techniques Archives

Tech Optimizer

July 2, 2026

From monolith to Lakebase to LTAP: rethinking the database from storage up

Sixteen years ago, the author began their PhD at UC Berkeley and was advised to focus on analytics rather than OLTP databases, which were considered solved. This led to the creation of Apache Spark and Databricks. However, during the development of Databricks, it was found that OLTP databases were not solved problems; they were difficult to scale and fragile. This realization led to the development of Lakebase, a serverless Postgres database designed with modern technology. Lakebase architecture separates the write-ahead log (WAL) and data files into independent, scalable services. The WAL is externalized to a service called SafeKeeper, which uses Paxos-based replication for durability, while data files are managed by PageServer, which stores them in cloud object storage. This design addresses challenges such as data loss, scaling, and performance interference between transactional and analytical workloads. Lakebase maintains compatibility with Postgres, offers unlimited storage, serverless compute, durable writes, and simpler high availability. It also introduces LTAP (Lake Transactional/Analytical Processing), which allows both transactional and analytical processing to operate on a single data copy in real time, eliminating the need for separate data copies and reducing costs. LTAP utilizes a unified storage layer that allows data to be materialized in both row and columnar formats, optimizing it for both transactional and analytical workloads. The system ensures that analytics can access the most current data without affecting transactional performance by using a log sequence number (LSN) to retrieve the latest changes. Unlike traditional CDC approaches, LTAP requires no explicit table replication, as all data is stored in a single governed copy. This architecture circumvents common issues faced by hybrid transactional/analytical processing (HTAP) systems, such as incomplete feature sets, lack of ecosystem support, and performance contention. The Lakebase architecture has unlocked capabilities like unlimited storage, elastic compute, durable writes, and instant branching, with ongoing developments anticipated in the future.

Tech Optimizer

July 2, 2026

From monolith to Lakebase to LTAP: rethinking the database from storage up

Sixteen years ago, the author began their PhD at UC Berkeley, where they were advised to focus on analytics rather than OLTP databases, which were considered a solved problem. However, upon developing Databricks, they found that OLTP databases were cumbersome, challenging to scale, and fragile. This led to the creation of Lakebase, a serverless Postgres database designed to address these issues by externalizing the write-ahead log (WAL) and data files into independent services. Lakebase architecture separates the WAL into a distributed service called SafeKeeper and data files into another service called PageServer, allowing for improved durability, scalability, and performance. This architecture eliminates data loss risks associated with disk failures and misconfigurations, simplifies high availability, and allows for elastic compute resources. Lakebase also introduces LTAP (Lake Transactional/Analytical Processing), which enables transactions and analytics to operate on a single data copy in real-time, avoiding the need for separate data copies and reducing costs. The system retains Postgres's ACID semantics while storing data in open columnar formats, making it accessible to both transactional and analytical engines without the delays and complexities of traditional replication methods. The architecture allows for unlimited storage, serverless compute, and instant branching, while ensuring that analytics can read the most current transactional data without affecting transactional workloads. LTAP aims to unify transactional and analytical processing by leveraging distinct compute engines for each workload while integrating at the storage layer.

AppWizard

June 30, 2026

New Vegas director Josh Sawyer says games can and should pull on artistic inspirations from ‘anywhere and everywhere’: ‘Greek plays, they knocked it out of the park thousands of years ago—why not look at them?’

Josh Sawyer, Obsidian's design director, discussed the impact of artistic inspiration on game design, emphasizing how video games evoke emotions and provoke thought through player experiences. In the game Pentiment, the design team aimed for players to confront difficult choices with significant consequences, fostering deep engagement with the narrative. Sawyer noted that while inventory systems in Pillars of Eternity may disrupt immersion, they shift cognitive focus, allowing players to evaluate items. He draws inspiration from various sources, including classical theater, musicals, visual art, and moral dilemmas in Greek plays, highlighting the importance of symbolism and emotional connections in game design.

AppWizard

June 30, 2026

Google swears (again) that data-sharing rules will help scammers, threaten your search history

Google is opposing the European Union's proposed amendments to the Digital Markets Act (DMA), warning that these changes could jeopardize user privacy and security. The DMA aims to reduce the dominance of major tech platforms by requiring gatekeepers like Google to share more data with competitors. Google is particularly concerned about the implications of sharing search data and granting third-party AI services access to sensitive Android features, fearing that this could lead to increased fraud and cyberattacks. The European Commission is pushing for Google to provide rival search engines with access to anonymized search data to enhance competition, but Google argues that once this data leaves its infrastructure, it becomes difficult to protect. DuckDuckGo and some researchers believe the Commission's proposals adequately address privacy risks, while others acknowledge the risks but suggest they should be balanced against technical protections. Additionally, EU regulators are advocating for deeper integration of competing AI assistants with Android, which Google warns could compromise existing security measures. Apple has shown support for some of Google's concerns regarding access to operating systems.

