NewApp Digest
search bot

redirection

Windows 365 Link: One year of the simple, secure, purpose-built Cloud PC device
Winsage
April 22, 2026

Windows 365 Link: One year of the simple, secure, purpose-built Cloud PC device

Windows 365 Link, a service launched a year ago, enhances the Windows 365 experience by providing a cloud-based Windows environment that is easy to manage, secure, and cost-effective. It allows organizations to scale Cloud PCs without local data or applications. Over the past year, it has expanded into new regions and industries such as manufacturing, healthcare, retail, and professional services. Organizations using Windows 365 Link have reported benefits like reduced management burdens and seamless access for workers. The partner network has grown to over 200 resellers in 20 countries, facilitating quick deployment. Upcoming updates include support for Bluetooth device pairing, tenant branding, USB redirection, and visibility into pending updates on sign-in screens.
Microsoft’s Patch Tuesday release for April is a whopper
Winsage
April 18, 2026

Microsoft’s Patch Tuesday release for April is a whopper

A series of updates have been released, focusing on system integrity and performance. Users should perform verification tasks, including installing, uninstalling, and repairing MSI packages, connecting and disconnecting cloud sync providers, and enrolling devices in Intune or MDM solutions. The Common Log File System driver (clfs.sys) is receiving a follow-up patch, along with updates to Storage Spaces (spaceport.sys) and app isolation file system drivers (bfs.sys, wcifs.sys). Users should also run Windows Update installation and rollback cycles, install and uninstall applications, and verify data integrity through backup solutions. For Storage Spaces, creating a pool with mirrored and thin virtual disks and ensuring clean deletion is necessary. April's updates for Office target MSI editions, including Excel 2016 (KB5002860), PowerPoint 2016 (KB5002808), Office 2016 shared libraries (KB5002859), and SharePoint Server editions from 2016 to 2019. These updates do not apply to Click-to-Run deployments like Microsoft 365 Apps. Users should validate complex Excel workbooks, PowerPoint presentations, SharePoint document libraries, and the functionality of Office add-ins. Testing for two High Risk components is essential: changes to Kerberos may disrupt services using RC4 keytabs, and the Remote Desktop client update requires validation of clipboard functionality, printer redirection, and session reconnection. Validating Secure Boot and BitLocker is critical as CVE-2023-24932 key rolling progresses. Additionally, cloud sync testing is important due to five patches to the Projected File System driver, and regression testing is needed for dual afd.sys updates and VPN/IPsec patches across remote-access infrastructure. Office updates are limited to MSI editions.
"More secure, reliable, user-friendly": Microsoft explains why it quietly killed Windows 11's phone activation option
Winsage
April 13, 2026

“More secure, reliable, user-friendly”: Microsoft explains why it quietly killed Windows 11’s phone activation option

Microsoft has discontinued the last method for activating Windows 10 or Windows 11 without an Internet connection, specifically the telephone activation option. Users have reported confusion and frustration as the option remained visible in Windows, but attempts to use it led to redirection to online portals. Microsoft has not fully disclosed the reasons for this change, but it aligns with a shift towards digital solutions and emphasizes the importance of Internet connectivity in software management.
Microsoft Copilot Cowork is Now Available to Windows Users
Winsage
April 5, 2026

Microsoft Copilot Cowork is Now Available to Windows Users

Microsoft has introduced early access to Copilot Cowork through its Frontier program, enhancing the Researcher feature to improve planning, analysis, and decision-making workflows. Copilot Cowork is an AI system designed to manage complex, multi-step tasks within Microsoft 365, allowing users to set outcomes and receive real-time updates while enabling adjustments as needed. It is based on the Claude Cowork framework by Anthropic. The Researcher tool now includes a Critique feature that uses two AI models, GPT and Claude, to improve response accuracy, resulting in a 13.8% performance boost on the DRACO benchmark. Additionally, the Model Council feature allows users to compare outputs from multiple AI models side by side. These updates are part of Wave 3 of Microsoft 365 Copilot, aiming to make AI a more active participant in work tasks.
Netflix Automates RDS PostgreSQL to Aurora PostgreSQL Migration Across 400 Production Clusters
Tech Optimizer
March 11, 2026

