Connect with us

Technology

Windows update flaw could be a hidden gateway to zombie vulnerabilities

Published

on

Windows update flaw could be a hidden gateway to zombie vulnerabilities

windo

Researchers have discovered a new way hackers could use to exploit Windows devices. They have found a vulnerability in your PC’s operating system that could let threat actors downgrade it to an older version of Windows. 

So, if you’re on Windows 11, they could roll it back to Windows 10, which would expose a bunch of old vulnerabilities they could use to take full control of your system.

Microsoft told CyberGuy it is working on a fix and claims the vulnerability is still just theoretical — the company hasn’t seen anyone try to exploit it yet. I’ll go over the details of this security flaw and share some tips to help you protect your PC.

GET SECURITY ALERTS, EXPERT TIPS — SIGN UP FOR KURT’S NEWSLETTER — THE CYBERGUY REPORT HERE

Advertisement

A person working on a Windows PC. (Kurt “CyberGuy” Knutsson)

How hackers exploit Windows downgrades

Alon Leviev, a researcher at SafeBreach, spotted the security flaw. Leviev says he started digging into downgrade attack methods after noticing that a big hacking campaign last year used malware called the “BlackLotus UEFI bootkit” that worked by downgrading the Windows boot manager to an old, vulnerable version.

Leviev found a way to downgrade Windows — either the whole operating system or just certain parts of it. He then created a proof-of-concept attack using this method to turn off a Windows protection called Virtualization-Based Security (VBS) and target the highly privileged code running in the computer’s core, known as the “kernel.”

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

Normally, when your PC requests an update, it communicates with a secure Microsoft server that controls the update process. Leviev couldn’t directly alter the server-controlled files, but he found that one key — “PoqexecCmdline” — was not locked, allowing him to manipulate the update process.

Advertisement

Using this control, Leviev was able to downgrade critical Windows components — including drivers, dynamic link libraries and the NT kernel — to older versions with known vulnerabilities. He also found ways to downgrade important security features like the Windows Secure Kernel, Credential Guard, the hypervisor and Virtualization-Based Security (VBS).

To make it clearer, older versions of Windows have unpatched issues that hackers can exploit to steal your data or take control of your PC. These issues get fixed when you update to the latest software version. But if hackers manage to downgrade your PC to an old, vulnerable version, they can easily break into your system.

windows OS

Windows software running on these laptops. (Kurt “CyberGuy” Knutsson)

BEST POWER STRIPS AND SURGE PROTECTORS 2024

What is Microsoft doing about the issue?

Microsoft has acknowledged the security flaw and is actively working on a fix. In response to an inquiry from CyberGuy, a company spokesperson provided the following statement:

“We appreciate the work of SafeBreach in identifying and responsibly reporting this vulnerability through a coordinated vulnerability disclosure. We are actively developing mitigations to protect against these risks while following an extensive process involving a thorough investigation, update development across all affected versions, and compatibility testing, to ensure maximized customer protection with minimized operational disruption.”

Advertisement

The Redmond, Washington-based company said it is developing a security update that will revoke outdated, unpatched VBS system files to mitigate this threat. Due to the complexity of blocking such a large quantity of files, rigorous testing is required to avoid integration failures or regressions. The company added:

“We are not aware of any attempts to exploit the technique outlined in this report and are continuing to monitor the threat landscape as it evolves.”

laptop on table

HP laptop running Windows. (Kurt “CyberGuy” Knutsson)

WINDOWS FLAW LETS HACKERS SNEAK INTO YOUR PC OVER WI-FI

Learn how to update your Windows software

Advertisement

Microsoft says that hackers haven’t exploited the vulnerability yet, and even if they do, there’s little you can do from your side. Still, as general cybersecurity hygiene, keep your operating system and other software up-to-date.

It is one of the most effective ways to safeguard your devices from known vulnerabilities and security flaws. To update your Windows software and benefit from the latest security patches, follow these simple steps:

For Windows 10 and Windows 11

  • Click on the Start menu and select “Settings” (or press the Windows key + I shortcut).
  • In the Settings window, click on “Update & Security.”
  • Under the “Windows Update” section, click “Check for updates.”
  • If updates are available, including the patch for the Wi-Fi driver vulnerability, Windows will download and install them automatically.
  • Once the installation is complete, you may be prompted to restart your computer to apply the updates.

