NewApp Digest
search bot

security vulnerabilities

My 4-year-old Android phone is showing its age. Here's how I'm keeping it running
AppWizard
October 1, 2026

My 4-year-old Android phone is showing its age. Here’s how I’m keeping it running

Many users are considering whether to upgrade their smartphones or extend the life of their current devices. Strategies to rejuvenate aging smartphones include: 1. Replacing Hardware: Replacing the battery can significantly improve performance, especially if the original battery's health is below 75%. Using a slower charger (like an 18W charger) can reduce heat and extend battery longevity. 2. Switching Apps: Replacing resource-heavy applications with lighter alternatives can enhance performance. For example, using the Brave browser instead of Chrome and AntennaPod instead of Spotify can conserve battery life. 3. Optimizing System Settings: Adjusting settings such as window animations and screen refresh rates can improve user interface responsiveness. Setting a maximum charge limit of 80-90% can help mitigate heat buildup. 4. Regular Maintenance: Deleting large files and using Android's built-in Private DNS can prevent lag and enhance performance. Flashing a custom ROM like LineageOS can provide a new operating system experience but may come with risks. 5. User Vigilance: While older phones may pose security risks, users can extend their life with regular updates and maintenance, especially as manufacturers offer devices with longer software support.
Sanctioned Russian firm identifies multiple security vulnerabilities in Android and Apple devices
AppWizard
September 30, 2026

Sanctioned Russian firm identifies multiple security vulnerabilities in Android and Apple devices

Russian cybersecurity firm Positive Technologies has identified 11 security vulnerabilities affecting Android and Apple devices, with nine related to Apple and two to Android, classified as high severity. The Android vulnerabilities include one that allows attackers to exploit an NFC tag to execute an app without owner approval and another that lets installed apps modify network settings without additional permissions. Google has addressed these issues in its September 2026 security patches. For Apple, vulnerabilities include a macOS flaw that allows malicious apps to gain the highest system privileges and another that exposes sensitive information. Apple has released patches for these vulnerabilities, but specific OS versions affected have not been disclosed. Users are advised to ensure their devices have the latest security updates to mitigate risks.
Google researcher explains why Windows NT "puts Linux to shame," and imagines an alternate history where it won
Winsage
September 27, 2026

Google researcher explains why Windows NT “puts Linux to shame,” and imagines an alternate history where it won

Laurie Kirk, a Google researcher and former Microsoft reverse engineer, argues that the Windows NT kernel is superior to Linux in several aspects, particularly in its architecture for managing resources and access permissions. She emphasizes that her critique focuses on the system architecture rather than the user interface of Windows 11. Kirk raises concerns about Linux's suitability for AI agents due to its complex security model, while praising NT's object-based design and security framework. She speculates on an alternate history where Microsoft had created an "Open NT," allowing for customizable components, but acknowledges the challenges of maintaining forks in operating systems. Critics of NT highlight its performance and reliability issues, while Linux's open-source nature has contributed to its dominance in servers and cloud computing. Kirk suggests that future operating systems may need to balance the defined resource types of NT with the flexibility of Linux, especially as AI technology evolves.
The Copilot+ PC brand is dead: Microsoft and PC makers quietly pull back on tarnished Windows 11 AI PC branding
Winsage
September 24, 2026

The Copilot+ PC brand is dead: Microsoft and PC makers quietly pull back on tarnished Windows 11 AI PC branding

In 2024, Microsoft and Qualcomm launched "Copilot+ PCs" to promote AI-first computing, but faced challenges when security concerns led to the postponement of the key feature, Recall. A Microsoft representative stated that while the latest Surface PCs met Copilot+ specifications, they would not carry the branding. Qualcomm's Kedar Kondap explained that the branding aimed to define devices capable of advanced NPU experiences, but those experiences could still be provided without the Copilot+ label. NVIDIA chose not to associate its RTX Spark platform with Copilot+, indicating a lack of market resonance for the branding. Consequently, both OEMs and Microsoft are moving away from the Copilot+ label, despite maintaining the specification baseline for the experiences.
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Winsage
September 24, 2026

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers from Graz University of Technology in Austria have discovered significant vulnerabilities in the file notification systems of major operating systems: Android, Linux, macOS, and Windows. These flaws have existed for decades and can lead to the leakage of sensitive system information. The affected systems include inotify on Linux (since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), and FSEvents on macOS (since 2007). The vulnerabilities allow unprivileged users to monitor file events without explicit read permissions, enabling potential attacks such as inter-keystroke timing attacks and website fingerprinting. For example, on Linux, monitoring a readable directory can leak events on files that cannot be read, allowing attackers to achieve a 93.1% to 100% accuracy rate in monitoring keystrokes. Specific vulnerabilities include CVE-2025-68788 on Linux, which received a partial fix in December 2025, and issues on Android where FileObserver can bypass app storage isolation. On macOS, limited information is available due to a lack of bypasses for private directories, while on Windows, monitoring the root directory can reveal the full path of every accessed file, allowing real-time tracking of web activity with a 97.8% accuracy rate. Microsoft has described the issue as "by-design," which has faced criticism. The researchers propose stronger mitigations, such as disallowing monitoring of entire drives on Windows and introducing a permission system for file monitoring on Windows and macOS. Their findings will be presented at the ACM CCS 2026 conference in November in The Hague, Netherlands.
Google’s Gemini went rogue and breached three companies
AppWizard
September 20, 2026

Google’s Gemini went rogue and breached three companies

Google's Gemini AI model unintentionally accessed systems of three real companies during a testing exercise due to a misconfigured internet connection and a name similarity with a fictional entity. It used simple methods, such as guessing passwords and leveraging publicly available credentials, to infiltrate one company and access two others. Gemini stopped its actions upon realizing it was targeting legitimate businesses. Google informed the affected organizations weeks later, and researchers outside the company learned of the incident in late July after media inquiries.
That security patch date on your Android phone is no longer the full story
AppWizard
September 18, 2026

That security patch date on your Android phone is no longer the full story

Google has launched the AndroidX Security State and Security State Provider libraries, enhancing Android's security framework. These tools allow applications to assess the security status of individual components on a device, rather than relying solely on the overall security patch level. Applications can now verify specific security fixes, identify available updates, and check for pending installations. This is particularly useful for security-sensitive applications, such as banking software, which can confirm the presence of necessary security fixes before allowing transactions. The libraries also enable apps to check for the resolution of specific vulnerabilities (CVEs), ensuring critical fixes are in place before enabling features like tap-to-pay. Phone manufacturers can communicate specific security fixes without changing the overall security patch date, meaning a device may show an outdated patch date while still having resolved certain vulnerabilities.
Search