security issues Archives

Winsage

April 18, 2026

‘They mopped the floor with me and pulled every childish game they could’: Disgruntled researcher releases second major Windows zero-day — claims Microsoft ‘would ruin my life, and they did’

A new zero-day vulnerability in Microsoft Defender has been disclosed by a researcher known as "Chaotic Eclipse," who has created a proof-of-concept exploit called "RedSun." This vulnerability allows local privilege escalation to SYSTEM level on Windows 10, Windows 11, and Windows Server when Microsoft Defender is active. The vulnerability has attracted attention from antivirus vendors, with some detecting it on VirusTotal due to an embedded EIRCAR in the executable. Chaotic Eclipse previously disclosed another vulnerability named BlueHammer, which also allowed local attackers to gain SYSTEM or elevated permissions. The researcher expressed dissatisfaction with Microsoft's vulnerability disclosure process, recounting negative interactions with the company. A Microsoft spokesperson stated the company's commitment to investigating security issues and supporting coordinated vulnerability disclosure.

Winsage

April 18, 2026

‘They mopped the floor with me and pulled every childish game they could’: Disgruntled researcher releases second major Windows zero-day — claims Microsoft ‘would ruin my life, and they did’

A researcher known as “Chaotic Eclipse” has revealed a new zero-day vulnerability in Microsoft Defender, called “RedSun,” which allows local privilege escalation to SYSTEM privileges on Windows 10, Windows 11, and Windows Server when Microsoft Defender is enabled. The exploit has been confirmed to function correctly, and some antivirus vendors have begun detecting it. This follows another vulnerability disclosure by the same researcher, named BlueHammer, which also allows local attackers to elevate permissions. Chaotic Eclipse expressed dissatisfaction with Microsoft’s handling of vulnerability disclosures, claiming they were threatened and experienced frustration with the company’s response. A Microsoft spokesperson stated the company is committed to investigating reported security issues and supports coordinated vulnerability disclosure.

AppWizard

April 17, 2026

Google wants AI to make Android apps and make them well

AI is being utilized in software development, particularly in coding, with tools like ChatGPT, Claude, and Gemini enabling users to create functional applications. However, AI models often lag behind updates in the Android core, leading to potential bugs and security issues in the apps they generate. Google has responded by providing real-time access to its official Android guidelines for AI coding agents and has introduced new tools to improve app development. This initiative allows AI agents to access the latest information from various developer resources, ensuring they can provide up-to-date guidance. Additionally, scaling AI applications across different devices has become easier, allowing Android apps to transition smoothly to platforms like smartwatches and tablets. The use of AI in app development is seen as a beneficial application amidst mixed feelings about AI-generated content in creative fields.

Winsage

April 14, 2026

Microsoft’s April Windows update fixes 165 flaws, one exploited zero-day

Microsoft has released its April 2026 Patch Tuesday updates for Windows 11, addressing a total of 165 vulnerabilities, including one zero-day exploit that has been actively targeted by malicious actors. The update aims to enhance security and improve overall system performance. Users are encouraged to promptly install the updates to mitigate risks associated with these vulnerabilities.

Winsage

April 10, 2026

Windows Zero-Day Published on Github as Microsoft Fails to Act

A security researcher named Chaotic Eclipse published a working exploit for a Windows zero-day vulnerability, called BlueHammer, on GitHub on April 2. The exploit allows attackers to gain SYSTEM-level privileges by exploiting a race condition in Windows Defender’s signature update mechanism. The exploit has gained significant attention, with over 100 forks and nearly 300 stars on GitHub. Will Dormann, a principal vulnerability analyst, confirmed that while BlueHammer is functional, it may not always operate reliably. Microsoft has not issued a patch for this vulnerability. The exploit targets the Windows Defender signature update process, allowing low-privilege attackers to manipulate a file path during operation, leading to access to the Security Account Manager (SAM) database. Currently, only 8 out of 72 cybersecurity vendors on VirusTotal flag the exploit file as malicious, which raises concerns about detection coverage. Microsoft reiterated its commitment to coordinated vulnerability disclosure but did not address the communication issues regarding the BlueHammer report.

