NewApp Digest
search bot

reporting

PoC Exploit Released for Microsoft Windows Error Reporting ALPC Privilege Escalation
Winsage
March 4, 2026

PoC Exploit Released for Microsoft Windows Error Reporting ALPC Privilege Escalation

A proof-of-concept exploit for CVE-2026-20817, a local privilege escalation vulnerability in the Windows Error Reporting (WER) service, has been released by security researcher oxfemale on GitHub. This vulnerability allows low-privileged users to gain SYSTEM-level access through crafted Advanced Local Procedure Call (ALPC) messages. The flaw is located in the WER service's SvcElevatedLaunch method, which fails to validate caller privileges before executing WerFault.exe with user-supplied command line parameters. The CVSS v3.1 base score for this vulnerability is 7.8, indicating a high severity level. It affects unpatched versions of Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022 prior to the January 2026 update. Demonstrations have shown successful exploitation on Windows 11 23H2. Security teams are advised to monitor for unusual processes related to WerFault.exe, investigate missing SeTcbPrivilege in SYSTEM tokens, and review WER-related activities from low-privilege users. Immediate application of the January 2026 security patches is recommended, and a temporary workaround involves disabling the WER service.
PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation
Winsage
March 3, 2026

PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation

A critical local privilege escalation vulnerability, tracked as CVE-2026-20817, affects Microsoft Windows through the Windows Error Reporting (WER) service. This flaw allows authenticated users with low-level privileges to execute arbitrary code with full SYSTEM privileges. The vulnerability resides in the SvcElevatedLaunch method (0x0D) and fails to validate user permissions, enabling attackers to launch WerFault.exe with malicious command-line parameters from a shared memory block. The exploit affects all versions of Windows 10 and Windows 11 prior to January 2026, as well as Windows Server 2019 and 2022. Microsoft addressed this vulnerability in the January 2026 Security Update. Organizations are advised to apply security patches and monitor for unusual WerFault.exe processes.
Meta makes changes following a Solon man's $1 million loss in scheme police say started on Facebook Messenger
AppWizard
March 2, 2026

Meta makes changes following a Solon man’s $1 million loss in scheme police say started on Facebook Messenger

A 63-year-old resident in Solon, Ohio, lost over a million dollars to a scammer posing as a cryptocurrency investment guru. The scam began with a friendly outreach on Facebook, which transitioned to WhatsApp for private conversations. Over several months, the victim was convinced to invest in what he thought was a legitimate opportunity. This incident reflects a broader trend, as the FBI reported that Ohioans aged 60 and older lost over a million to fraud in 2024. Meta Platforms is enhancing tools to detect and disrupt fraudulent activities on its platforms, including new warnings for screen sharing requests on WhatsApp. In the first half of 2025, Meta removed eight million accounts suspected of scams and shut down 21,000 pages impersonating legitimate businesses. Warning signs in the Solon case included initial contact from a stranger, a quick shift to cryptocurrency discussions, and unusually high promised returns.
Spotify Android App Draws Ire For Rigid Gestures
AppWizard
March 1, 2026

Spotify Android App Draws Ire For Rigid Gestures

Spotify's Android app relies on mandatory swipe gestures that cannot be disabled, causing usability issues that conflict with Android's navigation system. This design choice has led to accidental actions, such as skipping tracks or altering playlists, particularly affecting users with motor or dexterity challenges. Research indicates that invisible gestures can lead to unintended activations, and guidelines recommend providing multiple input methods. A proposed solution is to introduce a Gestures menu for user customization, allowing users to disable or modify swipe actions. With Android's market share at around 70% and Spotify having approximately 626 million monthly active users, minimizing accidental actions could enhance user experience and provide a competitive advantage.
Is Microsoft really spying on you with Windows telemetry?
Winsage
February 27, 2026

Is Microsoft really spying on you with Windows telemetry?

Windows 10 was released in 2015 and faced criticism for its telemetry feature, which some viewed as a surveillance tool. In 2017, the Dutch Data Protection Authority found Microsoft's telemetry settings non-compliant with local privacy laws, leading to changes by Microsoft. Telemetry, termed diagnostic data by Microsoft, is essential for device reliability and security, with a baseline level of data collection set to "Required." Users can opt to limit data collection to this level. The Optional category of diagnostic data may include device settings and browsing history, raising privacy concerns. Microsoft introduced the Diagnostic Data Viewer in 2018 to enhance transparency, allowing users to inspect the telemetry data sent to them. As of now, Microsoft has over a billion monthly active Windows 11 users.
Windows Update KB5077241 February 2026 Issues Nvidia GPU Bugs Task Manager Errors and ViVeTool Guide
Winsage
February 26, 2026

Windows Update KB5077241 February 2026 Issues Nvidia GPU Bugs Task Manager Errors and ViVeTool Guide

Windows Update KB5077241, released in February 2026, is a 4.5GB feature update for the 24H2 and 25H2 versions. It poses significant performance risks for older hardware, particularly laptops and desktops without a Neural Processing Unit (NPU). Users with outdated Nvidia graphics cards, specifically the 900 Series (Maxwell) and 1000 Series (Pascal), report issues such as game stuttering, screen flickering, and system boot failures. The update also contains a flaw that inaccurately displays CPU usage in Task Manager, showing 0% utilization even under load. Many users face installation issues, encountering Error 0x800F0983, requiring them to delete update cache files and run repair tools. The update introduces features like a Taskbar Speed Test, Sysmon Security, improved Sleep/Wake functionality, and WebP wallpaper support, but many remain locked. Users can enable these features using ViVeTool with specific commands. Overall, the update is advised against for those with older Nvidia GPUs due to potential conflicts and performance issues.
Minecraft 26.1 Snapshot 10
AppWizard
February 25, 2026

Minecraft 26.1 Snapshot 10

Players can expect several enhancements in the latest update, including new particle effects for the Golden Dandelion that indicate whether it is preserving youth or reintroducing aging to mobs. The heads of baby zombie mobs have been resized for better proportions, and various bug fixes have been implemented. Changes include: - Rectification of a pixel gap in the Snifflet texture. - Baby Striders now have animated bristles. - Striders inherit warmth from the Strider they are standing on. - Reduced head sizes for baby Zombie, Husk, and Drowned mobs. - Golden Dandelion displays green particles to indicate aging status. - Small Armor Stands now display adult armor correctly scaled down. Technical updates: - Data Pack version updated to 99.3. - Resource Pack version updated to 82. New particle effects introduced: - Pausemobgrowth particles for paused aging. - Resetmobgrowth particles for reset aging. Bug fixes include: - Resolved cross-platform CJK IME support issues. - Fixed tridents enchanted with riptide usage while riding. - Addressed visual issues with cacti in higher resolution texture packs. - Corrected behavior of worried pandas during thunderstorms. - Fixed clipping issues with baby mobs' legs and armor. - Ensured baby piglin and zombified piglin legs sync with adults. - Resolved rendering issues in Spectator mode. - Corrected armor display on small armor stands. - Adjusted farmer cookie sales from 18 to 4. Snapshots are available for Minecraft: Java Edition, and players are advised to back up their worlds before testing.
Search