monitor Archives

Winsage

September 28, 2026

A Windows 10 Update Was Force Triggering Copilot To Run Every Time A File Was Clicked, Leading To Frequent Crashes That Logged The Culprit As Microsoft Edge

Microsoft's Windows 10 update "KB5126256," intended as a licensing preparation package for Extended Security Updates, has caused issues for users, including one Reddit user whose File Explorer crashes when clicking on files due to the automatic activation of the Copilot feature. The crashes were misleadingly attributed to Microsoft Edge, but further investigation revealed they were linked to "mscopilot_proxy.exe" and the module "ShellEh6055x64.dll," associated with the 4t Tray Minimizer application. Users have reported that uninstalling problematic updates can provide temporary relief, while some have chosen to disable updates entirely, despite Windows not offering a complete option to do so.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 28, 2026

Norton’s antivirus plans drop to Black Friday prices — but the deals end tomorrow

Norton is offering substantial discounts on its antivirus plans, with reductions up to 76%. Current prices for the first year are as follows: Norton AntiVirus Plus at .99 (originally .99), Norton 360 Standard at .99 (originally .99), and Norton 360 Deluxe at .99 (originally 4.99). The plans provide protection for one, three, and five devices respectively, with additional features like VPN and dark web monitoring for higher-tier plans. After the first year, prices revert to standard rates unless auto-renewal is canceled. Norton also offers a 60-day money-back guarantee.

Tech Optimizer

September 28, 2026

What Is Happening with PostgreSQL 19?

Postgres 19 is experiencing delays in its release schedule, with Beta 4 scheduled for September 24, 2026. The development team is prioritizing quality over timelines, leading to the reversion of 53 significant features during the beta phase. Notable feature reversions include SQL Property Graph Queries, ALTER TABLE MERGE/SPLIT PARTITION(S), UPDATE/DELETE FOR PORTION OF, GROUP BY ALL, a change to default TOAST compression, nontext output formats for pg_dumpall, JSON_TABLE ON ERROR cascading, fast defaults for domains with nonvolatile constraints, logical replication database-specific snapshots, nested query tracking, and online data checksums. The majority of these reversions are due to design flaws, incorrect results, or compatibility issues. There are also at-risk features identified, including RI fast-path FK checks, REPACK / REPACK CONCURRENTLY, and Postgres_fdw statistics import. Despite these challenges, promising features such as pg_plan_advice, parallel autovacuum, ON CONFLICT DO SELECT, and logical replication enhancements are still anticipated in PG19. AI tools are being utilized in the development process to identify bugs and create test cases. Postgres 18 remains a reliable upgrade target, while features like property graphs and GROUP BY ALL are now planned for PG20.

Tech Optimizer

September 28, 2026

The Fault Line Spreads: Azure’s September CVE Cluster Now Covers PostgreSQL and Billing

Two newly identified Critical CVEs have expanded Microsoft's September identity infrastructure vulnerabilities to over ten verified weaknesses across more than ten distinct services. The Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) with a CVSS score of 9.9. Azure Billing is impacted by CVE-2026-62874, which presents an Insufficient Data Authenticity Verification issue (CWE-345) with a CVSS score of 10.0. Both vulnerabilities were disclosed on September 18 and validated by Tenable and MITRE. CVE-2026-85878 allows an authorized attacker to elevate privileges over the network with minimal complexity, while CVE-2026-62874 requires no authentication, enabling unauthenticated attackers to jeopardize financial integrity. The vulnerability cluster first emerged during the Patch Tuesday cycles on September 3 and September 8, with initial reports highlighting critical flaws in core services. Other September disclosures include CVE-2026-83711 (Azure AD B2C, CVSS 10.0), CVE-2026-70352 (Azure AI Language, CVSS 10.0), CVE-2026-83941 (Entra ID, CVSS 9.9), CVE-2026-62916 (Entra ID, CVSS 9.1), CVE-2026-69857 (Azure Cosmos DB, CVSS 8.5), and CVE-2026-69854 (Spring Cloud Azure, CVSS 9.0). Activity heightened between September 17 and 18 with the introduction of CVE-2026-77903 (Microsoft Dataverse, CVSS 9.0) and CVE-2026-69843 (Microsoft Fabric, CVSS 10.0). The attack surface has broadened from authentication concerns to encompass trust in AI endpoints, data storage locations, and billing verification processes. Seven out of the ten vulnerabilities are unauthenticated, and all issues were addressed through server-side fixes by Microsoft. The extensive range of affected services suggests these vulnerabilities indicate a shared architectural dependency on authentication logic.

