Windows versions Archives

Winsage

May 18, 2026

Why Your Windows 11 PC Doesn’t Get AI Features

Several hundred million Windows 11 users are experiencing frustrations due to the absence of Microsoft features like Recall and Cocreator, which are only available on Copilot+ PCs. Microsoft has divided Windows 11 into two tiers, with the latest AI functionalities requiring specific hardware known as Copilot+ PC. To qualify, a device must have: - An NPU capable of at least 40 TOPS - A minimum of 16 GB of RAM (DDR5 or LPDDR5) - At least 256 GB of SSD storage - Windows 11 version 24H2 or newer - A processor from specific families: Qualcomm Snapdragon X series, Intel Core Ultra 200V (Lunar Lake), or AMD Ryzen AI 300 series Many PCs lack these features due to missing NPUs, insufficient TOPS ratings, unsupported processor generations, outdated Windows versions, rollout delays, or regional limits. Features locked behind Copilot+ include Recall, Click to Do, Cocreator in Paint, Windows Studio Effects, Live Captions with Translation, Improved Windows Search, and Auto Super Resolution. To check for Copilot+ compatibility, users can verify the presence of an NPU in Task Manager, ensure they have Windows 11 version 24H2 or newer, and confirm their processor against the approved list. While some workarounds exist to enable features on unsupported PCs, they are often unstable and not recommended for primary use. Most users may not need to upgrade their laptops unless they require on-device AI features or their current device is significantly outdated. The AI feature gap is not currently critical for most users, as many features are optional or not essential.

Winsage

May 17, 2026

Classic 7 is Windows 10 LTSC cosplaying as Windows 7

Classic 7 is a heavily modified version of Windows 10 IoT LTSC designed to replicate the aesthetics of Windows 7, incorporating real binaries from Windows 7 and earlier versions. It integrates features like the original Windows 7 Explorer and the Control Panel Restoration Pack, allowing users to experience a nostalgic interface while still receiving updates until 2032. Classic 7 has been in development for over a year and a half and is based on a collaborative effort using various tools, including Winaero Tweaker. However, it raises legitimacy concerns as it is a modified version of an Enterprise edition of Windows, which requires a Volume License Agreement, making it unsuitable for production use. Testing in a virtual environment revealed a positive experience, although initial installation faced challenges. Classic 7 supports contemporary applications and drivers, including a Firefox version styled to resemble Internet Explorer.

Winsage

May 11, 2026

Microsoft denies Windows 11 CPU boost trick is a lazy fix, says Apple does this and you love it

The Low Latency Profile feature in Windows 11 temporarily increases CPU frequency to improve responsiveness for high-priority tasks, benefiting even low-powered virtual machines. It is currently available in Windows 11 Insider builds and aims to optimize performance with minimal impact on battery life and thermal performance. Critics have labeled it a "band-aid" solution for a bloated operating system, while Microsoft’s VP Scott Hanselman defended it as a standard practice in modern operating systems. He noted that the feature is particularly effective on ARM architecture, such as Qualcomm's Snapdragon chips, and explained that the complexity of contemporary Start menus requires more processing power than older versions. Microsoft is working to streamline the Start menu while also enhancing performance through the Low Latency Profile.

Winsage

May 5, 2026

Unpatched flaws turn Ollama’s auto-updater into a persistent RCE vector, researchers say

Researchers at Striga have identified two vulnerabilities (CVE-2026-42248 and CVE-2026-42249) in Ollama’s Windows auto-updater that could allow an attacker to install a persistent executable that runs at user login. CVE-2026-42248 fails to properly verify signatures of downloaded content, while CVE-2026-42249 is a path traversal flaw that allows an attacker to inject malicious code into the user's Startup folder. Exploitation requires control over the update response, with potential methods including compromising the update infrastructure or redirecting the client. The vulnerabilities affect Ollama versions 0.12.10 through 0.17.5, and users are advised to disable auto-updates and remove shortcuts from the Startup folder to mitigate risks.

BetaBeacon

May 5, 2026

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

ScarCruft compromised a video game platform in a supply chain attack, trojanizing its components with a backdoor called BirdCall to target ethnic Koreans residing in China. The attack enabled the threat actors to target both Windows and Android devices, turning it into a multi-platform threat. The campaign targeted sqgame[.]net, a gaming platform used by ethnic Koreans in China, known as a transit point for North Korean defectors. BirdCall has features like screenshot capture, keystroke logging, and data gathering, and relies on legitimate cloud services for command-and-control. The Android variant collects various data and has seen active development.

