script Archives

Winsage

June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.

Winsage

June 16, 2026

Windows 11 KB5094126 BSODing, freezing, forcing BitLocker lockout, breaks OneDrive, and more

Microsoft rolled out Patch Tuesday updates for Windows 11, specifically KB5094126 and KB5093998, along with dynamic updates KB5094149, KB5095971, and KB5094156. Users have reported various issues post-update, including access difficulties with OneDrive and Dropbox, BitLocker recovery lockouts, and blue screens of death (BSOD), particularly the 0xc0430001 error on HP systems. This error may be linked to a previous bug affecting HP devices related to Secure Boot certificate updates. Users experiencing this error are advised to verify the presence of the boot.stl file on their installation media, as it is essential for Secure Boot. Microsoft recommends using the Update WinPE script to ensure the boot.stl file is included or manually transferring it from the WindowsBootEFI directory. Additionally, some Lenovo PC users have reported system freezes after the update. One user identified a conflict between KB5094126 and User Account Control (UAC) that affects OneDrive and Dropbox access in Explorer, noting that enabling UAC resolves the issue.

Tech Optimizer

June 14, 2026

Automate Amazon Aurora PostgreSQL major or minor version upgrade using AWS Systems Manager and Amazon EC2

Managing upgrades for the Aurora PostgreSQL-Compatible Edition can be labor-intensive and error-prone when done manually. Automating Amazon Aurora PostgreSQL upgrades can reduce manual effort by up to 80% and minimize downtime risks through consistent procedures. The automation solution uses AWS Systems Manager, Amazon EC2, and AWS Secrets Manager, structured around two modules: PREUPGRADE for readiness checks and UPGRADE for the actual upgrade process. The solution identifies upgrade candidates using database tags, creates safety backups with Copy-on-Write clones, manages the upgrade process with minimal human intervention, and offers real-time monitoring and email notifications. The workflow includes logging into the Systems Manager console, downloading the upgrade script, identifying Aurora PostgreSQL clusters based on tags, retrieving credentials from AWS Secrets Manager, executing pre-upgrade checks or upgrades, uploading log files to Amazon S3, and sending email notifications via Amazon SNS. Prerequisites include familiarity with the Aurora upgrade process, appropriate IAM permissions, creating a maintenance user, setting up AWS Secrets Manager, tagging Aurora clusters, creating an S3 bucket, and configuring an SNS topic for notifications. Implementation steps involve reviewing setup instructions, uploading the upgrade script to S3, creating an AWS Systems Manager automation document, executing the automation document, and monitoring the upgrade process through logs generated during pre-upgrade and upgrade phases. The logs provide detailed information on tasks performed, including replication slot status and configuration backups. After testing, it is recommended to clean up resources to avoid future charges.

Winsage

June 13, 2026

I tried Microsoft’s new AI-powered Terminal, and it is a surprisingly different experience

Windows 11 has introduced a new command-line tool called "Intelligent Terminal," which is a fork of the open-source Windows Terminal project and integrates an AI agent, specifically GitHub Copilot by default. Users must manually download and install the Intelligent Terminal, which retains the familiar Windows Terminal interface but adds a side panel for AI interaction. Upon first launch, users select an Agent Client Protocol (ACP) compatible agent, with options to enable features like automatic error detection and session management. The Intelligent Terminal offers two main experiences: agent chat and agent management. The agent chat pane allows users to inquire about errors and receive assistance, while the agent management pane tracks active and past agent sessions. Users can also utilize other agents like Claude Code, Google Gemini, and OpenAI Codex, provided they are installed locally. The Command Palette is enhanced with AI actions, allowing users to initiate tasks without interrupting their workflow. Users can customize terminal and agent settings, including pane position and error detection features. Adjustments require saving to apply changes.

AppWizard

June 13, 2026

Don’t expect the Death Stranding movie to retell the story of the games, as its director says the film will be set in his ‘own corner of the world’

The cinematic adaptation of the video game Death Stranding has been in development since its announcement in 2022. Director Michael Sarnoski is currently writing the script and is collaborating with A24, which has expressed excitement about the project. Hideo Kojima has reacted positively to Sarnoski's script, recognizing film references within it. Additionally, a film adaptation of Elden Ring is in progress, with an expected release in 2028, and recent leaks suggest that Conwy Castle in North Wales may be used as a stand-in for Stormveil Castle from the game.

