security vulnerabilities Archives

AppWizard

April 11, 2026

Security researchers find 213 vulnerabilities in Russia’s state-backed messaging app Max

Security researchers discovered 213 vulnerabilities in Max, Russia's state-backed messaging app, during a bug bounty initiative. This information was shared by Alexei Batyuk, CTO of Positive Technologies, at the Svyaz-2026 exhibition. The bug bounty program has been active since July 1, 2025, resulting in 288 accepted vulnerability reports and total payouts of nearly 22 million rubles. Common vulnerabilities could allow unauthorized access to user data through the manipulation of object identifiers. Max's press service claimed that user data is "reliably protected" and emphasized the importance of independent white-hat hackers in identifying vulnerabilities. Max was launched by VK in March 2025 and is being promoted by Russian authorities amid efforts to block other messaging platforms like Telegram and WhatsApp. The app has faced criticisms regarding user surveillance and security vulnerabilities.

AppWizard

April 9, 2026

Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk

Version 5.2.1 of the EngageSDK was released to address security vulnerabilities related to third-party SDKs, particularly affecting digital asset management applications. Although no exploitation of this vulnerability has been reported, developers are urged to upgrade to the latest version. The Android operating system's security model provides some protections against these vulnerabilities, and the Android team has updated user protections during the transition to the secure version. The vulnerability, classified as severe, allows unauthorized access to protected components and sensitive data through intent redirection. Affected applications, particularly in the cryptocurrency and digital wallet sectors, account for over 30 million installations. The vulnerability was first identified in version 4.5.4 of the EngageLab SDK, reported in April 2025, and was addressed in version 5.2.1 released on November 3, 2025, which set the vulnerable activity to non-exported. Developers are advised to regularly review their Android manifests and upgrade to the latest SDK version to maintain application security.

AppWizard

April 9, 2026

Conspiracy Theories Are Eclipsing the Real Dangers of Russia’s Messaging App Max

Russia's state-run messaging app, Max, allows authorities to monitor personal messages and calls extensively. Many Russians continue to use WhatsApp and Telegram, which are out of government reach. Following a WhatsApp ban, the government is considering restrictions on Telegram. Intelligence agencies have created bots on Telegram that can lead to legal consequences for users. The Max app offers complete surveillance of messages, photos, and calls without such provocations. Despite efforts to make Max appealing through features like age verification and integration with Gosuslugi, users are reluctant to switch from existing platforms. The government has attempted to position Max as the primary communication tool by potentially eliminating competitors, but Telegram's popularity remains a significant barrier. Recent decisions have eased restrictions on Telegram, and officials now emphasize that using Max is "optional." Some users, including officials, prefer to use Max on separate devices for security. Concerns about Max's geolocation capabilities and its access to other applications are often exaggerated, and the app has faced scrutiny regarding surveillance practices. Developers have reduced checks on VPN usage, but public distrust persists. Many users focus on the risks posed by Max while neglecting other security vulnerabilities. Effective risk mitigation requires a rational assessment of threats and increased digital literacy.

Tech Optimizer

April 8, 2026

Avast Antivirus: A Complete Guide to the Software and Its Security Features

Avast antivirus is a widely used digital security solution for mobile and desktop platforms, developed by Gen Digital. It offers a free version that is accessible and easy to set up, making it popular among first-time users. Key security features include real-time threat protection, web protection tools, email protection, behavior monitoring, and a network inspector. The software operates quietly in the background, has a clean and intuitive interface, and provides essential security features in its free version. However, users may experience intrusive upgrade prompts, and advanced tools require a paid subscription. Avast distinguishes itself by offering behavioral threat detection in both free and paid versions, and its extensive user base enhances its threat detection capabilities. The free version includes basic protections suitable for everyday online activities, but advanced features necessitate an upgrade. Users are encouraged to adopt strong passwords, utilize password managers, enable two-factor authentication, and practice safe browsing habits to ensure online privacy.

Winsage

April 7, 2026

Google offers free ChromeOS Flex upgrade for Windows 10 users

Over 500 million Windows 10 PC owners are unable to upgrade to Windows 11 and may face security vulnerabilities. Google is offering a complimentary upgrade to ChromeOS Flex for these users, along with a reusable USB Kit priced at approximately €3 to facilitate the transition. Support for Windows 10 ended in October 2022, prompting users to either invest in new devices or continue using an outdated system. Microsoft is providing a free extended support update for Windows 10 users until October 2023, but many remain on the unsupported operating system due to slow adoption of Windows 11. Transitioning to ChromeOS Flex can reduce energy consumption by an average of 19% compared to other operating systems, promoting device longevity and reducing electronic waste.