Winsage

May 4, 2026

Miss Windows XP or 7? Then I have a free, open-source alternative for you

ReactOS has merged its Live and Boot ISOs into a single installation image, simplifying the installation process for users. This integration allows users to test the OS in a live environment and transition to installation without needing multiple discs or USB drives. The installation process still resembles older Windows versions with a text-based setup, but a full graphical installation interface is expected in the upcoming 0.4.16 build. Additionally, ReactOS is expanding its hardware compatibility with a new ATA storage driver, enabling it to boot on a wider range of storage devices. ReactOS is currently in its alpha stage of development and is not yet suitable for everyday use.

Winsage

May 1, 2026

Microsoft fixes Remote Desktop warnings displaying incorrectly

Microsoft resolved an issue affecting the display of security warnings when opening Remote Desktop (.rdp) files across all supported Windows versions, including Windows 11, Windows 10, and Windows Server. This problem was particularly evident on devices with multiple monitors having different display scaling settings. The fix was included in the optional KB5083631 preview cumulative update for Windows 11. The issue arose after the installation of the April 2026 security update, which introduced security warnings to enhance protection against phishing attacks. Users reported misalignment and obscured buttons in the security dialog, making it difficult to interact with. Additionally, the April security updates caused issues with third-party backup applications on Windows 11 systems and led to restart loops and failures during update installations on Windows Server.

Winsage

April 28, 2026

‘Unlimited Attack Vectors’—All Windows Versions At Risk From New Flaw

Microsoft is facing a significant security vulnerability in its Windows operating system known as PhantomRPC, which allows for privilege escalation. Cybersecurity experts have expressed concern over the company's delayed response in issuing a patch for this flaw. The vulnerability resides within the Windows Remote Procedure Call (RPC) architecture and enables processes with impersonation privileges to elevate their permissions to SYSTEM level. Researcher Haidar Kabibo identified five distinct paths for exploitation, which require user interaction, coercion, or compromise of background services. Despite disclosing the vulnerability to Microsoft in September 2025, the company categorized it as moderately severe and did not issue a patch or a Common Vulnerabilities and Exposures (CVE) listing. Microsoft stated that the technique requires an already-compromised machine and emphasized the importance of following security best practices. Experts have criticized Microsoft's lack of action, arguing that it is operationally negligent and places the burden of risk management on users. In the absence of a patch, security professionals recommend focusing on access control and environmental hygiene to mitigate the risks associated with the vulnerability.

Winsage

April 28, 2026

Here’s How Microsoft’s New Windows Insider Channels Work

Microsoft has transformed its Windows Insider program by introducing three new channels: Experimental, Beta, and Release Preview. The Experimental channel combines the previous Dev and Canary options, allowing users to test new features with less stability. The Beta channel has been updated to ensure all users receive the same features simultaneously, eliminating gradual rollouts. The Release Preview channel offers the least risk, providing access to updates before their official release. Users now have more control over the features they trial, with the ability to enable or disable specific features through a new "Feature flags" page. Additionally, switching between channels has been simplified, allowing smoother transitions without needing a complete PC wipe, except when moving to the Experimental Future Platforms channel.

Winsage

April 25, 2026

New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

PhantomRPC is a significant architectural vulnerability in the Windows Remote Procedure Call (RPC) framework that allows local privilege escalation to SYSTEM-level access across all Windows versions. Discovered by Kaspersky's Haidar Kabibo at Black Hat Asia 2026, this vulnerability stems from the RPC runtime's failure to verify the legitimacy of a responding server during calls to offline or disabled servers. Attackers can exploit this by setting up a malicious RPC server that impersonates a legitimate endpoint, using the RpcImpersonateClient API to escalate privileges from low-privileged accounts to SYSTEM or Administrator levels. Five distinct exploitation paths have been identified: 1. gpupdate.exe coercion: An attacker can intercept an RPC call made by the Group Policy Client service when executing gpupdate /force, granting SYSTEM-level access if TermService is disabled. 2. Microsoft Edge startup: Launching msedge.exe triggers an RPC call to TermService, allowing privilege escalation from Network Service to Administrator via a spoofed endpoint. 3. WDI background service: The Diagnostic System Host polls TermService regularly, enabling an attacker to exploit this without user interaction. 4. ipconfig.exe and DHCP Client: Running ipconfig.exe initiates an RPC call to the DHCP Client service, allowing a Local Service attacker to elevate privileges if DHCP is disabled and a fake server is present. 5. w32tm.exe and Windows Time: An attacker can expose a named pipe endpoint, allowing them to impersonate any privileged user executing the Windows Time executable. The vulnerability was reported to Microsoft on September 19, 2025, but Microsoft categorized it as moderate severity and closed the case without a patch, as the attack requires SeImpersonatePrivilege, which is granted by default to certain accounts. Organizations are advised to implement defensive measures such as enabling RPC monitoring, ensuring legitimate services are running, and restricting SeImpersonatePrivilege. Kaspersky has provided tools for auditing environments for exploitable RPC call patterns through the PhantomRPC GitHub repository.