GoKawiil
Tech News
Several Canadian regions, including parts of British Columbia, Alberta and Manitoba, stopped observing daylight saving changes on November 1, locking into fixed UTC offsets. Microsoft has confirmed that Outlook, Power Automate, Fabric and SharePoint On-Prem have not fully adapted, producing incorrect meeting times and requiring manual fixes from users and administrators.
Herdr has released a native desktop application that organizes terminal sessions and coding agents into workspaces called 'spaces,' each containing tabs and splittable panes. The app includes an agents sidebar that tracks the status of coding agents across all spaces—marking them as Working, Blocked, Done, or Idle—and lets terminals keep running after the window closes. It installs via shell script on Linux/macOS and PowerShell on Windows, and can also install its companion herdr-core component if missing.
A ColdFusion developer discovered that a hosting provider's server-wide IIS rewrite rule, deployed after PHP's October 21, 2026 emergency patches for a critical flaw dubbed PHP2Shell, was blocking legitimate multipart form-data requests on sites that don't even run PHP. The piece walks through using PowerShell to detect whether PHP is installed on a Windows/IIS ColdFusion or Lucee server—often left over from control panels or old phpMyAdmin installs—and how to remove it if unused.
Microsoft has published steps for IT admins to restore access to the Exchange Web Services (EWS) API after apps relying on it began failing with login prompts or protocol errors. Admins can either uncheck a block option in the Microsoft 365 admin center's Baseline Security Mode or run a PowerShell command to re-enable EWS within four hours. Microsoft says this workaround only lasts until April 2027, when EWS will be permanently retired.
A how-to guide explains using Windows 11's built-in Task Scheduler to automate routine maintenance, such as running WinGet's upgrade command weekly to keep apps current and delaying non-essential startup apps to speed up logon. It also covers pairing Task Scheduler with tested PowerShell scripts for file copying or housekeeping, and notes Power Automate for desktop as an alternative for interface-based automation, though broader use may require paid licenses.
Security researchers at Manifold Security found that third-party.com, a domain frequently used as a generic placeholder in developer documentation and code samples, now hosts a fake Cloudflare verification page. BleepingComputer confirmed the page mimics a 'Performing security verification' CAPTCHA that copies a malicious PowerShell command to a user's clipboard, then instructs them to paste and run it via Windows key + R, which downloads and executes malware from an external URL.
Microsoft is telling enterprises to migrate away from Slmgr.vbs, the VBScript-based tool used to manage Windows product activation, because VBScript itself is being phased out of Windows. The company recommends switching to PowerShell equivalents before VBScript is removed entirely in a future Windows release.
Microsoft has identified a malware campaign named TerminalFix that mimics Cloudflare and other trusted verification pages to trick Windows users into pasting commands into PowerShell or Command Prompt. Unlike earlier ClickFix attacks that used the Run dialog for simpler commands, TerminalFix's terminal-based approach lets attackers run longer, multi-stage scripts that establish persistent proxy access into a victim's machine and network.
Microsoft has identified a new ClickFix-style social engineering campaign called TerminalFix, which uses fake Cloudflare CAPTCHA prompts to trick users into pasting malicious commands into Windows Terminal or PowerShell. Once executed, the command triggers a multi-stage attack chain designed to give attackers a persistent foothold inside enterprise systems.
Microsoft has identified a new ClickFix-style attack called TerminalFix that uses fake Cloudflare CAPTCHA pages on compromised websites to trick users into pasting and running malicious PowerShell commands in Windows Terminal. Rather than deploying simple infostealers, the campaign runs a multi-stage chain that hides payloads inside PNG images via steganography, establishes persistence through scheduled tasks and registry keys, and ultimately installs a custom Python-based reverse tunnel into the victim's internal network.