processes Archives

AppWizard

October 2, 2026

How Two Android Intent Bugs Broke My App’s Red Alert Button

An Android application named CareVocal (internally referred to as CareBridge) was developed to facilitate communication for the user's mother living in a village. The app features three buttons: green for "feeling good," yellow for "something hurts," and red for "need help." Tapping the red button triggers three actions: saving an entry for her doctor, generating a pre-filled SMS to trusted contacts, and opening the phone dialer with the local emergency number pre-typed. The app requires the user to confirm sending the SMS and calling the emergency number to comply with Google Play's restrictions. During testing, issues arose where the SMS draft would not appear if the dialer was opened first, leading to adjustments in the code. A method was implemented to launch multiple intents simultaneously, ensuring that the SMS draft and dialer could be accessed without conflicts. Additionally, the recording feature was modified to start only after a second tap on the red button, separating it from the alert process to avoid distractions during emergencies. The app does not collect location data and is designed solely for logging and communication without diagnostic capabilities.

AppWizard

October 1, 2026

Google’s new Android sideloading rules are live — and here are all the ways to already bypass them

Google has implemented new developer verification rules for Android sideloading, affecting users in Brazil, Indonesia, Singapore, and Thailand. Apps from unverified developers are automatically blocked on certified Android devices with Google Play Services. This change is part of a global rollout expected in 2027. Users can still install apps from recognized app stores like Google Play Store, HONOR App Market, and others, but third-party developers not registered with Google’s Android Developer Verification Program face restrictions. To circumvent these restrictions, users can: 1. Rely on established app stores. 2. Use Google’s Advanced Flow, which involves enabling Developer Options, confirming choices, and waiting a mandatory 24-hour period before installation. 3. Utilize ADB for installation without waiting periods. 4. Use Shizuku for on-device wireless debugging. 5. Root their devices to bypass restrictions entirely. Apps installed before the new rules will remain functional but cannot be updated without following the new procedures. Developer Options do not need to remain enabled after completing the Advanced Flow. If the process is not completed after the waiting period, users must restart it. Uninstalling the Android Developer Verifier app while using Shizuku may not affect the waiting period. Users in regions not yet impacted by these changes do not need to take immediate action.

Winsage

October 1, 2026

Microsoft Enables Windows Settings Backup by Default

Microsoft has announced that Windows settings backup will now be enabled by default on eligible Windows 11 version 26H2 devices. This feature, previously known as Windows Backup for Organizations, automatically preserves users’ Windows settings and Microsoft Store app lists, facilitating restoration after device resets, replacements, or reimages. The change aims to minimize disruptions during device recovery and ensures more devices have recovery data readily available. Administrators will still control the restore process, which requires explicit configuration. The default-on behavior applies only to Windows 11 version 26H2 or later, devices with the backup policy in a “Not Configured” state, and excludes certain environments. Administrators can disable the backup feature if necessary.

AppWizard

October 1, 2026

Google outlines timeline to phase out Gemini Gems in favor of Skills

Google is phasing out its customizable Gems in favor of a new framework called Skills, which will begin rolling out in Google Workspace on October 5 and in the Gemini app on October 13. The phased departure of Gems will start in November. Skills allow for multiple modular components to work together, enabling more complex tasks. They will be accessible to both personal and Workspace accounts and are built on an open SKILL.md format using Markdown. However, Skills created in Gemini and Workspace will not synchronize automatically. Gems will be transferred to Gemini’s Settings on November 17, remaining usable for a limited time. Business and enterprise accounts will keep their Gems until March 1, 2027, while educational accounts will have until June 1. Remaining Gems will eventually be converted into draft Skills.

AppWizard

September 30, 2026

Minecraft Dungeons II, Ace Combat 8: Wings of Theve on Xbox X/S, PlayStation 5, Switch, PC: New Gameplay,

New video game releases this week include "Minecraft Dungeons II" on Tuesday and "Ace Combat 8: Wings of Theve" on October 2. "Minecraft Dungeons II" allows players to explore a new dimension called the Sift, either solo or with up to three friends. "Ace Combat 8" features aerial combat in the alternate-universe Earth of Strangereal, where players defend against an invasion. Analysts predict that AI tools could significantly reduce game development costs, potentially unlocking billions in profits for developers. Global consumer spending on video games is projected to reach 0 billion this year, with billion reinvested in development. "Grand Theft Auto VI" is set for a November 2026 launch, having been in development since 2018.

