Posts by Gandalf

  • Firefox 144.0.2

    Firefox 145.0.1

    • Fixed an issue causing breakage on sites using Three.js. (Bug 1995939)
    • Fixed a failure to open Firefox from the desktop launcher on older versions of Windows 10. (Bug 2000411)
    • Fixed Web compatibility issues with Rogers. Rogers customers would see a broken iframe with "Firefox Can’t Open This Page" when viewing bills, rather than the billing info. (Bug 1996823)
    • Fixed an issue in the Web Developer Tools preventing copy all or save all requests as HAR. (Bug 1995694)
    Firefox 145.0.1, See All New Features, Updates and Fixes
    www.firefox.com

  • Google Chrome Updates

    Google Chrome 142.0.7444.175/.176

    The Stable channel has been updated to 142.0.7444.175/.176 for Windows and 142.0.7444.176 for Mac and 142.0.7444.175 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.

    This update includes 2 security fixes. Below, we highlight fixes that were contributed by external researchers.

    [N/A][460017370] High CVE-2025-13223: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2025-11-12

    [N/A][450328966] High CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep on 2025-10-09

    Google is aware that an exploit for CVE-2025-13223 exists in the wild.

    Stable Channel Update for Desktop
    The Stable channel has been updated to 142.0.7444.175/.176 for Windows and 142.0.7444.176 for Mac and 142.0.7444.175 for Linux, which will...
    chromereleases.googleblog.com

  • Now Watching:

    External Content youtu.be
    Content embedded from external sources will not be displayed without your consent.
    Through the activation of external content, you agree that personal data may be transferred to third party platforms. We have provided more information on this in our privacy policy.

  • Logitech confirms data breach after Clop extortion attack

    Hardware accessory giant Logitech has confirmed it suffered a data breach in a cyberattack claimed by the Clop extortion gang, which conducted Oracle E-Business Suite data theft attacks in July.

    Logitech International S.A. is a Swiss multinational electronics company that sells hardware and software solutions, including computer peripherals, gaming, video collaboration, music, and smart home products.

    Today, Logitech filed a Form 8-K with the U.S. Securities and Exchange Commission, confirming that data was stolen in a breach.

    "Logitech International S.A. ("Logitech") recently experienced a cybersecurity incident relating to the exfiltration of data. The cybersecurity incident has not impacted Logitech's products, business operations or manufacturing," disclosed Logitech.

    "Upon detecting the incident, Logitech promptly took steps to investigate and respond to the incident with the assistance of leading external cybersecurity firms."

    Logitech says the data likely includes limited information about employees and consumers, as well as data relating to customers and suppliers, but the company does not believe hackers gained access to sensitive information such as national ID numbers or credit card information, as that data was not stored in the breached systems.

    Logitech says that the breach occurred through a third-party zero-day vulnerability that was patched as soon as a fix was available.

    This statement comes after the Clop extortion gang added Logitech to its data-leak extortion site last week, leaking almost 1.8 TB of data allegedly stolen from the company.

    Logitech confirms data breach after Clop extortion attack
    Hardware accessory giant Logitech has confirmed it suffered a data breach in a cyberattack claimed by the Clop extortion gang, which conducted Oracle…
    www.bleepingcomputer.com

  • Decades-old ‘Finger’ protocol abused in ClickFix malware attacks

    The decades-old "finger" command is making a comeback,, with threat actors using the protocol to retrieve remote commands to execute on Windows devices.

    In the past, people used the finger command to look up information about local and remote users on Unix and Linux systems via the Finger protocol, a command later added to Windows. While still supported, it's rarely used today compared to its popularity decades ago.

    When executed, the finger command returns basic information about a user, including their login name, name (if set in /etc/passwd), home directory, phone numbers, last seen, and other details.

    Recently, there have been malicious campaigns utilizing the Finger protocol in what appear to be ClickFix attacks that retrieve commands to execute on devices.

    This is not the first time the finger command has been abused in this way, as researchers warned in 2020 that it was used as a LOLBIN to download malware and evade detection.