Winsage

June 12, 2026

Microsoft’s bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits

Nightmare-Eclipse, also known as Chaotic-Eclipse, has introduced two new exploits: RoguePlanet and GreatXML. RoguePlanet exploits a vulnerability in Windows Defender, allowing attackers to gain SYSTEM user access privileges by tricking a user into executing a script. This access enables attackers to execute commands beyond standard Administrator capabilities, siphon sensitive data, and install malware. GreatXML provides a method for bypassing BitLocker encryption by creating a specially crafted "unattend.xml" file and a "Recovery" directory on the Windows recovery partition. Microsoft has shifted its stance from threatening legal action against Eclipse and is now monitoring the situation, while Eclipse has postponed a planned mass disclosure of zero-day Windows vulnerabilities initially set for July 14 due to delays in developing RoguePlanet.

AppWizard

June 11, 2026

Your dad’s favorite show might become a videogame

Taylor Sheridan is writing the script for the upcoming Call of Duty movie, directed by Peter Berg and likely featuring Mark Wahlberg. Paramount Games Studio, led by Shawn Kittelsen, plans to transform Yellowstone into a video game, alongside exploring other Paramount properties like Star Trek and Avatar: The Last Airbender. Kittelsen emphasized the importance of honoring the narratives and characters associated with these titles.

AppWizard

June 10, 2026

France’s Government Messaging App Tchap Got Breached

On June 7, 2026, Tchap, the French government's encrypted messaging platform for civil servants, experienced a significant breach detected by ANSSI. The breach resulted from a compromised user account and involved the education shard of Tchap, specifically targeting matrix.agent.education.tchap.gouv.fr. Approximately 650,000 messages, data from over 73,000 accounts, and about 13.5GB of documents and media files were allegedly scraped. The attacker also claimed to have discovered hardcoded LDAP credentials leaked through a PowerShell script shared by a regional director of the French tax authority. DINUM, the French Digital Affairs Directorate, stated that private conversations on Tchap are end-to-end encrypted and that the compromised account has been blocked. They notified CNIL about the potential exposure of personal data and reminded users to avoid sharing sensitive information in public chat rooms. The breach follows a mandate from Prime Minister François Bayrou in August 2025 requiring all civil servants to use Tchap, increasing its attractiveness as a target for cyber threats. The investigation into the breach is ongoing.

Tech Optimizer

June 9, 2026

Fake ChatGPT download site infects Windows and Mac users with malware

A counterfeit website, openew[.]app, is impersonating OpenAI's official ChatGPT download page and distributing malware. Windows users who download from this site receive a credential-stealing malware loader, while macOS users are infected with Odyssey Stealer, a variant associated with cryptocurrency theft. The fake site mimics the legitimate ChatGPT interface and uses HTTPS to appear trustworthy. The Windows malware, Chat_GPT.exe, creates a back channel to an attacker-controlled server, while the macOS malware captures sensitive data and attempts to replace legitimate cryptocurrency wallet applications with compromised versions. Users who download from official sources remain safe, but those who click on ads or unfamiliar links risk compromising their online accounts and sensitive information. Malwarebytes offers protection against this malware. Indicators of compromise include specific file hashes and network indicators associated with the malicious site.

Winsage

June 8, 2026

Microsoft answers what you must do as Windows 11 Secure Boot deadline hits in days

The expiration date of the original Microsoft Secure Boot KEK certificate is June 24, 2026. Microsoft held a live "Ask Microsoft Anything" session on June 4 to address concerns regarding this deadline. The expiration affects the KEK key, while the DB key remains valid until October. After June 24, Microsoft will not be able to sign new DBX payloads, which are necessary for revoking compromised bootloaders. Devices without the new KEK may miss future revocations, leading to decreased security but will not stop booting immediately. The June Patch Tuesday update is expected to classify most systems as high confidence. IT administrators are advised to use the Intune monitoring report for device status and updates. Devices in a "temporarily paused" status require OEM firmware updates. Administrators should not delay manual rollouts for devices outside the high confidence classification. Secure Boot must be enabled to update certificates, and re-enabling it later can pose risks. Older models may receive high confidence classification faster than newer ones due to statistical requirements. In PXE boot environments, caution is needed when updating bootloaders. The Secure Boot update mechanism is consistent across Windows 10 and 11, and event logs are important diagnostic tools. Key event log entries include 1801, 1802, and 1803, which indicate various device statuses and issues. Microsoft provides resources at aka.ms/GetSecureBoot for further guidance.