AppWizard

September 29, 2026

TNS Expands Android Terminal Platform with Bring Your Own App

Transaction Network Services (TNS) has launched a capability called Bring Your Own App (BYOA) for operators in the payment industry, allowing them to create and deploy customer-facing applications on TNS's Android-based unattended payment terminals. BYOA simplifies payment processing, compliance, and certification by managing card capture, PIN collection, encryption, EMV processing, and payment certification. Each operator's application must be approved and signed by TNS before execution on the terminal. This model enables operators to focus on enhancing customer experiences without the usual security and compliance burdens. BYOA is available across TNS's Android-based unattended payment terminal platform, including retail and fuel payment terminals.

Tech Optimizer

September 29, 2026

Why Endpoint Detection and Response Is No Longer Optional

Traditional antivirus software relies on a signature-based model that compares files against a database of known malware, which limits its effectiveness against modern threats. Cybercriminals have adapted by using polymorphic malware and fileless techniques that evade detection. Endpoint Detection and Response (EDR) continuously monitors device activities, tracking process activity, network connections, and file changes to detect behavioral patterns indicative of attacks. EDR also enables rapid response actions, such as isolating affected devices and terminating malicious processes. Small and medium businesses are increasingly targeted by attackers who exploit the limitations of traditional antivirus solutions. Relying solely on antivirus software creates vulnerabilities, making it essential for organizations to incorporate EDR for enhanced security.

AppWizard

September 29, 2026

How we found 24 Android vulnerabilities using our open source AI security agent

The GitHub Security Lab has introduced the Taskflow Agent, an open-source tool that uses artificial intelligence to automate the identification of vulnerabilities in Android applications. This tool allows security researchers to create custom taskflow prompts, leading to the discovery of over 20 vulnerabilities. To use the taskflows, a GitHub Copilot license is required, and users can run scripts to audit their projects, with results displayed in an SQLite viewer. Two specific vulnerabilities identified include: 1. OsmAnd app allows malicious applications to track user locations due to improper handling of intent extras in its exported activity. 2. The Wikipedia app has a logic flaw that enables attackers to redirect users to malicious sites via a deeplink mechanism, potentially leading to account takeovers. The GitHub Security Lab has reported a total of 24 vulnerabilities in Android applications, highlighting the effectiveness of AI in security research.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 28, 2026

The Fault Line Spreads: Azure’s September CVE Cluster Now Covers PostgreSQL and Billing

Two newly identified Critical CVEs have expanded Microsoft's September identity infrastructure vulnerabilities to over ten verified weaknesses across more than ten distinct services. The Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) with a CVSS score of 9.9. Azure Billing is impacted by CVE-2026-62874, which presents an Insufficient Data Authenticity Verification issue (CWE-345) with a CVSS score of 10.0. Both vulnerabilities were disclosed on September 18 and validated by Tenable and MITRE. CVE-2026-85878 allows an authorized attacker to elevate privileges over the network with minimal complexity, while CVE-2026-62874 requires no authentication, enabling unauthenticated attackers to jeopardize financial integrity. The vulnerability cluster first emerged during the Patch Tuesday cycles on September 3 and September 8, with initial reports highlighting critical flaws in core services. Other September disclosures include CVE-2026-83711 (Azure AD B2C, CVSS 10.0), CVE-2026-70352 (Azure AI Language, CVSS 10.0), CVE-2026-83941 (Entra ID, CVSS 9.9), CVE-2026-62916 (Entra ID, CVSS 9.1), CVE-2026-69857 (Azure Cosmos DB, CVSS 8.5), and CVE-2026-69854 (Spring Cloud Azure, CVSS 9.0). Activity heightened between September 17 and 18 with the introduction of CVE-2026-77903 (Microsoft Dataverse, CVSS 9.0) and CVE-2026-69843 (Microsoft Fabric, CVSS 10.0). The attack surface has broadened from authentication concerns to encompass trust in AI endpoints, data storage locations, and billing verification processes. Seven out of the ten vulnerabilities are unauthenticated, and all issues were addressed through server-side fixes by Microsoft. The extensive range of affected services suggests these vulnerabilities indicate a shared architectural dependency on authentication logic.