    Decades-old ‘Finger’ protocol abused in ClickFix malware attacks
    The decades-old "finger" command is making a comeback,, with threat actors using the protocol to retrieve remote commands to execute on Windows devices.
    www.bleepingcomputer.com

  • Dedoimedo: Unattended Windows installations bring peace and quiet

    From that article:

    Quote

    The Unattend Generator is a beautiful website that lets you create your own XML. You answer questions in a human format, e.g.: username, system name, which apps you want or not, whether to configure Wi-Fi, and then some, and from these questions, from this online form, the site will create the autounattend.xml file for you. It can also wrap the file into an ISO archive, so you can use it with other products.

  • Dedoimedo: Unattended Windows installations bring peace and quiet

    Over time, Microsoft Windows has steadily become more annoying, less fun. Windows 11 is the epitome of this sad trend, exhibiting tons of smartphone-like "experiences" that completely ruin the very idea of what the desktop ought to be. You can work around many of these nonsense features, but it takes time and patience.

    In the past couple of years, I've written tons of tutorials on how to tame this unruly beast, how to make Windows 11 less stupid. All of these articles were made for the typical desktop use, with interactive changes via the Settings, Control Panel, services and some registry. As it turns out, there's a superior way. You can actually install your Windows "enterprise style", in an unattended mode, which lets you clean and prune about 90% of useless garbage without any interaction whatsoever. Let me show you how you can accomplish this.

    One moment, please...

  • WhatsApp users in Europe will now be able to chat to users on other apps

    Meta has announced that WhatsApp is rolling out third-party chats in Europe to allow users there to connect with people on other messaging services. This implementation is required for Meta to remain in compliance with the European Union’s Digital Markets Act (DMA) interoperability requirements.

    The company said that the option will be rolling out across the European Region for users soon on Android and iOS for users who decide to opt-in, meaning it won’t be the default option.

    The first services that will be implemented with WhatsApp are BirdyChat and Haiket. For those not familiar, BirdyChat is targeted at work-related chats, while Haiket is a voice-first messaging platform. Unfortunately, as Meta will only be covering interoperability in Europe, those in the rest of the world won’t be able to connect to these other platforms via WhatsApp which could cause some friction.

    https://www.neowin.net/news/whatsapp-users-in-europe-will-now-be-able-to-chat-to-users-on-other-apps/

  • ASUS warns of critical auth bypass flaw in DSL series router

    ASUS has released new firmware to patch a critical authentication bypass security flaw impacting several DSL series router models.

    Tracked as CVE-2025-59367, this vulnerability allows remote, unauthenticated attackers to log into unpatched devices exposed online in low-complexity attacks that don't require user interaction.

    ASUS has released firmware version 1.1.2.3_1010 to address this vulnerability for DSL-AC51, DSL-N16, and DSL-AC750 router models.

    "An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system," ASUS explains.

    "ASUS recommends update to the latest firmware to ensure your device remains protected. Download and install the latest firmware version 1.1.2.3_1010 for your device from the ASUS support page or your product page at ASUS Networking."

    While the Taiwanese electronics manufacturer only mentions three affected router models, it also provides mitigation measures for users who can't immediately update their devices or have end-of-life models that will not receive firmware updates.

    To block potential attacks without patching the routers, users are advised to disable any services accessible from the Internet, including remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port triggering, and FTP.

    ASUS also recommends taking additional measures to secure routers and reduce the attack surface, including using complex passwords for the router administration page and wireless networks, regularly checking for security updates and new firmware, and avoiding the reuse of credentials.

    ASUS warns of critical auth bypass flaw in DSL series routers
    ASUS has released new firmware to patch a critical authentication bypass security flaw impacting several DSL series router models.
    www.bleepingcomputer.com

  • Windows president says platform is "evolving into an agentic OS," gets cooked in the replies — "Straight up, nobody wants this"

    Microsoft's current head of Windows, Pavan Davuluri, has posted on X saying that the future of the platform is one that is "evolving into an agentic OS," weeks after the company reorganized the Windows division internally to better position it to bring an AI-powered Windows to market.

