NewApp Digest
search bot

university

Dutch government to replace Microsoft Windows with NixOS-based operating system
Winsage
September 25, 2026

Dutch government to replace Microsoft Windows with NixOS-based operating system

The Dutch government is launching the Digitaal Autonome Werkomgeving Overheid (DAWO) initiative to create a self-sufficient digital environment, featuring a custom Linux-based operating system and IT suite. DAWO will be based on the Dutch Linux distribution NixOS and will include an office suite, collaboration applications, cloud services, and management tools, with a stable version expected by 2027. Other European countries, such as Denmark, Switzerland, and France, are also pursuing digital independence, with France transitioning 250 employees to Linux-based workstations using NixOS and promoting broader Linux adoption within state administration.
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Winsage
September 24, 2026

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers from Graz University of Technology in Austria have discovered significant vulnerabilities in the file notification systems of major operating systems: Android, Linux, macOS, and Windows. These flaws have existed for decades and can lead to the leakage of sensitive system information. The affected systems include inotify on Linux (since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), and FSEvents on macOS (since 2007). The vulnerabilities allow unprivileged users to monitor file events without explicit read permissions, enabling potential attacks such as inter-keystroke timing attacks and website fingerprinting. For example, on Linux, monitoring a readable directory can leak events on files that cannot be read, allowing attackers to achieve a 93.1% to 100% accuracy rate in monitoring keystrokes. Specific vulnerabilities include CVE-2025-68788 on Linux, which received a partial fix in December 2025, and issues on Android where FileObserver can bypass app storage isolation. On macOS, limited information is available due to a lack of bypasses for private directories, while on Windows, monitoring the root directory can reveal the full path of every accessed file, allowing real-time tracking of web activity with a 97.8% accuracy rate. Microsoft has described the issue as "by-design," which has faced criticism. The researchers propose stronger mitigations, such as disallowing monitoring of entire drives on Windows and introducing a permission system for file monitoring on Windows and macOS. Their findings will be presented at the ACM CCS 2026 conference in November in The Hague, Netherlands.
The Industrial Revolution is the reason RPGs have area-of-effect spells: A PC Gamer Causality Chain™
AppWizard
September 24, 2026

The Industrial Revolution is the reason RPGs have area-of-effect spells: A PC Gamer Causality Chain™

Causality Chain is a series at PC Gamer that explores the connections between history, culture, and video games. The concept of area-of-effect spells in video games began to develop in the 1980s, with the Wizardry series introducing spells that could target multiple enemies. Ultima 3 featured a noxum spell that allowed for multiple fireballs aimed at different foes, and by 1985, Ultima 4 included a tremor spell affecting all adversaries on screen. Wizard's Crown, released in 1986, showcased a fireball affecting surrounding enemies, and Ultima 5 added cone-shaped spells in 1988. That same year, SSI acquired the license to create official D&D games, leading to the release of Pool of Radiance, which introduced a true area-of-effect fireball spell that could harm party members.
Russia's national messenger app Max found to contain backdoor capable of secret screen captures
AppWizard
September 19, 2026

Russia’s national messenger app Max found to contain backdoor capable of secret screen captures

Researchers have found that Max, a messaging app mandated by the Russian government, can secretly capture screenshots, access sensitive information, impersonate users, and inject code into other applications. Developed by VK, the app integrates messaging, banking, and government services. Since September 1 of last year, it has been preinstalled on new smartphones, following the blocking of WhatsApp and Telegram. Despite its reach, it is not widely used in political circles, with insiders indicating that compliance with its use is performative.
Russia's "National Messenger" Turned Out to Be... "Putin Is Watching"
AppWizard
September 19, 2026

Russia’s “National Messenger” Turned Out to Be… “Putin Is Watching”

The Russian government is pressuring citizens to download a mobile app called "Max," which has raised privacy and surveillance concerns. Max is a popular messaging platform in Russia and integrates messaging, government services, and payment functionalities. Research by a University of Michigan team found that Max can capture users' screens without consent, access sensitive information, impersonate users, and potentially enable cyberattacks via code injection. Despite these concerns, many Russians still use alternative messaging platforms like Telegram and Signal. Some government officials are using separate devices for Max, indicating unease about its surveillance capabilities. The app is linked to a social media company connected to the Russian government, and President Putin may have an indirect financial stake in it.
Revealed: How Russia use mobile ‘super-app’ Max to spy on its citizens
AppWizard
September 18, 2026

