trust Archives

Winsage

August 18, 2026

CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed a privilege escalation vulnerability in the Windows Task Host, designated as CVE-2025-60710, which is being exploited by ransomware groups. Microsoft released a patch for this flaw on November 11, 2025, and CISA added it to its Known Exploited Vulnerabilities catalog on April 13. The vulnerability allows scheduled tasks to operate at the highest privilege level, enabling attackers to delete files and potentially gain full control over a machine. This access can lead to the extraction of credentials, manipulation of endpoint protection, and lateral movement across networks, culminating in widespread ransomware deployment. Security experts emphasize the critical nature of this vulnerability and urge organizations to address it promptly, as it poses significant risks to systems running Windows 11 and Server 2025.

AppWizard

August 18, 2026

Moozi and Dentsu Redder turn milk discovery into an immersive Minecraft experience

Moozi and Dentsu Redder Vietnam relaunched Moozi's children's milk range through Mooziland, Vietnam's first branded Minecraft universe. This initiative features seven interactive islands representing Moozi's milk flavors, inspired by Australian ecosystems. Over seven weeks, children participated in quests guided by Minecraft creator TOGA and gaming influencers, while a nationwide Moozi Fest allowed in-person engagement. The campaign ran from April to July 2026, achieving over 53 million impact views, 700,000 engagements, and a 30% growth in total channel value. The experience aimed to connect children and parents with the brand through exploration and discovery, emphasizing quality and trust.

Tech Optimizer

August 17, 2026

Avast, AVG and Norton in 2026: smarter security for a new generation of threats

In 2026, cybersecurity has shifted from traditional virus blocking to addressing a wider range of threats, including phishing, AI-generated scams, fake websites, account takeovers, ransomware, and fraudulent calls. Key players in this transformation include Avast, AVG, and Norton, which are integrating advanced AI, scam detection, and multi-device security into their offerings. Avert IT Distribution (Avert ITD) is the official distributor for Avast and AVG in Africa and provides Norton solutions, along with essential licensing and support services. Avast has introduced Scam Guardian technology, which combines automated protection with an AI tool to analyze suspicious communications. AVG has enhanced its AntiVirus with AI-driven protection against various online threats and offers mobile security features like Scam Guardian. Norton has expanded its services to include AI-powered Scam Protection and a secure browser for small and medium enterprises, along with significant upgrades to its VPN capabilities. Avert ITD supports African resellers and businesses by providing localized access to these cybersecurity solutions, ensuring tailored support and guidance. The company has also launched a WhatsApp support channel for quick assistance. Avert ITD emphasizes its commitment to reseller growth and accountability in its distribution approach.

AppWizard

August 14, 2026

“Fluid Trouble and Cobble Gen Talk” Minecraft in VRchat. Doc Plays Stuff EP 2

Google has introduced a passive sign-in feature for YouTube to enhance user convenience by allowing seamless access to accounts. This feature aims to reduce barriers to engagement and provide a personalized viewing experience. Additionally, Google has implemented robust security protocols to protect user data, ensuring that ease of access does not compromise safety.

Tech Optimizer

August 13, 2026

PSA: Don’t trust that Chrome update popup

Users of Chromium-based browsers, including Google Chrome, Brave, and Opera, are experiencing deceptive pop-ups that falsely claim a "Critical Update Required" or "Update available." These notifications are part of a scam designed to trick users into downloading malware disguised as software updates. Clicking on these prompts can lead to the download of harmful scripts, such as .vbs or .exe files, which traditional antivirus software often fails to detect. The issue is linked to compromised browser extensions that fetch malicious scripts from external servers. A specific extension, QuickLens – Search Screen with Google Lens, has been identified as a source of these pop-ups and has been removed from the Web Store. Other extensions, like “Enable Right Click & Copy Smart Unlock + OCR,” have also been implicated despite their popularity. Users are advised not to click on any links or run downloaded files and to check their browser settings for legitimate updates, as well as to audit and disable suspicious extensions.

Tech Optimizer

August 13, 2026

Enforcing TLS and managing certificate rotation for RDS and Amazon Aurora PostgreSQL

When an Amazon RDS certificate expires and the application’s trust store is outdated, it can cause connection failures. AWS announces Certificate Authorities (CA) rotation events in advance and provides management tools, but a lack of proactive certificate lifecycle management can lead to unplanned downtime. Default configurations for RDS and Amazon Aurora allow both encrypted and unencrypted PostgreSQL connections, which can expose sensitive data if not properly configured. AWS manages the Certificate Authority infrastructure and provisions server certificates, while users are responsible for enforcing TLS usage and managing the rotation lifecycle. Amazon RDS employs a managed Certificate Authority hierarchy that issues server certificates for each database instance, supporting TLS 1.2 and TLS 1.3. The solution to enforce TLS includes server-side enforcement with the rds.force_ssl parameter, client-side verification with the sslmode=verify-full parameter, and automated lifecycle monitoring using Amazon EventBridge, AWS Lambda, and Amazon CloudWatch. Prerequisites for implementing this solution include an AWS account with an Amazon RDS for PostgreSQL or Amazon Aurora PostgreSQL instance, IAM permissions for relevant services, a compatible PostgreSQL client, familiarity with Amazon RDS parameter groups, and the openssl CLI. The rds.force_ssl parameter controls whether Amazon RDS rejects non-SSL connections, with defaults varying by PostgreSQL version.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

AppWizard

August 11, 2026

Even the AI assistant inside Russia’s state-backed Max messenger tells users not to trust the app

Alisa, the AI assistant in the Max messenger, has recommended users consider alternative messaging platforms such as Telegram, Signal, or WhatsApp. She highlighted several security vulnerabilities in Max, including the absence of end-to-end encryption and the direction of user data to VK-owned servers. The data collected by Max includes IP addresses, activity timestamps, contact lists, device and browser types, internet service provider information, and various metadata. Alisa suggests that users keep Max on a separate device, referred to as a “maxphone,” to protect sensitive information. If used on personal devices, she recommends using the browser version and restricting the app's access to location services, contacts, microphone, and camera to enhance privacy and security.

BetaBeacon

August 11, 2026

Aptoide Games Joins Google Play: First Rival Android Store in Over Decade

The Play Catalog Access Program was implemented on July 22, 2026, as a result of a court order after Google lost a lawsuit filed by Epic Games for illegally monopolizing Android app distribution and in-app billing. The program allows enrolled stores, such as Aptoide Games, to access Google Play's app catalog and offer users the ability to install apps through Google Play's infrastructure, maintaining security and service fees.

Winsage

August 10, 2026

Microsoft, Red Hat, and DH2i to Present, “Simplify Hybrid SQL Server: Windows & Red Hat OpenShift Side By Side”

DH2i will host a live webinar titled "Simplify Hybrid SQL Server: Windows & Red Hat OpenShift Side By Side" on August 20 at 12:00 PM Eastern Time (9:00 AM Pacific Time) in collaboration with Microsoft and Red Hat. The webinar aims to help organizations extend their SQL Server OLTP environments to Red Hat OpenShift, focusing on deploying a secure, cross-platform Availability Group (AG) linking Windows Server VMs with Red Hat OpenShift. Key topics include automating Kubernetes AG cluster deployment, establishing secure connections using Zero Trust Networking (ZTNA), and implementing HA automation for hybrid SQL Server environments. Featured speakers include OJ Ngo from DH2i, Amit Khandelwal from Microsoft, and Vivien Wang from Red Hat. Registration is available for those interested in attending or accessing the recording later.