    The post is more about Microsoft Ignite and how customers are using Windows as an AI platform, but it does reaffirm Microsoft's plans to push Windows into becoming an agentic OS, one that the company has teased multiple times over the last few months.

    The post has seen major pushback from people online, with various opinions all stating roughly the same thing. Nobody wants an AI powered version of Windows. "Stop this non-sense. No one wants this," reads one post. "Bro, straight up, nobody wants this," reads another.

    In fact, a majority of the replies to Davuluri's tweet are negative, with a handful showing optimism about the future of Windows. The rest? Nobody is interested or thinks Microsoft deserves to be trying to turn Windows into an AI-first agentic platform.

    This doesn't appear to be a small vocal minority, either. In almost all coverage about the future of Windows being an agentic one, a large chunk of reactions from people are often pushing back against Microsoft's vision. "You are getting overwhelmingly negative feedback about all this AI stuff. And yet you persevere. Why?" asks one X user.

    It's clear that Windows' reputation is at an all time low right now, and Microsoft's insistence on pushing towards an AI-powered future is not helping things. Many customers want Windows to be a platform that gets out of the way, but the last few years have seen Windows become enshittified in unapologetic ways.

    Windows president says platform is "evolving into an agentic OS," gets cooked in the replies — "Straight up, nobody wants this"
    Microsoft's current Windows lead Pavan Davuluri has tweeted that the future of Windows will be one that evolves into an agentic OS, but has received…
    www.windowscentral.com

  • OpenAI: Fighting the New York Times’ invasion of user privacy

    The New York Times is demanding that we turn over 20 million of your private ChatGPT conversations. They claim they might find examples of you using ChatGPT to try to get around their paywall.

    This demand disregards long-standing privacy protections, breaks with common-sense security practices, and would force us to turn over tens of millions of highly personal conversations from people who have no connection to the Times’ baseless lawsuit against OpenAI.

    They have tried this before. Originally, the Times wanted you to lose the ability to delete your private chats. We fought that and restored your right to remove them. Then they demanded we turn over 1.4 billion of your private ChatGPT conversations. We pushed back, and we’re pushing back again now. Your private conversations are yours—and they should not become collateral in a dispute over online content access.

    We respect strong, independent journalism and partner with many publishers and newsrooms. Journalism has historically played a critical role in defending people’s right to privacy throughout the world. However, this demand from the New York Times does not live up to that legacy, and we’re asking the court to reject it. We will continue to explore every option available to protect our users’ privacy.

    https://openai.com/index/fighting-nyt-user-privacy-invasion/

  • Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland

    Synology has addressed a critical-severity remote code execution (RCE) vulnerability in BeeStation products that was demonstrated at the recent Pwn2Own hacking competition.

    The security issue (CVE-2025-12686) is described as a ‘buffer copy without checking the size of input’ problem, and can be exploited to allow arbitrary code execution.

    It impacts multiple versions of BeeStation OS, the software powering Synology’s network-attached storage (NAS) devices marketed as a consumer-oriented “personal cloud.”

    There are no mitigations available, so the vendor recommends that users upgrade to the following versions, which address :

    • BeeStation OS version 1.3.2-65648 or above
    • BeeStation OS version 1.3.2-65648 or above
    • BeeStation OS version 1.3.2-65648 or above
    • BeeStation OS version 1.3.2-65648 or above

    Researchers Tek and anyfun at French cybersecurity company Synacktiv exploited the flaw in a demonstration during the Pwn2Own Ireland 2025 contest on October 21st. For their successful exploitation, the two researchers received a $40,000 reward.

    Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland
    Synology has addressed a critical-severity remote code execution (RCE) vulnerability in BeeStation products that was demonstrated at the recent Pwn2Own hacking…
    www.bleepingcomputer.com

  • FlyOOBE discussion and updates

    FlyOOBE 2.0 is here!

