NewApp Digest
search bot

security vulnerability

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service
Tech Optimizer
June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.
Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address
AppWizard
May 15, 2026

Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address

A security vulnerability in Android 16 allows malicious applications to expose a user's real IP address, even with "Always-On VPN" and "Block connections without VPN" features activated. Discovered by security researcher 0x33c0unt and disclosed on April 30, 2026, the flaw exploits the registerQuicConnectionClosePayload feature, which lacks permission checks. This vulnerability has been verified on a Pixel 8 with Proton VPN active. Google has not released a patch, but users can disable the feature via ADB commands.
‘Unlimited Attack Vectors’—All Windows Versions At Risk From New Flaw
Winsage
April 28, 2026

‘Unlimited Attack Vectors’—All Windows Versions At Risk From New Flaw

Microsoft is facing a significant security vulnerability in its Windows operating system known as PhantomRPC, which allows for privilege escalation. Cybersecurity experts have expressed concern over the company's delayed response in issuing a patch for this flaw. The vulnerability resides within the Windows Remote Procedure Call (RPC) architecture and enables processes with impersonation privileges to elevate their permissions to SYSTEM level. Researcher Haidar Kabibo identified five distinct paths for exploitation, which require user interaction, coercion, or compromise of background services. Despite disclosing the vulnerability to Microsoft in September 2025, the company categorized it as moderately severe and did not issue a patch or a Common Vulnerabilities and Exposures (CVE) listing. Microsoft stated that the technique requires an already-compromised machine and emphasized the importance of following security best practices. Experts have criticized Microsoft's lack of action, arguing that it is operationally negligent and places the burden of risk management on users. In the absence of a patch, security professionals recommend focusing on access control and environmental hygiene to mitigate the risks associated with the vulnerability.
Microsoft Is Already Pulling Back On Its Windows Copilot AI Push
Winsage
April 14, 2026

Microsoft Is Already Pulling Back On Its Windows Copilot AI Push

Microsoft has integrated its generative chatbot, Copilot, into various aspects of the Windows operating system, leading to user dissatisfaction due to perceived compromises in the overall experience. Users have expressed frustration with Windows 11's problematic updates and system demands, coining the term "Microslop." Initially, Microsoft resisted this backlash, but as dissatisfaction grew, the company began to shift its strategy, acknowledging the need to address Windows' challenges. This included removing the Copilot button from Notepad in a recent preview build, while still maintaining AI functionality through a different button. Leadership changes at Microsoft suggest a potential realignment of priorities amid profitability challenges in the AI sector. Upcoming enhancements to Windows will restore legacy taskbar features, make Windows Update less intrusive, and improve File Explorer's performance. Additionally, the launch of Apple's budget-friendly MacBook Neo poses a challenge to Microsoft's affordable Windows market, as Apple adopts a more measured approach to AI. Microsoft must ensure that new Windows 11 laptop owners do not face performance issues or an overload of AI features.
Microsoft Provides a Secure Boot Certificate Update
Winsage
April 2, 2026

Microsoft Provides a Secure Boot Certificate Update

Microsoft will roll out new Secure Boot certificates starting in April 2026, allowing users to access and understand their Secure Boot certificate status through the Windows Security app. This feature will be found under the Device security section in the Secure Boot area. Users with PCs manufactured in 2024 or later will have the necessary certificates, while older models will receive updates via Windows Update. The Windows Security app will use a color-coded system to indicate certificate status: a green check box for up-to-date certificates, a yellow bang for safety recommendations, and a red stop icon for critical issues. Further enhancements, including notifications and in-app guidance, will be introduced in May. Resources for IT administrators are available on Microsoft Support.
Think Windows 11 is annoying? These 4 Windows XP "nightmares" were way worse
Winsage
March 20, 2026

Think Windows 11 is annoying? These 4 Windows XP “nightmares” were way worse

Windows XP was launched in 2001 without an active firewall or integrated antivirus, exposing users to malware. The Internet Connection Firewall was included but not enabled by default, and it wasn't activated until Service Pack 2 was released nearly three years later. Microsoft introduced its antivirus solution, Microsoft Security Essentials, in 2009. Internet Explorer 6, included with Windows XP, had significant security vulnerabilities, allowing malware to easily infiltrate systems. The transition from Windows 95/98 to NT caused driver compatibility issues, leading to troubleshooting challenges for users. Network sharing features were unreliable, with many users experiencing difficulties connecting multiple XP PCs and sharing printers. Windows XP reached its refined state with Service Pack 3 in 2008 and ended mainstream support in 2014. Despite this, it continues to be used in some modern applications, such as self-checkout registers.
Norton is slashing up to 60% off its antivirus app — here's how to get it
Tech Optimizer
March 19, 2026

Norton is slashing up to 60% off its antivirus app — here’s how to get it

Norton 360 Deluxe is currently available at a discounted price of .99 per year, down from .99 per year, offering a 60% savings. It provides coverage for up to five devices and includes features such as file backup, a rescue disk for system recovery, and scam protection against phishing attempts. The software offers various scanning options: quick antivirus scan, full scan, and deep scan. It also includes ransomware protection that backs up critical files, and it is recognized for its extensive features and affordability compared to competitors.
Search