For Windows 8.1 and Earlier Versions

  • Open the Control Panel and navigate to “System and Security.”
  • Under the “Windows Update” section, click “Check for updates.”
  • If updates are available, including the patch for the Wi-Fi driver vulnerability, select them and click “Install updates.”
  • Follow the on-screen instructions to complete the installation process.
  • Restart your computer if prompted to apply the updates.

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET 

Four additional ways to protect your Windows PC

The report says that even if the downgrade flaw is quite undetectable, hackers still need a way to get remote access to your computer. This is where you can stop them. Here are some steps you can take:

1. Install a strong antivirus program: Hackers often gain access to devices by sending infected emails or documents or tricking users into clicking a link that downloads malware. You can avoid this by installing strong antivirus software that will detect any potential threat before it can take over your device or router. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

2. Recognize urgent requests as potential scams: Always be wary if someone is urgently requesting you to do something like send money, provide personal information or click on a link — chances are it’s a scam.

Advertisement

3. Use strong and unique passwords: Create strong passwords for your accounts and devices, and avoid using the same password for multiple online accounts. Consider using a password manager to securely store and generate complex passwords. It will help you to create unique and difficult-to-crack passwords that a hacker could never guess. Second, it also keeps track of all your passwords in one place and fills passwords in for you when you’re logging into an account so that you never have to remember them yourself.  The fewer passwords you remember, the less likely you will be to reuse them for your accounts. Get more details about my best expert-reviewed Password Managers of 2024 here.

4. Enable two-factor authentication: Enable two-factor authentication whenever possible. This adds an extra layer of security by requiring a second form of verification, such as a code sent to your phone, in addition to your password. 

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET 

Kurt’s key takeaways

This latest Windows vulnerability is a major concern, exposing your PC to potential risks by allowing hackers to downgrade your system to an older, less secure version. By exploiting this flaw, attackers could access outdated vulnerabilities and take full control of your machine. While Microsoft is aware of the issue and is working on a fix, the fact that this vulnerability even exists is a stark reminder of how critical it is to stay on top of system updates and security measures. Keep an eye on your system’s security and be cautious as more details emerge.

Advertisement

Do you regularly check for and install updates to avoid security threats like this? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

Advertisement

New from Kurt:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Technology

Google is shutting down Android Instant Apps over ‘low’ usage

Published

on

Google is shutting down Android Instant Apps over ‘low’ usage

Google has confirmed that it plans to shut down Android’s Instant Apps later this year, attributing the decision to “low” usage of the functionality.

Instant Apps were introduced in 2017, and allow developers to create mini versions of Android apps that load, well, instantly. Users can try apps and demo games from the click of a link, without having to fully install them. That makes the experience easier for users to navigate and provides developers with more ways to find new audiences.

Android Authority first reported that Google is moving on from the feature, which came to light after developer Leon Omelan spotted a warning about the change in Android Studio:

“Instant Apps support will be removed by Google Play in December 2025. Publishing and all Google Play Instant APIs will no longer work. Tooling support will be removed in Android Studio Otter Feature Drop.”

Google spokesperson Nia Carter confirmed the decision to The Verge, explaining that Instant Apps simply haven’t been popular enough to continue supporting.

“Usage and engagement of Instant Apps have been low, and developers are leveraging other tools for app discovery such as AI-powered app highlights and simultaneous app installs,” Carter says. “This change allows us to invest more in the tools that are working well for developers, and help direct users to full app downloads to foster deeper engagement.”

Advertisement
Continue Reading

Technology

11 easy ways to protect your online privacy in 2025

Published

on

11 easy ways to protect your online privacy in 2025

NEWYou can now listen to Fox News articles!

Privacy is getting harder to protect in a world where everything is connected. 

Whether you’re chatting with an AI, checking your email or using your smartphone, your personal information is constantly being collected, tracked and sometimes even sold. 