Winsage

April 5, 2026

Microsoft Ships Emergency Windows 11 Fix for Broken Patch

On March 31, Microsoft released emergency update KB5086672 in response to issues caused by the previous preview patch KB5079391, which left many Windows 11 devices in a loop with error code 0x80073712, blocking access to March security fixes. Microsoft withdrew KB5079391, which was launched on March 26, and replaced it with KB5086672, a cumulative update that includes all fixes from March 2026. KB5086672 supersedes previous updates, including KB5079473, KB5085516, and KB5079391. Users with the "Get the latest updates as soon as they’re available" setting will receive KB5086672 automatically, while others can manually check for updates or download it from the Microsoft Update Catalog. Microsoft has been issuing multiple emergency updates recently, raising concerns about the quality of its update pipeline, with a history of emergency patches for various issues affecting Windows 10, Windows 11, and Windows Server. The issues from KB5079391 may resurface in the upcoming April cumulative update.

Winsage

April 3, 2026

Microsoft now force upgrades unmanaged Windows 11 24H2 PCs

Microsoft has begun upgrading unmanaged devices running Windows 11 24H2 Home and Pro editions to the latest Windows 11 25H2 version. Support for Windows 11 24H2 will end on October 13, 2026. The 25H2 version rollout started in September and is delivered through compact enablement packages. The update is now available for all unmanaged devices running Windows 11 24H2, and those devices will stop receiving critical updates. Users can manually check for the update or pause it through the settings menu. Microsoft has provided a support document and guide for the upgrade process.

Winsage

April 1, 2026

New Windows 11 emergency update fixes preview update install issues

Microsoft released an out-of-band update (KB5086672) to address installation issues caused by the March 2026 non-security preview update (KB5079391) for Windows 11 versions 24H2 and 25H2. The initial update led to errors indicating missing or problematic update files, prompting Microsoft to halt its rollout. The new emergency update consolidates previous updates and is available through Windows Update for automatic installations or can be manually accessed via Settings. Additionally, Microsoft has addressed issues from earlier Patch Tuesday security updates affecting sign-ins with Microsoft accounts and has released two other out-of-band updates targeting Bluetooth visibility bugs and security vulnerabilities in the Routing and Remote Access Service. Guidance has also been provided for resolving access issues on C: drives of Samsung Windows 11 laptops linked to specific Samsung applications.

Winsage

March 30, 2026

Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products

On March 11, NSFOCUS CERT reported the release of Microsoft’s March Security Update, addressing 83 security vulnerabilities in products like Windows, Microsoft Office, Microsoft SQL Server, and Azure. The update includes eight critical vulnerabilities and 75 important ones, with risks such as privilege escalation and remote code execution. Key vulnerabilities include: - CVE-2026-26110: Microsoft Office Remote Code Execution Vulnerability (CVSS score: 8.4) - CVE-2026-26113: Microsoft Office Remote Code Execution Vulnerability (CVSS score: 8.4) - CVE-2026-26144: Microsoft Excel Information Disclosure Vulnerability (CVSS score: 7.5) - CVE-2026-23669: Windows Print Spooler Remote Code Execution Vulnerability (CVSS score: 8.8) - CVE-2026-24294: Windows SMB Server Privilege Escalation Vulnerability (CVSS score: 7.8) - CVE-2026-23668: Windows Graphics Component Privilege Escalation Vulnerability (CVSS score: 7.0) Affected product versions include various editions of Microsoft Office, Windows Server 2012 R2, Windows Server 2016, Windows 10, and Windows 11. Microsoft has released security patches for these vulnerabilities, and users are encouraged to install them promptly.

Winsage

March 27, 2026

Microsoft tells crusty old kernel drivers to get with the Windows Hardware Compatibility Program

Microsoft is enhancing the security of the Windows kernel by eliminating trust for kernel drivers not certified through the Windows Hardware Compatibility Program (WHCP) starting with the April 2026 Windows Update. This change specifically targets kernel drivers signed by the now-obsolete cross-signed root program, which has been associated with security vulnerabilities. The new policy will initially be introduced in an "evaluation mode" to monitor and audit driver loads for potential compatibility issues. Custom kernel drivers can still be used under the Application Control for Business policy, but must be signed by an authority within the device's Secure Boot Platform Key or Key Exchange Key variables. The changes will impact Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025.