security flaws Archives

Winsage

April 14, 2026

Microsoft’s April Windows update fixes 165 flaws, one exploited zero-day

Microsoft has released its April 2026 Patch Tuesday updates for Windows 11, addressing a total of 165 vulnerabilities, including one zero-day exploit that has been actively targeted by malicious actors. The update aims to enhance security and improve overall system performance. Users are encouraged to promptly install the updates to mitigate risks associated with these vulnerabilities.

AppWizard

April 8, 2026

The FBI Warns That Foreign Cybercriminals Have Targeted Messaging App Users

Cybercriminals connected to Russian intelligence are conducting a large phishing campaign targeting messaging applications, impacting thousands of accounts worldwide. A joint advisory from the FBI and CISA reveals that these attacks focus on individuals with access to sensitive information, including government officials, military personnel, political figures, and journalists. The campaign relies on deception, with attackers impersonating official support channels on platforms like Signal, sending messages that prompt victims to click malicious links or provide confidential information. Victims who comply risk losing control of their accounts, allowing attackers to read private messages and access contact lists. This trend has been observed not only in the U.S. but also in the Netherlands, where similar tactics are used against government employees. The FBI notes that the security of the messaging apps is not the issue; rather, the vulnerability lies in human error. The rise of social engineering tactics poses a risk to both high-profile individuals and potentially everyday users, and users are advised to be cautious with unsolicited messages and not to share sensitive information.

AppWizard

February 24, 2026

Android mental health apps with 14.7M installs filled with security flaws

Recent analysis by Oversecured identified 1,575 security vulnerabilities across ten mental health mobile applications, which include 54 high-severity, 538 medium-severity, and 983 low-severity issues. These apps, with over 14.7 million downloads, assist users with conditions like clinical depression and anxiety. Vulnerabilities include improper handling of user-supplied URIs, weak local data storage practices, and cryptographically weak session token generation. Six of the ten apps had no high-severity vulnerabilities, but medium-severity issues still pose risks to user privacy. The scans were conducted between January 22 and 23, 2026, and only four apps had received recent updates.

AppWizard

February 21, 2026

Unsecured AI apps are leaking personal data of Android users

Many unregulated or inadequately secured AI applications on platforms like the Google Play store pose significant privacy risks to users. A specific Android application, "Video AI Art Generator & Maker," linked to a data leak, compromised 1.5 million user images, over 385,000 videos, and millions of AI-generated media files due to a misconfiguration in a Google Cloud Storage bucket. Another app, IDMerit, exposed sensitive know-your-customer data from users in 25 countries, including full names, addresses, birthdates, IDs, and contact information, totaling a terabyte of data. Both developers addressed the vulnerabilities after being alerted by researchers. However, cybersecurity experts warn that lax security among AI applications is a widespread issue, with 72 percent of analyzed Google Play apps exhibiting security flaws, including the practice of "hardcoding secrets" in their source code.

Winsage

February 16, 2026

Multiple Flaws Found in Microsoft Windows & Office — Could Let Hackers In

Microsoft has identified at least six zero-day vulnerabilities in Windows and Microsoft Office that were actively being exploited by hackers before patches were released. These vulnerabilities allow attackers to compromise systems with minimal user interaction, such as clicking on malicious links or opening compromised Office documents. Notable examples include a Windows Shell Security Bypass (CVE-2026-21510) and an Office File Exploit that can execute malicious code. The vulnerabilities pose serious risks, including active exploitation, remote code execution, and the potential for malware installation and credential theft. Microsoft has released security patches to address these vulnerabilities, and users are urged to install them immediately. The affected systems include all supported versions of Windows and Microsoft Office applications. Users are advised to install updates, be cautious with emails and links, enable security tools, and keep software up to date.

Winsage

February 14, 2026

Microsoft Fixes Critical Windows 11 Notepad Flaw

Microsoft has released a patch for a significant vulnerability in Notepad on Windows 11 that could allow attackers to execute code by opening a Markdown file and clicking on a malicious link. This vulnerability was due to how Notepad processed links within Markdown files, which could trigger unverified protocols to load remote content. The patch now includes a security warning before such links can be activated. Users are advised to check for updates via Windows Update and the Microsoft Store to ensure Notepad and related components are up to date. Security tips include inspecting URLs before clicking and keeping Microsoft Defender features enabled.

