set Archives

Winsage

September 24, 2026

Microsoft: September Windows updates break Always On VPN connections

Microsoft has informed IT administrators about potential connection challenges with the Always On VPN after the September 2026 Windows 11 security updates. Users may face difficulties connecting to their organization's network, particularly if the VPN is set to automatically attempt an alternative connection method upon failure. Symptoms include connections remaining in a 'Connecting' state or displaying the error message: 'The specified port is already in use.' Affected versions include Windows 11, version 26H1 (KB5124012), version 25H2 (KB5124008), and version 24H2 (KB5124008). A temporary workaround involves adjusting the Always On VPN profile from automatic protocol selection to a single protocol (SSTP or IKEv2). Microsoft is also addressing various other issues related to Hyper-V, Remote Desktop Services, USB audio, and the File History backup feature.

AppWizard

September 23, 2026

Blame this Google Maps Android Auto bug for your next speeding ticket

A glitch in Google Maps is affecting Android Auto users, causing the speedometer feature to switch inconsistently between miles per hour (MPH) and kilometers per hour (KPH), regardless of user settings. Reports from users indicate that some see MPH when they prefer KPH and vice versa. The cause of the inconsistency is unclear, though one theory suggests proximity to international borders may be a factor.

Tech Optimizer

September 23, 2026

BigDiskBuster PoC Blocks Windows Defender Updates

A new tool named BigDiskBuster has been released on GitHub, which disrupts Microsoft Defender Antivirus by preventing it from installing updates. It does this by consuming available disk space during the update process, causing Defender to remain on its current version and unable to receive new platform or signature updates. BigDiskBuster operates as a local denial-of-service technique and requires prior access to the target machine to execute. The tool was created by researcher Abdelhamid Naceri, known as Nightmare Eclipse, who has previously worked on similar projects. As of now, there is no CVE identifier, patch, or advisory from Microsoft regarding this issue.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

AppWizard

September 23, 2026

Expert Opinions and Insights from the Tech Industry

The Android development community has historically addressed memory optimization reactively, but new performance requirements from Google Play, effective February 2027, emphasize proactive memory management. These requirements include metrics for dynamic memory usage, bitmap memory, and DEX code optimization, with apps needing at least 25% optimization coverage. Memory usage can now hinder releases even without local crash replication, necessitating its integration into the pre-production process alongside other performance metrics. Dynamic memory usage is defined as anonymous RSS plus swap, excluding file-backed data. Google Play will evaluate this across different application states and device performance categories. Bitmap memory is scrutinized for the retention of invisible bitmaps, and DEX optimization aims to reduce memory footprint and improve performance. Investigating memory growth involves using Android Studio’s Memory Profiler to monitor memory changes during specific user flows and conducting heap dumps to identify retained objects. Issues often arise from retained state, where components hold onto callbacks that reference image data, necessitating a focus on lifecycle management rather than merely cache size. Bitmap memory should be carefully managed, as the decoded size can significantly exceed the compressed file size. Downsampling images to match UI dimensions is crucial. Memory checks should occur before production, with a focus on establishing a memory budget based on actual measurements and defining representative memory scenarios for testing. A pre-release memory checklist includes running user flows repeatedly, testing on various devices, inspecting heap dumps, examining image configurations, and reviewing optimization metrics. Monitoring Android vitals and Play Console warnings is essential to detect potential issues before they lead to user-reported crashes.

AppWizard

September 23, 2026

Google Recorder could soon fix its biggest drawback for power users

The Google Recorder app is set to introduce a new feature in version 4.2.2 that allows users to access audio recordings through the Files by Google app or other file manager applications. A toggle labeled “Access recordings in other apps” will enable future recordings to be automatically saved to the device's internal storage in a designated Recordings folder. Existing recordings will not be affected by this change, and the app will remember user preferences even when switching devices or clearing app data. This update is expected to roll out through a server-side update, though the timeline is uncertain.

AppWizard

September 23, 2026

New Google Maps Speedometer Headache on Android Auto, Users Calling for Another Fix

The Google Maps speedometer feature has been experiencing a glitch where it fluctuates between kilometers per hour (kph) and miles per hour (mph), causing confusion for users, particularly those set to kph. This issue requires users to restart the app to restore their preferred settings, which is cumbersome on Android Auto. Some users report that the speedometer switches to mph while the settings still indicate kph, highlighting a disconnect between user preferences and app functionality. Google has not yet addressed this issue publicly. Additionally, a new speedometer feature that operates without a destination has faced challenges, including its disappearance after an update in early September, which Google stated was part of the rollout process. The feature is expected to be widely available by the end of the year. Users experiencing the glitch are advised to force-close the app when the unit switches to mph.

AppWizard

September 23, 2026

Spotify could soon fix a major storage issue that users have complained about for years

Spotify is developing a "Cache Limit" feature for Android users that will allow them to manage the local storage used by temporary files. This feature aims to give users control over the app's caching behavior, which currently operates automatically and can accumulate several gigabytes of data over time. Users can manually clear the cache but may find it tedious. The new feature will enable users to set a cap on storage for temporary files, with notifications about the implications of their choices, such as increased data usage or potential effects on playback quality. The feature will not affect downloaded music or podcasts and is expected to first appear in the beta version of the app before being rolled out to all users.

AppWizard

September 23, 2026

Hello, Googlebook: The complete FAQ on Google’s Android-ChromeOS combo

The Googlebook features the Magic Pointer for easy navigation, seamless integration with Android devices for file management, and the Rambler natural-language voice-to-text system for accurate dictation. It includes the Create My Widget system for personalized widgets, a Quick Insert menu for quick access to functions, and a glowbar design element. These innovations aim to enhance user experience and productivity.