AppWizard

September 28, 2026

Android Google Wallet Now Shows Google Store Points Balance

The Android version of Google Wallet now allows users to check their balance of Google Store Points, expanding its functionality beyond managing Google Play Points. Users can monitor their Google Store Points alongside other rewards, but these points cannot be used for purchases within the app.

Winsage

September 27, 2026

Windows 11’s driver signature requirement is one of the best anti-consumer security features out there

Windows 11 requires drivers to be digitally signed, a policy aimed at enhancing security by preventing unauthorized code from executing at the kernel level. This requirement, which began with Windows Vista and became mandatory with Windows 10, version 1607, has tightened over the years, especially with the introduction of UEFI Secure Boot and TPM in Windows 11. While this enforcement protects against malware and supports anti-cheat systems in gaming, it limits user autonomy and imposes significant challenges for developers, particularly those working on smaller projects. In contrast, Linux allows users more freedom to modify their systems, though this flexibility can compromise security.

Winsage

September 26, 2026

“We’re building Copilot as a new OS,” says Satya Nadella, even as Microsoft strips it from Windows 11

Microsoft CEO Satya Nadella announced a unified Copilot experience that integrates Home, Code, and Autopilot into a single application, transforming the Microsoft 365 suite into a “super app.” Copilot is described as a “new OS for work,” serving as a central hub for productivity across various tasks and devices. The Home section features Chat and Cowork functionalities, while the Office section includes full integration of Word, Excel, and PowerPoint. The Code feature allows users to create applications using natural language, democratizing app development. Autopilot, previously known as Scout, functions as a virtual colleague that manages tasks and projects. Microsoft has revised its pricing model to include a standard per-user subscription for basic functionalities and a usage-based billing model for advanced features. The announcement on September 25 met the timeline set during the Build 2026 conference, although features are still being rolled out incrementally. The new Copilot experience aims to enhance user interaction with AI without introducing a new operating system.

Tech Optimizer

September 26, 2026

What Is End Point Security And How Does It Work?

Endpoint security is a suite of technologies and processes designed to protect devices connected to a business network from cyber threats. It includes various devices such as laptops, smartphones, tablets, servers, and IoT devices. Endpoint security employs a multi-layered approach, scanning for malware, regulating applications, and monitoring device activity for unusual behavior. It is distinct from antivirus software, encompassing a broader range of protective measures, including firewalls, encryption, application controls, patch management, and Endpoint Detection and Response (EDR). The rise of remote work and the increasing number of devices create a larger attack surface, making endpoint security essential for preventing breaches and safeguarding business operations.

Winsage

September 25, 2026

Windows 11 24H2 Home and Pro editions reach end of updates on October 13, 2026 — here’s what you must do

Microsoft announced that the Home and Pro editions of Windows 11 version 24H2 will stop receiving updates after October 13, 2026. The Enterprise and Education editions of Windows 11 24H2 will continue to be supported until October 12, 2027. Windows 11 SE will also reach its end of support in October 2026, with no feature updates after 24H2. Users are encouraged to upgrade to Windows 11 version 25H2 to extend their support window until October 2027. The upgrade requires Windows 11 version 24H2 and a specific cumulative update. If users do not upgrade, Microsoft will automatically push the 25H2 update to unmanaged Home and Pro devices.