    • Modernized and simplified Interface: cleaner, more focused, and less overwhelming, making the initial setup much easier for new and casual users
    • Improved perfomance: The app is faster and more responsive, with reduced loading times and better resource management
    • Extensions engine completely reworked under the hood, now using a new internal filtering system with a category dropdown.
    • A brand-new app icon finally featuring a smart, friendly little bee inside 🐝 (I might've cheated a bit and let AI help with that one 😉)
    • Improved global search and refresh behavior for smoother control updates across views
    • New centralized Home dashboard that intelligently categorizes and recommends OOBE setup pages and extensions. Many items are now discoverable via keyword tags. (The first experimental Copilot integration has been temporarily removed while refined.)
    • Large-scale refactoring and transition to primarily asynchronous processing. Search, filtering, and loading operations no longer cause UI hangs
    • New back navigation system with a full stack-based history, allowing you to rewind through previous pages just like in a browser
    • Extensions shipped with the app can now also be uninstalled just like user-added ones
    • New native activity monitor logs system actions in real time and can provide contextual help for extensions (when supported).
    • Improved UI scaling and clarity on high-DPI displays
    • New indexing system for all OOBE pages and extensions based on metadata, allowing tools like Flyby11 to be found using simple keywords such as ESU, 10, or 11
    • New modern Copilot-inspired designs can now be found in the settings menu
    • Extensions.md has been updated accordingly
    • Dozens of Minor Fixes and Quality Improvements
    Release FlyOOBE 2.0 is here! · builtbybel/FlyOOBE
    🐝 FlyOOBE – Guided Setup & Upgrade Experience for Windows Note for returning users: ❗ Important: Flyby11 is now FlyOOBE (pronounced “fly-oh-bee”) - yeah, it…
    github.com

  • Google Chrome Updates

    Google Chrome 142.0.7444.162/.163

    The Stable channel has been updated to 142.0.7444.162/.163 for Windows and 142.0.7444.162 for Mac and 142.0.7444.162 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.

    Stable Channel Update for Desktop
    The Stable channel has been updated to 142.0.7444.162/.163 for Windows and 142.0.7444.162 for Mac and 142.0.7444.162 for Linux, which will r...
    chromereleases.googleblog.com

  • Windows 11 (KB5068861, KB5067112) November 2025 Patch Tuesday out

    This was a better article as first post :(

    Microsoft November 2025 Patch Tuesday fixes 1 zero-day, 63 flaws

    Today is Microsoft's November 2025 Patch Tuesday, which includes security updates for 63 flaws, including one actively exploited zero-day vulnerability.

    This Patch Tuesday also addresses four "Critical" vulnerabilities, two of which are remote code execution vulnerabilities, one is an elevation of privileges, and the fourth is an information disclosure flaw.

    The number of bugs in each vulnerability category is listed below:

    • 29 Elevation of Privilege Vulnerabilities
    • 2 Security Feature Bypass Vulnerabilities
    • 16 Remote Code Execution Vulnerabilities
    • 11 Information Disclosure Vulnerabilities
    • 3 Denial of Service Vulnerabilities
    • 2 Spoofing Vulnerabilities

    When BleepingComputer reports on the Patch Tuesday security updates, we only count those released today by Microsoft. Therefore, the number of flaws does not include Microsoft Edge and Mariner vulnerabilities fixed earlier this month.

    Today is also the first extended security update (ESU) for Windows 10, so if you are still utilizing the unsupported operating system, it is strongly advised that you upgrade to Windows 11 or enroll in the ESU program.

    For those who are having issues enrolling in the program, Microsoft released an out-of-band update today to fix an bug that prevents enrollments.

    To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5066835 and KB5066793 updates and the Windows 10 KB5068781 extended security update.

    Microsoft November 2025 Patch Tuesday fixes 1 zero-day, 63 flaws
    Today is Microsoft's November 2025 Patch Tuesday, which includes security updates for 63 flaws, including one actively exploited zero-day vulnerability.
    www.bleepingcomputer.com