Winsage

June 30, 2026

Microsoft quietly sped up File Explorer in June’s optional update

A recent Microsoft update, KB5095093, enhances the user experience on Windows 11, particularly by significantly accelerating File Explorer. The update reorganizes the "Home" tab in File Explorer for improved performance, resulting in faster access and functionality. It also improves the reliability of the address bar with quicker suggestions and enhances responsiveness when mounting disk images and adjusting folder view case sensitivity. This update is part of June's optional Windows update and will become mandatory in July. Users can install it via Windows Update or the Microsoft Update Catalog.

AppWizard

June 29, 2026

US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve

The US government is offering rewards of up to million for information on individuals associated with two Russian-linked cyber threat groups, UNC5792 and UNC4221, which target US officials, military leaders, journalists, and personnel in Ukraine. The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have reported that these groups conduct sophisticated phishing campaigns via commercial messaging applications (CMAs), using social engineering and masquerading as support accounts to gain unauthorized access. The attackers now request victims' Backup Recovery Keys, which can lead to future account takeovers even if new accounts are created. Both groups are linked to Russian intelligence services, with UNC5792 associated with the FSB Border Guards and UNC4221 with Russian military services. The US government seeks information on the identities, locations, affiliations, and funding sources of the actors behind these groups.

Winsage

June 25, 2026

Introduction to COM usage by Windows threats

Component Object Model (COM) is a technology in Windows that enables object activation, inter-process communication, and automation across different programming languages. Malware exploits COM interfaces for activities such as lateral movement, execution, downloading, exfiltration, persistence, evasion, system discovery, and automation of Windows and Office functionalities. Reverse engineering COM-heavy binaries involves navigating GUIDs and indirect vtable calls to understand malware mechanics. Research at the AVAR 2025 conference and CARO 2026 workshop discusses methodologies for analyzing COM binaries and case studies of malware families that utilize COM. COM is an application binary interface (ABI) model that allows software components to be reused and enables interaction between different programming languages through interfaces defined at the binary level. Distributed COM (DCOM) allows clients to activate COM objects on remote systems. COM classes are identified by unique class identifiers (CLSIDs), and interfaces by interface identifiers (IIDs). The Windows registry stores COM registration data, with classes and interfaces located under specific keys. Malware often acts as a COM client, utilizing the COM runtime to instantiate classes and request interfaces. ProgIDs provide human-readable registry entries for COM classes. The CoCreateInstance function helps create class objects by resolving CLSID registrations. All COM interfaces derive from IUnknown, which manages object lifetimes and interface querying. COM has its own security model, and identifying classes and interfaces used by malware is crucial for threat researchers. Tools like ComView and OleView.NET assist in inspecting COM registrations. The analysis workflow includes identifying activation API calls, extracting CLSID and IID values, consulting registry definitions, and mapping vtable calls. Qakbot, a banking trojan, exemplifies the use of COM in malware, with its architecture enabling malicious activities like credential theft. Dynamic analysis tools can log COM-related calls in real-time to trace execution flow. Notable malware families that utilize COM include Gh0stRAT, which uses Task Scheduler COM interfaces, and the Attor platform, which employs BITS for file transfers. WarmCookie demonstrates the use of COM for persistence through Task Scheduler. Understanding COM's role in malware is essential for cybersecurity professionals.

AppWizard

June 25, 2026

You can finally turn Riot’s Vanguard anti-cheat off when you’re not playing a game

Riot Games is updating its Vanguard anti-cheat system to an "on-demand" model, which will only activate during gameplay and stop once the game ends. This change addresses concerns over Vanguard's previous persistent background operation and kernel mode access. Players must meet specific security criteria to use the new feature, including enabling pre-boot security mechanisms and Windows' native protection features. Approximately 35% of players already meet these conditions, while 3% using older hardware will not have access to the on-demand option until they upgrade. Vanguard will continue its current operation for those unable to meet the requirements. The update is influenced by advancements in Windows and PC hardware security and aims to enhance anti-cheat measures while keeping the process optional for most players.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Tech Optimizer

June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.