Revealed: How Russia use mobile ‘super-app’ Max to spy on its citizens

A new messaging and payment app called Max has emerged in Russia, developed by VKontakte, and has become the country's most utilized messaging platform. Max integrates various services, including banking and government services, and has been adopted by tens of millions of Russians. It features extensive surveillance capabilities, allowing it to take screenshots, access information without consent, impersonate users, and potentially conduct cyberattacks. The app's adoption has been largely mandatory, particularly among state employees and students. Despite its rise, Max has not replaced Telegram as a primary news source, and users have raised concerns about privacy and surveillance. Experts warn that Russia's swift implementation of digital control strategies reflects a growing trend of digital authoritarianism.
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Winsage
September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.
Switzerland begins testing alternatives to Microsoft 365 to protect its "most sensitive data" and strengthen digital sovereignty
Winsage
September 7, 2026

Switzerland begins testing alternatives to Microsoft 365 to protect its “most sensitive data” and strengthen digital sovereignty

Switzerland's federal government plans to reduce its reliance on Microsoft 365 and is exploring alternative software solutions, reflecting a trend among European nations for digital sovereignty. The initiative includes transitioning 3,000 Swiss workstations away from Microsoft 365. Concerns about data protection and potential risks of data leaks from foreign systems are primary motivations for this shift, alongside rising license costs. Professor Matthias Stürmer has highlighted the risks of foreign access to sensitive data. Microsoft has introduced its Sovereign Cloud to address these concerns, but apprehensions remain among governments in Switzerland, Germany, and France regarding data sovereignty.
Overcoming the Barriers of Commercial DBs with Open Source and AI… EDB Hosts 'PostgreSQL AI Summit'
Tech Optimizer
August 29, 2026

Overcoming the Barriers of Commercial DBs with Open Source and AI… EDB Hosts ‘PostgreSQL AI Summit’

A company's approach to artificial intelligence (AI) begins with determining the optimal structure for data storage and management, often facing challenges such as high costs of commercial databases and reliance on specific enterprise technologies. To effectively utilize AI, companies need to establish new infrastructures, including vector search capabilities, Search Augmentation Generative (RAG) systems, and data lakehouses. EDB is notable for connecting companies and technology partners that have transitioned to open-source databases. On September 3, EDB will host the 'EDB Postgres AI Summit Seoul 2026' at the Sofitel Ambassador Seoul, starting at 10:00 AM. This event is the largest PostgreSQL conference in Korea, themed 'Change the Game,' focusing on the shift from commercial databases to open-source and AI-driven frameworks, featuring real-world case studies. Approximately 300 C-level executives and IT decision-makers from various sectors are expected to attend, with participation by invitation only. The summit will include 15 sessions with customer case studies and technical presentations. Notable discussions will include IBK Industrial Bank of Korea's migration of 15 core systems to PostgreSQL, a semiconductor company's diversification of MPP databases on a DBaaS platform, and Kyobo Book Centre's database modernization strategy. Shopcast will present its development of an 'Agentic Lakehouse' integrating AI technology with a data lakehouse framework. The keynote address will be given by Kim Deok-joong, discussing organizational management strategies for integrating AI agents. The technical sessions will cover the architecture of the 'EDB Postgres AI' platform, which supports AI vector search and RAG, with live demonstrations of the analytics engine ClickHouse and LakeHouse technology for analyzing petabyte-scale data. EDB's domestic distributors and international partners will participate as sponsors. The summit aims to showcase technologies and case studies from the domestic ecosystem, addressing PostgreSQL adoption, system migration, operations, data analysis, and AI implementation. EDB manages transaction, analytics, and AI workloads using Postgres in cloud environments, serving over 1,500 global customers. Herve Timsit, EDB's Chief Revenue Officer, emphasized the event's focus on sharing tangible results and addressing the challenges of commercial databases while investing in AI infrastructure.
Search