsers as default. It also notes that Microsoft's AI tool, Copilot, fails to recognize the default browser when opening links, and data-sharing settings are preselected to ON in regions like the US and India. Despite these efforts, Edge's market share has declined from 13 percent in June 2025 to just over 10 percent, while Mozilla's Firefox has increased from 5.84 percent to 6.44 percent. The Browser Choice Alliance and other browser developers have criticized Microsoft's practices, calling for fair competition.

AppWizard

July 15, 2026

GOG is now my go-to storefront for buying PC games since Sony and Microsoft are seemingly against it

Major players in the gaming industry, such as Sony and Microsoft, have recently made controversial decisions, including Sony discontinuing physical game discs and removing 500 movies without refunds, and Microsoft laying off around 3,200 Xbox game developers while suspending user accounts without justification. In contrast, GOG.com has emerged as a proponent of digital preservation, offering DRM-free games that come with standalone offline installers, allowing users to own their games permanently and play them without an online store's permissions. GOG encourages users to save their games to discs for sharing and backup purposes.

Winsage

July 15, 2026

Indomitus Group Brings indiAccounting to Windows: Buy-Once Accounting and Payroll Now Available for Windows 11

Indomitus Group has launched indiAccounting, a desktop accounting and payroll application for Windows 10 and 11, available for a one-time purchase of 9. This application, initially launched for Linux, offers a robust double-entry accounting system with optional payroll functionality for all 50 states. Unlike subscription-based services that can cost small businesses between ,000 to ,000 annually, indiAccounting allows users to own their software and data without recurring fees. The application operates offline, requires no account setup, and includes features such as double-entry bookkeeping, invoicing, accounts management, inventory tracking, and financial reporting. The optional indiPayroll add-on manages payroll calculations and tax forms for all states. Users can manage an unlimited number of businesses under a single license, with each company maintaining isolated financial records.

Tech Optimizer

July 15, 2026

State antivirus revived: “Multiscanner” returns after funding cut

The Russian portal "Multiscanner" has resumed its service for scanning files for malicious software without mandatory registration. It allows users to upload files up to 256 MB in over 30 formats, including DOC, DOCX, PDF, PPTX, EXE, and ZIP. The scanning history is saved in the browser but can be deleted for privacy. "Multiscanner" is compatible with popular web browsers like Google Chrome, Yandex Browser, Firefox, Microsoft Edge, and Safari, but is not available on mobile browsers. The portal was originally developed between 2023 and 2024 and is now managed by the National Technology Center for Digital Cryptography, operating in pilot mode.