NewApp Digest
search bot

mitigation

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools
Tech Optimizer
March 11, 2026

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools

Cybersecurity researchers at the CERT Coordination Center (CERT/CC) have identified a new evasion technique, VU#976247, used by threat actors to exploit malformed ZIP archives and bypass Antivirus (AV) and Endpoint Detection and Response (EDR) systems. Attackers manipulate the internal headers of ZIP files, particularly altering the compression method field, which causes security tools to fail in analyzing the malicious payload. While some security products may flag the modified files as corrupted, they often do not detect the underlying malicious code. Standard extraction tools typically trust the tampered metadata and may return errors, leaving the hidden payload undisclosed. Attackers use custom malware loaders to extract and execute the malicious data, circumventing traditional AV detection. Cisco has been confirmed as affected, while other vendors, including AhnLab, Avast, Bitdefender, and Avira, have an “Unknown” status regarding their vulnerability. To mitigate this threat, organizations should enhance archive handling processes, avoid relying solely on declared metadata, adopt aggressive detection modes, flag metadata inconsistencies, and consult with AV and EDR providers about vulnerabilities.
CVE-2026-3172 Impact, Exploitability, and Mitigation Steps
Tech Optimizer
March 7, 2026

CVE-2026-3172 Impact, Exploitability, and Mitigation Steps

On February 25, 2026, a high-severity vulnerability affecting PostgreSQL and its extension, pgVector, was disclosed, with a CNA score of 8.1. The affected technologies are PostgreSQL and pgVector. There are currently no public or known exploits listed in the CISA Known Exploited Vulnerabilities (KEV) database, and the exploitation probability percentile is 14.5%. The vulnerability impacts specific packages and libraries, including pgvector and postgresql18-pgvector. Organizations are advised to monitor for updates and apply necessary patches.
Microsoft Blocks Credential Autofill to Fix Windows Hello Flaw
Winsage
February 15, 2026

Microsoft Blocks Credential Autofill to Fix Windows Hello Flaw

Microsoft has blocked credential autofill functionality in Windows 11 as part of the February 2026 Patch Tuesday updates to address the critical vulnerability CVE-2026-20804, which allows unauthorized access by tampering with Windows Hello authentication. This vulnerability was first identified in August 2025 and allows local administrators to inject biometric data. The restriction was documented in the January 2026 Patch Tuesday release notes. Enhanced Sign-in Security (ESS) operates at a hypervisor virtual trust level but is limited by hardware compatibility issues, particularly affecting AMD-based systems. Post-update, credential dialogs do not respond to virtual keyboard inputs from remote desktop or screen-sharing applications, preventing autofill during remote support sessions. Microsoft has provided a risky workaround that allows applications to operate with elevated administrator privileges, but this reintroduces the vulnerability. Organizations must now choose between disrupted remote support workflows or risking exposure to credential injection attacks, leading to operational challenges for IT teams and help desk staff.
Check for Windows 11 updates. Microsoft patched a big vulnerability.
Winsage
February 12, 2026

Check for Windows 11 updates. Microsoft patched a big vulnerability.

Microsoft has addressed a "remote code execution" vulnerability in Windows 11's Notepad application that could allow malicious actors to exploit Markdown files. The vulnerability occurs when a user clicks a harmful link in a Markdown file, potentially leading to the execution of unverified protocols and remote files with the same permissions as the user. Microsoft has implemented a warning system to alert users about unsafe links before they proceed. Users are advised to manually verify that their Windows 11 installations are current to ensure security.
Arnis Brings The World To Minecraft: Bedrock Edition
AppWizard
January 17, 2026

Arnis Brings The World To Minecraft: Bedrock Edition

Arnis, developed by Louis Erbkamm, is an open-source project that allows users to transform real-world locations into Minecraft blocks and maps. Initially limited to the Java edition, it has been updated to support the Bedrock Edition, enabling integration across various devices. The tool has improved elevation generation using NASA data, allowing users to visualize landscapes like the Alps and Himalayas, as well as explore a map of the Moon. The accuracy of the generated landscapes has been recognized for use in research studies on flood mitigation education. The project's advancements are attributed to a dedicated community that supports its development.
Google’s AI Android Updates Spark Phone App Glitches on Pixel Devices
AppWizard
January 2, 2026

Google’s AI Android Updates Spark Phone App Glitches on Pixel Devices

The phone app within Google's ecosystem has faced significant user frustration due to recent updates that disrupt essential functions like dialing and contact management. Users report issues such as the app failing to register incoming calls and cumbersome navigation following software patches. AI features introduced to enhance user experience often misfire, raising privacy concerns. The Pixel series has experienced bugs, including one that automatically declined calls. Updates to Google's search algorithm have inadvertently affected app performance, leading to instabilities. Monthly system updates prioritize new features over rigorous testing, resulting in a bloated app with sporadic functionality. Policy changes regarding data handling complicate app interactions, making simple tasks more laborious. Google's rapid release cycle has led to volatility in app performance, with security patches sometimes introducing new bugs. The integration of third-party services has created inconsistencies, and the overall Android ecosystem suffers from misalignment between updates. Users express dissatisfaction with the prioritization of aesthetics over functionality in updates. Critics argue that Google's approach mirrors past missteps, and experts recommend proactive user measures and improved developer practices to enhance app reliability.
В торрентах с одним из самых популярных фильмов года рассылают опасный вирус
TrendTechie
December 16, 2025

В торрентах с одним из самых популярных фильмов года рассылают опасный вирус

Recent reports indicate that torrent files for the film "Battle for Battle" are concealing a Trojan known as Agent Tesla, which can steal credentials, monitor computer activity, and take control of infected systems. The infection occurs when users download what appears to be the film file, which contains files like CD.lnk or Part2.subtitles.srt. Opening the first file executes a PowerShell script that interacts with the second file, leading to the installation of the Trojan. This malware can evade detection by Windows and antivirus programs by using harmless file types and PowerShell, complicating identification and mitigation efforts.
Microsoft mitigates Windows LNK flaw exploited as zero-day
Winsage
December 3, 2025

Microsoft mitigates Windows LNK flaw exploited as zero-day

Microsoft has addressed a security vulnerability in Windows tracked as CVE-2025-9491, which allows malicious actors to embed harmful commands in Windows LNK files, requiring user interaction to exploit. Threat actors often distribute these files in ZIP formats to bypass email security. In March 2025, 11 hacking groups, including Evil Corp and Kimsuky, were actively exploiting this vulnerability using various malware payloads. Although Microsoft initially did not consider the issue urgent, it later modified the handling of LNK files in November updates to allow users to view the entire character string in the Target field. However, this change does not eliminate the malicious arguments embedded in the files. ACROS Security has released an unofficial patch that restricts shortcut target strings to 260 characters and alerts users about risks associated with long target strings, covering multiple Windows versions.
Search