But protecting your privacy in 2025 doesn’t have to be overwhelming. With a few practical steps, you can take back control of your data and make your online life safer. This guide walks you through 11 easy ways to get started.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Advertisement

Scrabble pieces form the word “SCAM.” (Kurt “CyberGuy” Knutsson)

1. Don’t overshare: Even with AI tools like ChatGPT

AI chatbots like ChatGPT are useful, but they’re not private journals. The platform owners may have privacy policies and use the latest security measures, but that doesn’t mean you should let your guard down. When using these tools, refrain from sharing any personal information, such as your name, address, birthdate, passwords, financial details or sensitive conversations. Remember that AI systems store and process your inputs, and despite security promises, data breaches can occur.

SCAMMERS CAN EXPLOIT YOUR DATA FROM JUST 1 CHATGPT SEARCH

Tip: Treat all online forms of AI interaction like public forums. Keep your examples generic and use caution with anything that could identify you.

If you’re going to input your personal information while using these AI tools, ensure there is an option to prevent them from sharing it. On ChatGPT, for instance, do the following:

Advertisement
  • Go to Settings.
  • Click Data controls.
  • Tap Improve the model for everyone.
privacy tips 2

Steps to prevent ChatGPT from sharing your personal information (Kurt “CyberGuy” Knutsson)

  • Toggle off Improve the model for everyone.
  • Click Done.
privacy tips 3

Steps to prevent ChatGPT from sharing your personal information (Kurt “CyberGuy” Knutsson)

Why it matters: AI tools may seem personal, but they’re not secure vaults. Guarding what you share helps prevent misuse, identity theft or data leaks from breaches.

CLEAN UP YOUR PHONE: SPEED, STORAGE AND PRIVACY BOOST IN MINUTES

2. Use alias email addresses

Your email is often the key to your online identity and a common target for spam. By creating disposable email aliases that forward messages to your main inbox, you can keep your real address hidden from websites and services. These unique aliases act as shields, so if one starts getting spammed or is involved in a data breach, you can simply deactivate it without affecting your main email account.

My top recommendation to avoid being inundated with spam emails is to use an alias email address. An alias email address is an additional email address that can be used to receive emails in the same mailbox as the primary email address. It acts as a forwarding address, directing emails to the primary email address.

In addition to creating throwaway email accounts for online sign-ups and other circumstances where you would not want to disclose your primary email address, alias email addresses are helpful for handling and organizing incoming communications. 

Advertisement

Sometimes, it’s best to create various email aliases so that you don’t have to worry about getting tons of spam mail or having your information taken in a data breach. An alias email address is a great way for you to stop receiving constant spam mail by simply deleting the email alias address. See my review of the best secure and private email services here.

Why it matters: You stay anonymous, avoid data leaks and never have to change your main email address again.

BEST ANTIVIRUS FOR MAC, PC, IPHONES AND ANDROIDS – CYBERGUY PICKS

3. Take advantage of Facebook’s privacy checkup

Meta frequently updates its privacy settings, so it’s best to check regularly to see how you can improve your privacy. Use Facebook’s Privacy Checkup tool to review and adjust crucial settings, including post visibility, app permissions, search visibility and friend-request settings. This comprehensive tool helps ensure your profile remains as private as you want it to be. You can find the tool by following these steps:

  • Log in to your Facebook app on your phone.
  • Then click the menu icon in the bottom right.
  • Tap Settings.
  • Click Privacy Checkup.

Once you open the Privacy Checkup, you’ll be guided through several key areas to customize your privacy preferences and better control your information.

  • Who can see what you share: Adjust who can view your posts, photos and profile details to limit access to only people you trust.
  • How people can find you on Facebook: Manage who can send you friend requests, look you up using your email or phone number, and decide whether your profile appears in search engines.
  • Your data settings on Facebook: Review which apps and websites have access to your Facebook data and remove any you no longer use or trust.
  • How to keep your account secure: Set up two-factor authentication, update your password and monitor login alerts to protect your account from unauthorized access.
  • Your ad preferences on Facebook: Control how Facebook uses your activity to show you personalized ads and opt out of categories that feel too intrusive.

Quick tip: Set a reminder to run a privacy checkup every few months, especially after major Facebook updates. This way, you’ll always be in control of your information.

Why it matters: Social media platforms thrive on your personal data. Adjusting your settings regularly puts you back in control of what others and Facebook can see and use.

