Category: Information Technology

A patch Microsoft released on Wednesday to fix a zero-day vulnerability in its Defender security engine may cause Windows machines to write files large enough to completely consume available disk space, the researcher who discovered the flaw said.

RoguePlanet, tracked as CVE-2026-50656, came to public notice in June when NightmareEclipse, the pseudonymous name used by a researcher, disclosed it along with code for exploiting it. The vulnerability allows remote attackers to gain administrative control of Windows 10 and Windows 11 machines, even when real-time protection has been disabled. Over the past few months, the anonymous researcher has published a handful of other zero-days that have sent Microsoft scrambling to develop patches.

Writing files of unlimited size

Microsoft said Wednesday that it patched RoguePlanet with an update to the Microsoft Malware Protection Engine, which is used by the Defender antivirus app. The fix will automatically be downloaded and installed without users having to take any action. Wednesday’s update also includes “defense-in-depth updates to help improve security-related features.”

In a post on Thursday, NightmareEclipse said the defense-in-depth additions produce behavior that may allow attackers to exhaust all available space on a hard drive by writing massive amounts of data to it. The newly introduced mitigations create a problem in mpengine.dll, the driver associated with the Microsoft Malware Protection Engine, that in some cases causes it to leak 8 bytes of data when trying to open a file. New functionality in SpyNet, a cloud service that allows Microsoft Security Essentials or Forefront Endpoint Protection to send reports about suspicious software and programs to Microsoft, also plays a role in the potential mass file-writing behavior.

Defender normally places hard limits on how big a file can be written to disk when scanning and quarantining a machine.

“This implementation make [sic] sense, because quarantining a huge file will cause Defender to completely exhaust the available disk space,” the researcher wrote. “I found a small exception to this rule, apparently the spynet functions in mpengine.dll really wants [sic] to keep a local copy of Zone.Identifier ADS file and it does not matter how big this file is, Windows Defender will cache it locally anyways.”

SAVE OVER $10: As of July 9, select colors of the Soundcore P30i by Anker noise cancelling earbuds are on sale for $27.99 at Amazon. That’s $12 off their full price of $39.99.

One of our favorite pairs of budget earbuds just got cheaper. As of July 9, select colors of the Soundcore P30i by Anker noise cancelling earbuds have dropped to $27.99 at Amazon. Compared to their full price of $39.99, that’s $12 you save.

Both the black and green pair have hit this price at the retailer, but they’re actually not the only colors on sale. The blue, pink, and white pairs are discounted for a couple dollars extra at $29.99. No matter which color you go with, you’ll still enjoy some savings.

These earbuds have stood out to us as the best budget pair under $50, with our roundup saying, “The active noise cancellation on them is impressive for their price, able to block out the bustle of busy streets or the noisy gym.” However, it does add that, “it isn’t the best noise cancellation or sound we’ve ever experienced,” as a “$50 pair of earbuds just can’t compete with a $300 pair,” but if you don’t mind that, they’re a great option to grab that won’t break the bank.

Our roundup also highlights that, “Advanced audiophiles on a budget will enjoy the addition of custom EQs and multi-point connection.” Plus, their battery life can definitely keep up with you, boasting up to 45 hours with the charging case, or 25 hours with ANC enabled.

Don’t miss out on this great offer on the Soundcore P30i by Anker noise cancelling earbuds at Amazon.

Want to learn more about getting the best out of your tech? Sign up for Mashable’s Top Stories and Deals newsletters today.

The FBI, in partnership with Google and other tech companies, struck a massive blow against NetNut, a public-facing residential network proxy service that secretly hosted a botnet controlling approximately 2 million Android TVs and similar smart home devices. The network was being used for password-spraying, credential attacks and other malicious activity. 

Residential proxy botnets make malicious traffic appear like normal internet use, allowing everyday devices to be secretly hijacked by cybercriminals to conduct illegal activities using your home internet. Infected home devices were often preloaded with malicious software used by the botnet, which made traditional home security practices less effective at detecting and stopping the problem. 