Tech Optimizer

January 29, 2026

Using Windows 10? Do This Now to Lower Your Risk of Being Hacked

Support for Windows 10 officially ended last year, and Microsoft recommends users transition to Windows 11 or buy new computers. Users will no longer receive security updates, and any issues encountered will not be supported by Microsoft. Windows Update will indicate that devices are no longer receiving updates, leaving users to manage security vulnerabilities themselves. Microsoft Defender Antivirus will continue to receive updates until October 2028, and users can enroll in Extended Security Updates (ESU) for an additional year of security updates until October 13, 2026, under certain conditions. Windows 11 installations surpassed Windows 10 in June 2025, with Windows 11 at 53.7% and Windows 10 at 42.7%. Users opting to stay on Windows 10 should implement third-party security solutions to mitigate risks from the lack of official updates.

Winsage

January 11, 2026

Windows 10 Users Are Being Targeted With New Upgrade Offer

A surge of attacks targeting Windows 10 machines highlights the need for users to upgrade to Windows 11 Pro, which is currently available at a discount of approximately 94% off its standard price. Windows 10 is becoming increasingly vulnerable as it approaches its end of support, leaving users exposed to cyber threats. The U.S. Cybersecurity and Infrastructure Security Agency warns that unsupported systems are often exploited by cybercriminals. Windows 10 remains widely used, making it a significant target for attackers, as evidenced by over billion in reported cybercrime losses in 2023. Windows 11 Pro offers enhanced security features, including BitLocker drive encryption, Credential Guard, and Smart App Control, along with a security-first design that requires compatible hardware. Current promotions allow users to purchase a Windows 11 Pro license for under 0, providing a one-time purchase option that includes updates until Microsoft ends support for Windows 11. Users are advised to check compatibility before upgrading and to back up important files. For those unable to upgrade, alternatives include purchasing Extended Security Updates or investing in new hardware that meets Windows 11 specifications.

Tech Optimizer

December 11, 2025

Hackers Are Targeting Windows 10 Users. Make Sure to Do This One Thing to Stay Safe

Microsoft has set the end of support for Windows 10 to October 14, 2025, after which users will not receive security updates or technical assistance. Windows 10 machines will continue to function, but users will face risks due to unaddressed security vulnerabilities. Microsoft has introduced the Extended Security Updates (ESU) program, extending support for eligible consumer editions until October 13, 2026, with specific enrollment criteria. Windows 11 installations surpassed Windows 10 in June 2025, with Windows 11 holding a 53.7% market share compared to Windows 10's 42.7%. Users can continue using Windows 10 by employing third-party security solutions, including antivirus programs and VPNs, to mitigate risks in the absence of Microsoft’s support.

Winsage

December 11, 2025

Microsoft’s Latest ‘Patch Tuesday’ Update Fixes These Three Zero-Days

Microsoft's December Patch Tuesday update addresses three critical zero-day vulnerabilities and a total of 56 bugs, including: - 28 elevation-of-privilege vulnerabilities - 19 remote-code-execution vulnerabilities - 4 information-disclosure vulnerabilities - 3 denial-of-service vulnerabilities - 2 spoofing vulnerabilities Three remote code execution flaws are classified as "critical." One zero-day vulnerability, CVE-2025-62221, allows attackers to gain SYSTEM privileges through the Windows Cloud Files Mini Filter Driver. The other two vulnerabilities fixed are: - CVE-2025-64671: A remote code execution vulnerability in GitHub Copilot for Jetbrains, exploitable via Cross Prompt Injection. - CVE-2025-54100: A PowerShell remote code execution vulnerability that can execute scripts from a webpage using Invoke-WebRequest. CVE-2025-62221 is attributed to MSTIC and MSRC, CVE-2025-64671 was disclosed by Ari Marzuk, and CVE-2025-54100 was identified by multiple security researchers.