Advertisement
privacy tips 4

Facebook’s privacy checkup (Kurt “CyberGuy” Knutsson)

HOW TO PROTECT YOUR ONLINE PRIVACY AND SECURITY ON YOUR NEXT CRUISE VACATION

4. Scrub yourself off the internet automatically

Your name, phone number and home address may already be listed on people-search sites like Spokeo, Whitepages and BeenVerified. These data brokers collect and sell your personal information without you even knowing it. Fortunately, personal data removal services are available to protect your privacy. They automatically send legal removal requests to hundreds of data brokers. They also go above and beyond by continuously monitoring them in case these third parties happen to get your information again.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you. Check out my top picks for data removal services here.

Get a free scan to find out if your personal information is already out on the web.

Why it matters: The less personal information available about you online, the harder it is for scammers and identity thieves to target you and the more peace of mind you’ll have. 

Advertisement

10 SIMPLE STEPS TO IMPROVE YOUR SMARTPHONE’S SECURITY AND PRIVACY

5. Use a privacy-focused messaging app

If you’re still using standard texting apps or platforms like Facebook Messenger, it’s time to upgrade to a more secure option. Apps like Signal and Session offer end-to-end encryption, no ads and no metadata tracking, meaning they can’t see who you’re talking to or what you’re saying. Both apps support disappearing messages, giving you more control over how long your conversations stick around.

Why it matters: Your messages stay private and can’t be accessed by hackers, advertisers or the app developers themselves.

6. Stop Google from tracking your every move

Google collects a massive amount of data from your searches, YouTube views, Gmail activity and location history, all of which fuels targeted advertising. You can stop much of this tracking by turning off Ad Personalization and deleting your activity history. Here’s what to do:

  • Go to Google’s My Ad Center.
  • Find the Ad Personalization section.
  • Toggle the switch to turn off ad personalization. This stops Google from using your activity to tailor ads.

Manage activity history

  • In My Ad Center or via your Google Account, go to Data & Privacy.
  • Under History Settings, review and pause or delete: Web & App Activity, YouTube History and Location History (if applicable).

Delete existing activity data

  • Select Manage all Web & App ActivityManage all YouTube History, etc.
  • Delete past activity by choosing a time range (e.g., “All time”) and confirming deletion for each category.

Opt out of third-party ad personalization

  • Scroll to Ad settings and look for third-party ad personalization options.
  • Opt out of partner sites’ ad personalization if available.
  • If you have multiple Google accounts, repeat these steps for each account.

Why it matters: Cutting down on ad tracking reduces how much of your online behavior is used to build a profile on you, often without your knowledge.

7. Turn off location tracking on your smartphone

Apps don’t need to know your every move. Disabling or limiting location tracking is one of the simplest ways to protect your physical privacy. Here’s what to do:

Advertisement

iPhone:

  • Go to Settings.
  • Tap Privacy & Security.
  • Click Location Services.
  • Scroll down and tap the app you want to manage.
  • Choose your preferred setting: Never to block location access completely; Ask Next Time Or When I Share to allow location only with your permission; While Using the App to allow location only when the app is open.

For apps like Maps, toggle Precise Location off to prevent pinpoint tracking.

To disable location tracking entirely, toggle Location Services off at the top of the Location Services page (this will stop all apps from using your location).

Android:

Settings may vary depending on your Android phone’s manufacturer.

  • Go to Settings.
  • Tap Location.
  • Tap App permissions or App location permissions.
  • You will see a list of apps grouped by their location access: Allowed all the timeAllowed only while in useAsk every time; Not allowed.
  • Tap any app to change its location permission. Choose from: Allow all the time; Allow only while using the app; Ask every time; Don’t allow.

For apps that have location access, you can also turn Precise location on or off if you want to limit accuracy. Repeat for each app you want to manage.

Tip: If you want to stop all apps from accessing your location, you can turn off Location at the top of the Location settings page.

Advertisement

Why it matters: Prevents apps, advertisers and even your OS from building a detailed map of your daily routines.

privacy tips 5

Steps to turn off location tracking on your smartphone (Kurt “CyberGuy” Knutsson)

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

8. Change the default admin password on your router

Most routers ship with default admin usernames and passwords like “admin” or “1234,” and these are publicly available online. Hackers know this and often scan networks looking for unprotected routers. Here’s what to do:

  • Log in to your router’s settings via its IP address (often 192.168.1.1 or 192.168.0.1).
  • Change the admin username and password to something strong and unique.
  • Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here.

