NewApp Digest
search bot

security vulnerability

Android bug puts users at risk, sending unauthorised messages
AppWizard
July 22, 2026

Android bug puts users at risk, sending unauthorised messages

A security vulnerability is affecting Android devices from various manufacturers, requiring direct access to the device, which poses a risk if a smartphone is lost or stolen. Users are advised to restrict Gemini's access to the lock screen by disabling options related to Gemini on the lock screen and limiting its access to specific applications. Google has confirmed a solution to this issue, which will be implemented through an Android update later this week, and users are encouraged to keep their Android version up to date.
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
Winsage
July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.
Microsoft says stop waiting to install Windows updates. Here's why
Winsage
July 14, 2026

Microsoft says stop waiting to install Windows updates. Here’s why

Microsoft has revised its guidance on Windows updates, urging users to install them within three days due to the rise of AI-driven cyber threats. Jeremy Chapman from Microsoft 365 emphasized the need for timely updates, recommending a maximum deferral period of two days for quality updates. In June, Microsoft patched 206 vulnerabilities, highlighting the importance of these updates to avoid significant risks. AI can help attackers exploit vulnerabilities quickly, making the practice of delaying updates obsolete. Microsoft has also developed an AI tool, MDASH, to identify vulnerabilities in Windows code.
Microsoft Details How It’s Using AI to Improve Windows Security
Winsage
July 9, 2026

Microsoft Details How It’s Using AI to Improve Windows Security

Microsoft has reaffirmed its commitment to security, focusing on enhancing protection for Windows users. The company is utilizing a multi-model agentic scanning harness (MDASH) that incorporates various AI models to identify Windows vulnerabilities earlier in the development process. This proactive approach allows security experts to detect potential issues before public releases. Microsoft is also investing in technologies that use AI to streamline the development of fixes while maintaining human oversight during code reviews. The company acknowledges the dual nature of AI in security, as it accelerates both the identification of vulnerabilities and the potential for exploitation. Microsoft aims to strengthen its systems to find vulnerabilities earlier and deliver timely security patches to customers.
Microsoft just broke custom folder icons in Windows, and the reason is a bug from 2003
Winsage
July 6, 2026

Microsoft just broke custom folder icons in Windows, and the reason is a bug from 2003

Microsoft has updated Windows to stop trusting untrusted desktop.ini files, a change aimed at addressing a long-standing security vulnerability that has existed since 2003. This decision affects the display of custom folder icons, as Windows will now ignore customization metadata from potentially unsafe sources. Users can still use custom folder icons if the desktop.ini file and icon resources come from trusted locations. A workaround allows users to manually create a desktop.ini file with the desired icon while following new security protocols.
Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service
Tech Optimizer
June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.
Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address
AppWizard
May 15, 2026

Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address

A security vulnerability in Android 16 allows malicious applications to expose a user's real IP address, even with "Always-On VPN" and "Block connections without VPN" features activated. Discovered by security researcher 0x33c0unt and disclosed on April 30, 2026, the flaw exploits the registerQuicConnectionClosePayload feature, which lacks permission checks. This vulnerability has been verified on a Pixel 8 with Proton VPN active. Google has not released a patch, but users can disable the feature via ADB commands.
‘Unlimited Attack Vectors’—All Windows Versions At Risk From New Flaw
Winsage
April 28, 2026

‘Unlimited Attack Vectors’—All Windows Versions At Risk From New Flaw

Microsoft is facing a significant security vulnerability in its Windows operating system known as PhantomRPC, which allows for privilege escalation. Cybersecurity experts have expressed concern over the company's delayed response in issuing a patch for this flaw. The vulnerability resides within the Windows Remote Procedure Call (RPC) architecture and enables processes with impersonation privileges to elevate their permissions to SYSTEM level. Researcher Haidar Kabibo identified five distinct paths for exploitation, which require user interaction, coercion, or compromise of background services. Despite disclosing the vulnerability to Microsoft in September 2025, the company categorized it as moderately severe and did not issue a patch or a Common Vulnerabilities and Exposures (CVE) listing. Microsoft stated that the technique requires an already-compromised machine and emphasized the importance of following security best practices. Experts have criticized Microsoft's lack of action, arguing that it is operationally negligent and places the burden of risk management on users. In the absence of a patch, security professionals recommend focusing on access control and environmental hygiene to mitigate the risks associated with the vulnerability.
Microsoft Is Already Pulling Back On Its Windows Copilot AI Push
Winsage
April 14, 2026

Microsoft Is Already Pulling Back On Its Windows Copilot AI Push

Microsoft has integrated its generative chatbot, Copilot, into various aspects of the Windows operating system, leading to user dissatisfaction due to perceived compromises in the overall experience. Users have expressed frustration with Windows 11's problematic updates and system demands, coining the term "Microslop." Initially, Microsoft resisted this backlash, but as dissatisfaction grew, the company began to shift its strategy, acknowledging the need to address Windows' challenges. This included removing the Copilot button from Notepad in a recent preview build, while still maintaining AI functionality through a different button. Leadership changes at Microsoft suggest a potential realignment of priorities amid profitability challenges in the AI sector. Upcoming enhancements to Windows will restore legacy taskbar features, make Windows Update less intrusive, and improve File Explorer's performance. Additionally, the launch of Apple's budget-friendly MacBook Neo poses a challenge to Microsoft's affordable Windows market, as Apple adopts a more measured approach to AI. Microsoft must ensure that new Windows 11 laptop owners do not face performance issues or an overload of AI features.
Search