According to an FBI statement emailed to CNET, on July 2, the federal agency carried out “a court-authorized seizure of multiple domains as part of a coordinated law enforcement action with the Department of Justice and IRS Criminal Investigation targeting infrastructure associated with the NetNut residential proxy platform, its administrators, and users.”

Authorities worked in tandem with Google, Lumen Technologies and the Shadowserver Foundation to go after NetNut and its services — also known as the Popa botnet by security researchers. Google said in a blog post that the actions “caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” NetNut’s website now shows an FBI takedown notice. 

Google acknowledged that taking down NetNut is only the first step. Because these proxy networks frequently share and resell access to each other’s botnets, disrupting one provider often leads malicious actors to simply purchase capacity from a competitor. To create a lasting impact, Google said it must “target the infrastructure of several interconnected providers” simultaneously.

How this botnet worked

In 2024, security researchers at XLab found the Vo1d botnet, a massive collection of hacked, mostly off-brand Android TV devices. If you recall the fake AI video of Donald Trump and Elon Musk appearing on TVs at the Department of Housing and Urban Development, that was most likely caused by a malicious actor using the Vo1d botnet. 

Those same researchers also found Popa, a legitimate network protocol plug-in that turned consumer devices into residential proxy nodes with the user’s consent. But the version researchers found was being installed on the hacked Android TV devices without user consent. According to the FBI, a residential proxy node is “an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere.” 

Residential proxy networks are legal in the US, and businesses that use them usually sell access to enterprise customers, where they’re often used for security penetration testing, ad verification, gathering marketing data and unlocking geo-locked websites. Since residential nodes use real IP addresses from someone’s home, the company or person using the node is seen by the World Wide Web as just an ordinary user, and their true identity is hidden. 

Android TV devices that were part of the Vo1d botnet and infected with Popa allowed cybercriminals to conduct attacks, scrape data from infected devices looking for sensitive information like passwords, and even hijack the device to perform malicious tasks, all while the hacker appeared to originate from the house across the street or the apartment across the hall without actually being there. 

That is where NetNut comes in. NetNut is a public-facing residential proxy network operator owned by Alarum Technologies, a publicly traded company out of Israel. Per Google, it was one of the largest residential proxy network operators in the world.

On the surface, NetNut appeared to be a legitimate business and even had an official website where you could buy its services. However, late last month, multiple researchers confirmed that traffic generated by the Popa botnet was from NetNut users. This meant that NetNut was effectively selling its botnet out in the open to anyone, for both legitimate and illegitimate uses, which gave authorities enough evidence to take the company down.

Stay safe from the next attack

The good news is that making sure you don’t wind up as part of the next Android TV-powered botnet is actually pretty easy. According to Google and security researchers, the overwhelming majority of the hacked devices were no-name Android TV streamers that you can freely find on Amazon, Temu, AliExpress and other online outlets.

Many of those streaming sticks and boxes are quite cheap, but they do work. The problem is that nearly all of them run ancient versions of Android, which are easier to hack since those devices don’t have the modern protections afforded by newer versions. 

Some brands sell streaming boxes that promise free streaming with no subscriptions. These are often advertised on Instagram and TikTok by fresh-faced influencers who claim to offer a no-subscription streaming TV solution. Security researchers found that many of those streamer boxes came prehacked with botnet software installed out of the box. 

So, step one to avoid becoming part of a botnet is to only buy Android TV devices from reputable companies like Sony, Nvidia, Google and others. Try to buy one that runs a modern version of Android and still gets security updates. You should also avoid those “one price, no subscriptions” boxes on social media, since they definitely come with malware preinstalled. 

Botnets like this aren’t unique to Android TV. Smart home devices are also consistently included in botnets, so step two to keeping yourself safe is to make sure you apply all of the above advice to your smart home products as well. You should also keep up with the latest trends, like promptware, a new kind of malware that hacks your devices by asking the onboard AI to do it on behalf of the hacker. 

The incident serves as an important reminder to be wary of low-quality, cheap tech peddled by influencers — or you risk having your personal ID information stolen. The usual array of things helps as well, like making sure to have a robust password, learning how to avoid phishing emails and not revealing any personal details to suspicious characters online.