Why it matters: Prevents intruders from hijacking your home network and spying on your devices.

9. Enable WPA3 encryption on your Wi-Fi router

WPA3 is the newest wireless encryption protocol and offers much stronger protection than WPA2. If your router supports WPA3, enabling it is a no-brainer. How to check:

  • Log into your router settings and look under Wireless Security.
  • If WPA3 is available, enable it.
  • If not, consider upgrading to a newer, security-focused router. Check out our top routers for best security 2025.

Why it matters: Stronger encryption means hackers can’t easily intercept or crack your Wi-Fi traffic.

10. Set up a guest network for visitors and smart devices

Your friends don’t need access to your entire home network and neither do your smart lights and doorbells. Creating a guest network adds a safety barrier between your personal devices and less trustworthy ones. Steps to take:

Advertisement
  • Log into your router settings.
  • Create a separate guest network with its own password.
  • Connect smart devices, TVs and guests to this network only.
  • Keep your main network just for personal computers and phones.

Why it matters: Even if a smart device gets compromised, the attacker won’t have access to your main network or sensitive devices.

11. Use a secure, private browser for sensitive browsing

Not all browsers treat your privacy equally. Switching to a browser designed for privacy like Brave, Firefox or DuckDuckGo’s browser can drastically cut down on the amount of data collected about you while you browse. Also, use incognito/private mode for sensitive searches. 

Why it matters: Reduces digital fingerprints and helps stop advertisers and data brokers from building a profile on you based on your browsing behavior.

SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES

Kurt’s key takeaways

Staying private online isn’t about being paranoid; it’s about making smart, intentional choices. With the right tools and a few small changes, you can take back control of your data in 2025. Digital privacy is always changing, so it’s a good idea to check your settings and habits every so often. The upside is that for every new privacy challenge, there’s usually a way to push back and keep your information safe.

Advertisement

If you’d like a printable checklist or want this content turned into a shareable infographic, just let me know.

What privacy tools and methods do you use to protect your data online? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Advertisement

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.

Continue Reading

Technology

Anker is recalling over 1.1 million power banks due to fire and burn risks

Published

on

Anker is recalling over 1.1 million power banks due to fire and burn risks

The recall covers about 1,158,000 units that were sold online through Amazon, Newegg, and eBay between June 2016 and December 2022. The affected batteries can be identified by the Anker logo engraved on the side with the model number A1263 printed on the bottom edge. However, Anker is only recalling units sold in the US with qualifying serial numbers. To check if yours is included, you’ll need to visit Anker’s website.

Anker is offering affected consumers their choice of either a $30 gift card (the recalled battery cost around $27) that can be used on Anker.com, or a free 10,000mAh Anker power bank as a replacement (model A1388) featuring upgrades including a charge level display and a USB-C charging cable lanyard.

To receive the gift card or the replacement, Anker requires a “photo of the power bank with the submission date and the word ‘recall’ or ‘recalled’ written clearly in permanent marker,” to be submitted, and a “photo showing the model number and serial number (SN) printed on the bottom of the device.” The company is also requesting a purchase receipt, but it’s not mandatory to participate in the recall.

After confirming that your power bank is one of the recalled units, Anker says it should be taken to a facility that can safely dispose of lithium-ion batteries due to the risk of fire. Those facilities can be found through the Environmental Protection Agency’s website or other organizations in the US that specialize in processing e-waste. Do not throw them in the trash, recycling bins, or used battery boxes provided at various retail locations.

The recall is also a reminder that power banks and backup batteries can potentially develop severe issues over time, as these particular units are almost a decade old. If you’ve been regularly using devices featuring lithium-ion batteries for a while, you’ll want to be mindful of issues like overheating or visible swelling and dispose of them properly if you think there’s a potential problem. And while the technology is currently more expensive than lithium-ion batteries, you can also consider upgrading to solid-state batteries which are more powerful, safer, and longer lasting than what we commonly use now to power our devices.

Advertisement
Continue Reading
Advertisement

Trending