Security Archives

AppWizard

August 13, 2026

Is Aptoide safe? I tried Android’s first alternative app store on Google Play

Google has introduced Aptoide, a decentralized marketplace for Android applications, to its Play Store following an antitrust ruling that requires Google to allow certified third-party app stores. Aptoide is available for installation in the US through the Play Store, while users outside the US can sideload it from its website. The Aptoide Games app is available on the Play Store but offers a limited selection of games, while the full Aptoide app, which has a broader range of software, must be sideloaded. Aptoide's safety depends on the applications installed, and while it previously had a feature to indicate safe apps, this is no longer present in the app. Users should verify app developers to ensure safety, as Aptoide allows anyone to upload apps.

Tech Optimizer

August 13, 2026

Enforcing TLS and managing certificate rotation for RDS and Amazon Aurora PostgreSQL

When an Amazon RDS certificate expires and the application’s trust store is outdated, it can cause connection failures. AWS announces Certificate Authorities (CA) rotation events in advance and provides management tools, but a lack of proactive certificate lifecycle management can lead to unplanned downtime. Default configurations for RDS and Amazon Aurora allow both encrypted and unencrypted PostgreSQL connections, which can expose sensitive data if not properly configured. AWS manages the Certificate Authority infrastructure and provisions server certificates, while users are responsible for enforcing TLS usage and managing the rotation lifecycle. Amazon RDS employs a managed Certificate Authority hierarchy that issues server certificates for each database instance, supporting TLS 1.2 and TLS 1.3. The solution to enforce TLS includes server-side enforcement with the rds.force_ssl parameter, client-side verification with the sslmode=verify-full parameter, and automated lifecycle monitoring using Amazon EventBridge, AWS Lambda, and Amazon CloudWatch. Prerequisites for implementing this solution include an AWS account with an Amazon RDS for PostgreSQL or Amazon Aurora PostgreSQL instance, IAM permissions for relevant services, a compatible PostgreSQL client, familiarity with Amazon RDS parameter groups, and the openssl CLI. The rds.force_ssl parameter controls whether Amazon RDS rejects non-SSL connections, with defaults varying by PostgreSQL version.

AppWizard

August 13, 2026

Starship job simulation game Contact Protocol launches in spring 2027 for PS5, Xbox Series, Switch 2, and PC

Kinetic Publishing has partnered with Cold Zephyr Games to release the starship job simulation game Contact Protocol on PlayStation 5, Xbox Series, Switch 2, and PC via Steam, with a planned release in spring 2027. The game places players in the role of a security officer aboard the starship Pale Horse, requiring them to assess the intentions of approaching ships and make critical decisions that can have significant consequences. Key features include investigating incoming data, multitasking under pressure, and making choices that affect relationships and narratives. The game offers unique procedural encounters and a visually striking science-fiction world. A video and screenshots showcasing the game have been released.

Winsage

August 13, 2026

Microsoft’s August update fixes a Windows flaw that’s already being attacked

The upcoming Patch Tuesday is scheduled for September 8th, 2026, during which Microsoft will address over 200 vulnerabilities across Windows platforms, including Windows 10, Windows 11, and Windows Server. Windows 10 users in the Extended Security Updates (ESU) program will receive updates until October 2027. Among the vulnerabilities, CVE-2026-68820 allows attackers to gain elevated privileges through the Windows auxiliary function driver for Winsock. Microsoft has identified 18 vulnerabilities as critical, including CVE-2026-62878, an RCE vulnerability in the Windows DNS server that can lead to a buffer overflow and code execution without user interaction. Another critical issue is CVE-2026-62893, a UAF vulnerability in the TFTP server of Windows Deployment Services, which allows code injection through UDP port 69. Additionally, CVE-2026-62815, an RCE vulnerability in Quick UDP Internet Connections (QUIC), permits code execution without user interaction, while CVE-2026-59124, although high risk, is not classified as critical due to the HPC Pack not being enabled by default.

Winsage

August 12, 2026

Microsoft fixes 421 bugs and a Windows zero-day in August Patch Tuesday

Microsoft's August Patch Tuesday update addressed 421 vulnerabilities across various products, including multiple versions of Windows (11 25H2/24H2, 11 23H2, and 10). A critical zero-day flaw, the "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability," allows attackers with lower-level access to gain system privileges without user interaction. Additionally, the update addresses two other zero-day flaws, including the "Windows User Profile Service Elevation of Privilege Vulnerability," which has not yet been exploited but was publicly disclosed. The update is mandatory and should automatically install on supported PCs, with users encouraged to verify its application. The update also includes minor improvements to Windows features, such as enhancements to File Explorer, Windows Hello, Voice Access, and touchpad controls.

Winsage

August 12, 2026

Windows 11 Gets Dynamic File Sizes in File Explorer, Low Latency Profile for Apps, and More

Microsoft's August update, KB5121003, includes several enhancements: - The File Explorer now displays file sizes in kilobytes (KB), megabytes (MB), or gigabytes (GB) dynamically, simplifying file management. - The Low Latency Profile is expanded to more applications, improving launch speeds for Microsoft apps like Edge and Outlook by up to 40%, and other system components by up to 70%. - Windows Search has been improved to better handle typos and incomplete queries, prioritizing relevant results and indexing files across the operating system. - The Start Menu now more effectively respects user preferences, ensuring consistent settings.

Winsage

August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.

Winsage

August 12, 2026

Windows 11 ships nine AI components, you can delete one

Microsoft announced the release of new AI components for Windows 11 Home and Pro editions, documented in KB5101684 on July 28, 2026, introducing the Windows Copilot+. Additionally, updates KB5121003 and KB5121000 were released on August 11, 2026, focusing on performance enhancements, bug fixes, and optimizing user experience.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Winsage

August 12, 2026

Smart PC users are upgrading to Windows 11 Pro while it’s only $10

Windows 11 Pro is available for .97, reduced from its regular price of 9, until August 20. The operating system features a modern user interface, enhanced multitasking, improved security with BitLocker, virtualization capabilities with Hyper-V, integration with Azure AD, and an AI-powered Copilot.