Mobile Malware
The latest Mobile Malware coverage — news, analysis, and updates from the WindowsNews.AI desk.
Why a Malformed XFS Disk Can Crash Your Linux VM—and the Fix for CVE-2026-64187
A newly disclosed Linux kernel vulnerability, CVE-2026-64187, can cause a NULL pointer dereference and instant crash when mounting XFS filesystems with corrupted journals. While home Windows users face little direct risk, anyone running Linux virtual machines, WSL with XFS volumes, or managing Linux servers must update their kernels promptly to avoid denial-of-service disruptions.
Your Firewall Automation Might Be a Kernel Crash Waiting to Happen: Inside CVE-2026-64189
A newly disclosed Linux kernel vulnerability, CVE-2026-64189, allows a race condition in the ipset firewall tool to trigger kernel panics during routine management tasks. Any system running a vulnerable kernel and using IP sets—including WSL2, VMs, and container hosts—should apply the backported kernel patch immediately to prevent crashes.
Qualcomm RMNET Driver Race Condition Fixed in Linux Kernel—Check Your WSL and Cellular Devices
The Linux kernel has fixed CVE-2026-64188, a use-after-free vulnerability in the Qualcomm RMNET driver that could crash or compromise systems using cellular modems. While most Windows users are not directly affected, those running WSL2 with custom kernels or working with Qualcomm hardware should update their Linux environments immediately. The fix defers memory freeing to prevent a race condition, and all users should reboot after patching.
NGINX 1.31.3 Fixes SSI Worker Crash—Here’s Who Needs to Upgrade Now
CVE-2026-56434 is a use-after-free vulnerability in NGINX's Server-Side Includes module that can restart worker processes when SSI is enabled, proxies are used, and upstream buffering is off. Fixed in NGINX 1.31.3, 1.30.4, and Plus R36 P7. Windows administrators should inventory all NGINX instances, check for the vulnerable configuration combination, and upgrade or apply temporary mitigations like disabling SSI or re-enabling buffering.
WSL 2 Users Urged to Update Linux Kernel After BPF Panic Vulnerability Discovered
A newly disclosed Linux kernel vulnerability (CVE-2026-64192) can crash WSL 2 and other Linux environments by corrupting memory through improperly initialized BPF security hooks. The flaw affects kernels where BPF LSM is compiled in but not active at boot, and the fix rejects dangerous map creation. Windows systems are not directly affected, but WSL 2 users should update their Linux kernels immediately.
Macquarie Government's Azure Practice Targets 26% Cost Cuts for Australian Agencies
Macquarie Government has launched a co-managed Microsoft Azure practice for Australian federal and state agencies, promising an average 26% reduction in cloud costs through continuous optimization and governance. The move extends the company’s long-standing government cybersecurity business into public cloud services for the first time, offering PROTECTED-ready landing zones, managed security, virtual desktops, and hybrid Azure Local options. Agencies are advised to carefully evaluate the co-management model, validate cost savings, and plan for exit strategies before signing on.
Microsoft 365 Email Routing Alert: Why Your Inline Security Setup Needs a Second Look
Microsoft’s renewed warnings about routing Exchange Online mail through third-party security services have put a spotlight on inline email solutions like Check Point’s. While Check Point argues its architecture is safe, administrators must meticulously verify that their connectors, authentication, and security rules don’t undermine Microsoft 365’s native protections or create new vulnerabilities.
Endpoint DLP Alerts in Microsoft Purview Will Soon Feed into In-Depth Content Investigations
Microsoft will enable security analysts to launch Data Security Investigations directly from endpoint DLP alerts in Microsoft Purview starting August 2026. The integration lets teams query and collect related files across users and devices, then apply AI-assisted analysis to understand the full scope of a potential data breach. Organizations need to prepare by validating DLP coverage, enabling evidence collection, configuring tight access controls, and running pilots to avoid governance or cost pitfalls.
Microsoft Purview DLP Targets Your Google Workspace and AWS Data Starting September 2026
Microsoft Purview is expanding Data Loss Prevention and auto-labeling to Google Workspace, Box, Dropbox, Salesforce, ServiceNow, AWS, and Cisco Webex. Preview in July 2026 and general availability in September 2026 will let organizations enforce consistent policies across non-Microsoft clouds, but connector capabilities will vary. Administrators must prepare a migration from Defender for Cloud Apps file policies, which retire in January 2027.
Microsoft Purview’s File Quarantine: Sensitive Docs Will Be Plucked from SharePoint and OneDrive This July
Microsoft Purview's new File Quarantine action for SharePoint and OneDrive, rolling out globally in July 2026, physically removes sensitive files that violate DLP policies and replaces them with a tombstone message. This article explains how it works, why it's a major shift from simple blocking, and offers practical guidance for administrators to prepare and deploy the feature safely.
Macquarie Government Unveils Managed Azure for Australian Agencies as New Cloud Policy Takes Hold
Macquarie Government has launched a comprehensive managed Azure practice for Australian federal and state agencies, offering infrastructure, security, virtual desktops, and data analytics under one roof. The launch aligns with the new whole-of-government cloud computing policy and addresses critical gaps in governance, cyber security, and AI readiness. Agencies gain a path to disciplined cloud operations, but must negotiate clear ownership, exit plans, and retain internal skills to avoid long-term dependency.
Windows 11 Experimental Build Brings Braille Out-of-Box Setup, Tightens Cloud Session Security
Windows 11 Insider Preview Build 28120.2546 rolls out to the Experimental (26H1) channel with plug-and-play HID braille support in Narrator, a smart-card removal policy for Entra-authenticated virtual desktops, Voice Access in Portuguese and Korean, gamepad navigation in Quick Settings, and other fixes. The update may appear minor but delivers meaningful gains for accessibility users, IT admins, and handheld PC gamers.
Xbox Hack Victims Finally Get a Lifeline: Microsoft Promises Human Review After Years of Broken Support
Microsoft is under intense pressure to fix its broken support for hacked Xbox and Microsoft accounts, with internal sources revealing a review that could finally deliver human-led recovery processes. After a content creator’s viral ordeal exposed the system’s failures, the company is promising to honor user trust and keep them connected to years of purchases and personal data. The article details what’s changing, who’s at risk, how we arrived here, and specific steps victims and proactive users should take immediately.