Winsage

April 9, 2026

BlueHammer: Windows zero-day exploit leaked

A proof-of-concept (PoC) exploit called BlueHammer has been released on GitHub, targeting an unpatched local privilege escalation vulnerability in Windows. The exploit, attributed to users Chaotic Eclipse and Nightmare Eclipse, has been modified by security researchers to work on updated versions of Windows 10, 11, and Windows Server. The exploit manipulates Microsoft Defender to create a Volume Shadow Copy, allowing access to sensitive registry files and enabling the extraction of NTLM password hashes. This facilitates the alteration of a local Administrator's password and subsequent login. The exploit can duplicate the Administrator's security token and create a malicious Windows Service that runs with SYSTEM privileges. While there are no reports of BlueHammer being exploited by malicious actors, researchers warn that such PoC code can be weaponized quickly. Microsoft has committed to investigating reported security issues related to this vulnerability.

Tech Optimizer

April 3, 2026

Why I Use Additional Antivirus Protection on Top of Microsoft Defender

Microsoft Defender has evolved into a reliable security tool, integrating seamlessly with the Windows operating system and offering features such as real-time malware scanning, cloud-based threat intelligence, collaboration with the Windows firewall, and ransomware protections. It receives automatic updates through Windows Update, providing users with up-to-date threat definitions. While Defender is sufficient for users with straightforward online activities, those engaging in riskier behaviors or handling sensitive information may benefit from additional protection. Some antivirus solutions offer features that Defender lacks, such as enhanced web protections, phishing defenses, and parental controls. The text mentions that the author uses Bitdefender alongside Microsoft Defender for added security, citing its stronger web protections and broader range of tools. It emphasizes that effective security also relies on user habits, including keeping software updated, avoiding suspicious downloads, using strong passwords, and regularly backing up data.

AppWizard

April 3, 2026

Which messaging app takes the most limited approach to permissions on Android?

Messaging applications Messenger, Signal, and Telegram exhibit significant differences in permissions and operational behaviors that impact user privacy. Telegram has the fewest total permissions at 71, with 25 classified as dangerous; Signal requests 72 permissions, including 19 dangerous ones; and Messenger requests the most at 87, with 24 dangerous permissions. Messenger also has the highest number of vendor-specific unknown permissions. Access to sensitive resources is crucial for messaging functionalities, with permissions for contacts, camera, microphone, location, storage, and calendar being essential. Telegram and Messenger request additional system-level permissions, while Signal is more conservative and does not request certain permissions like phone-call control or overlay windows. The analysis, using the Mobile Security Framework (MobSF), indicates all three apps are in the medium risk category, with Messenger having more flagged issues. Telegram allows cleartext connections by default, potentially exposing traffic, while Signal uses encrypted connections by default and only permits limited cleartext traffic for certificate checks. Messenger's issues include world-writable files and remote debugging enabled in WebViews. Messenger uses third-party SDKs, while Signal and Telegram do not disclose third-party trackers. All three utilize Firebase Cloud Messaging for notifications without sensitive data leakage. Data exchange patterns show Messenger primarily routes traffic through North America, while Telegram and Signal focus on Europe with some additional connections in the U.S. and Asia.

AppWizard

March 15, 2026

Meta rolls out scam warnings on Facebook, Messenger, WhatsApp

Meta has launched a suite of AI-driven tools to enhance security on Facebook and Instagram, responding to challenges from scammers. In 2025, Meta removed over 159 million fraudulent ads and collaborated with law enforcement, resulting in the disabling of more than 150,000 accounts and 21 arrests. New features include real-time warnings for suspicious friend requests on Facebook, a WhatsApp alert system for fraudulent device linking, and expanded scam detection in Messenger. No new security measures have been announced for Instagram, which is experiencing a rise in password reset emails. Meta aims to increase verified advertisers in high-risk ad categories to 90% of ad revenue by the end of 2026, up from 70%.

AppWizard

March 13, 2026

World Day Against Cyber Censorship: RSF unveils new US room in its Minecraft Uncensored Library

The Uncensored Library has added a new room dedicated to the United States and updated content in sections for Egypt, Belarus, Russia, and Iran. The USA room includes analyses of press freedom and a political cartoon by Ann Telnaes that was rejected by the Washington Post. The library allows access to journalism from countries with censorship, using the Minecraft platform for broader reach. New articles include Elahe Mohammadi's piece on Evin Prison in Iran, two articles from MadaMasr in Egypt, over 20 articles from exiled Russian media, and six articles by exiled journalists in Belarus. The library has been visited by over one million users since its launch in 2020.