Netflix Automates RDS PostgreSQL to Aurora PostgreSQL Migration Across 400 Production Clusters

Netflix has developed an internal automation platform to migrate Amazon RDS for PostgreSQL databases to Amazon Aurora PostgreSQL, reducing operational risks and downtime for nearly 400 production clusters. The platform allows service teams to perform migrations through a self-service workflow while ensuring processes like replication validation and rollback safeguards are maintained. Database access is managed through a platform-managed layer using Envoy, which standardizes mutual TLS and abstracts database endpoints, enhancing security and efficiency. The migration process starts with creating an Aurora PostgreSQL cluster as a read replica of the source RDS instance, initialized from a storage snapshot and continuously replaying write-ahead log (WAL) records. Validation checks are performed to ensure the replica can handle peak write throughput before cutover. For change data capture workloads, the system coordinates the state of replication slots and pauses CDC consumers to prevent excessive WAL retention. The Enablement Applications team at Netflix successfully migrated databases for device certification and partner billing workflows, addressing issues like elevated replication lag due to inactive logical replication slots. As replication lag decreases, the system enters a controlled quiescence phase, adjusts security rules, and reboots the source RDS instance. Once all transactions are processed and the Aurora replica is ready, it is promoted to a writable cluster, and traffic is rerouted. Rollback capabilities are prioritized, allowing redirection back to the original RDS instance if validation checks fail or anomalies are detected post-promotion. This setup enables seamless restoration without redeployment, and CDC consumers can resume from recorded slot positions if needed.
GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection
Tech Optimizer
February 10, 2026

GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection

GuLoader, also known as CloudEye, is a downloader malware that has been active since late 2019, primarily used to fetch and install secondary malware like Remote Access Trojans (RATs) and information stealers. It employs legitimate cloud services such as Google Drive and Microsoft OneDrive to host its malicious payloads, allowing it to evade detection by security tools. GuLoader utilizes advanced techniques including polymorphic code, which alters its appearance to avoid static detection signatures, and exception-based control flow to confuse analysis tools. Over the years, GuLoader has refined its tactics, including the use of software breakpoints and various exception types to redirect its operations. It also employs dynamic XOR encryption to obfuscate internal data, making it difficult for analysts to extract URLs. The malware's continuous evolution poses ongoing challenges for security researchers. Indicators of Compromise (IOCs) include specific hash values for different versions of GuLoader from 2022 to 2024.
EDRStartupHinder Disables Antivirus and EDR Protections During Windows 11 25H2 Startup
Winsage
January 12, 2026

EDRStartupHinder Disables Antivirus and EDR Protections During Windows 11 25H2 Startup

A new tool named EDRStartupHinder was unveiled on January 11, 2026, which allows attackers to inhibit the launch of antivirus and endpoint detection and response (EDR) solutions during the Windows startup process. Developed by security researcher Two Seven One Three, it targets Windows Defender and various commercial security products on Windows 11 25H2 systems by redirecting essential system DLLs during boot using the Windows Bindlink API and Protected Process Light (PPL) security mechanisms. The tool employs a four-step attack chain that includes creating a malicious service with higher priority than the targeted security services, redirecting critical DLLs to attacker-controlled locations, and modifying a byte in the PE header of the DLLs to cause PPL-protected processes to refuse loading them. This results in the termination of the security software. EDRStartupHinder has been tested successfully against Windows Defender and other unnamed antivirus products, demonstrating its effectiveness in preventing these security solutions from launching. The source code for EDRStartupHinder is publicly available on GitHub, raising concerns about its potential misuse. Security teams are advised to monitor for Bindlink activity, unauthorized service creation, and registry modifications related to service groups and startup configurations to detect this attack vector. Microsoft has not yet issued any statements regarding patches or mitigations for this technique.
Search