Passkeys are supposed to replace passwords and stop phishing attacks. But Google and Microsoft warn that passkeys alone are not enough if weaker recovery methods remain attached to accounts. “Each account is only as secure as its weakest credential,” Microsoft says, warning that passwords and SMS recovery options can become a new attack surface even after passkeys are deployed.

“Passkeys are an easier and safer way to access online accounts compared to passwords,” Google says, “and even traditional multi-factor methods.” But passkeys are not 100% safe on their own. In a new warning, Google says “even when you normally use a passkey, it’s important to secure your account with two-step verification (2SV)." You need this in case “someone tries to impersonate you and claims to have lost your passkey."

If there is an automated recovery process that exploits weaker credentials to bypass a passkey, then that passkey is not 100% safe — it really is that simple. Attackers can target recovery flows and fallback credentials instead of passkeys.

This is an interesting twist — because much of the rhetoric is that a passkey alone is enough. But Microsoft flags account recovery as a new attack surface, as the surge in passkey use shuts down traditional attack methods.

“Deploying passkeys improves sign-in," Microsoft says. "But most accounts still have a password or SMS method attached 'just in case’ — and as long as those credentials exist, they’re an attack surface.”

The best recovery method is to use your account passkey on a different device to complete a recovery step. As a back-up, Microsoft says a process that pushes users to provide ID and a face scan is best. “As NIST recommends, high-assurance recovery requires government-issued ID and biometric verification.”

Microsoft’s advice is aimed at enterprise users — Google’s primarily at home users. That’s a major difference, but it doesn’t remove the threat. Gmail and other Google accounts are high-value to cyber attackers, and remain under attack.

Google tells users to add 2SV to “prevent hackers from accessing your account with an additional layer of security." But given an attacker can use Google’s account recovery process, pretending to be you and claiming a passkey has been lost, the form of 2SV becomes more critical than ever. There are two types you should use. Google Prompts and an Authenticator (which can be an app on your phone).

You should stop using SMS one-time codes. These are the weaker, traditional forms of MFA that Google and Microsoft dismiss in their passkey promotions. Authenticator apps are now easy to set up and use, and should replace SMS codes on all your key accounts. You then need to disable SMS codes completely.

Passkey adoption is surging. But as Microsoft warns, these protections are only effective if users “eliminate phishable credentials entirely.” Google’s warning that passkeys alone are not a 100% solution is timely — especially as attackers shift toward recovery flows and fallback authentication methods.

source

A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares.

This technique, created by Kim Dvash of Israel Aerospace Industries, abuses the Windows 'CreateFileW' API and file-sharing modes to prevent other users and applications from opening files while handles remain active.

The GhostLock technique abuses the 'dwShareMode' parameter in the CreateFileW() function, which specifies the type of access other processes have to a file while it is opened.



When a file is opened with 'dwShareMode = 0`, Windows grants the process exclusive access to the file, preventing other users or applications from opening it.

For example, the following code will open the finance.xlsx file in exclusive mode, preventing any other process from accessing it.

HANDLE hFile = CreateFileW(
    L"\\\\server\\share\\finance.xlsx",
    GENERIC_READ,
    0,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL
);

When attempting to do so, Windows will display the following 'STATUS_SHARING_VIOLATION' error instead.



The researcher has published a GhostLock tool on GitHub that automates this attack by recursively opening a large number of files on SMB shares. While these file handles are open, new attempts to access the files will fail with sharing violations.

The tool can be run by "standard" domain users, and does not need any elevated privileges to lock files.

This is further compounded if an attacker launches the attack from multiple compromised devices simultaneously, while continuously reacquiring file handles as previous processes are terminated.

However, once the associated SMB session is terminated, the GhostLock processes are killed, or the affected system is rebooted, Windows automatically closes the handles, and access to the files is restored.

Dvash told BleepingComputer that the technique should be viewed primarily as a disruption attack rather than a destructive one, like ransomware.

"Yes, the impact is disruption-based, not destructive. The parallel to ransomware is the operational downtime window, not data loss," Dvash told BleepingComputer.

While this attack is more akin to a denial-of-service technique, it could be useful as a decoy during intrusions.

Attackers could use widespread file-access disruptions to overwhelm IT staff while conducting data theft, lateral movement, or other malicious activity elsewhere in the environment.

The researcher says that many security products and behavioral detection systems focus on detecting mass file writes or encryption operations. GhostLock primarily generates large numbers of legitimate file open requests, making it less likely to be detected.

"The only observable that reliably identifies this attack is the per-session open-file count with ShareAccess = 0 at the file server layer — a metric that lives inside storage platform management interfaces, not in Windows event logs, not in EDR telemetry, not in network flow data," explains Dvash.

The researcher has shared SIEM queries and an NDR detection rule in the GhostLock whitepaper that IT teams and defenders can use as a template for detections.

source

Redstallion/Getty Images

When your phone turns off, it shuts down all background processes. Upon turning back on, it initializes everything from scratch, including the operating system, the hardware configurations, and apps that may run in the background on your phone. This happens regardless of whether you choose a restart or power your phone off, and both methods can result in a faster, smoother experience afterward.

The only difference between rebooting your phone and shutting it down is the amount of time it stays powered off. A restart means that it turns on immediately after it stops all processes and starts initialization, whereas when you power it off, you choose when to boot it back up. There is no evidence that powering your phone off offers any real system benefits over simply restarting or rebooting your phone — it doesn't "deep clean" your phone's memory, nor does it deal with processes any better than restarting it would. Since a reboot takes significantly less time than turning the power off and turning it back on, restarting your phone is almost always the better option.

 Just like how often you should clean your phone depends on your specific needs, how often you need to reboot a smartphone differs from person to person. Most experts recommend that you at least do it every once in a while if you want to continue using your phone for a long time or are dealing with a laggy phone.

When should you power off your phone?


Weerayut Chaiwanna/Getty Images

When it comes to the technology and how the system behaves, there's no advantage to powering your phone off compared to restarting or rebooting it. However, there are cases where controlling how much time your phone stays powered off can be better than a quick and immediate reboot.

For example, if you need to conserve your phone battery, keeping it powered off can be a good idea. Do note that the battery saved is minimal, since the difference in battery percentages will generally be single digits if you shut your phone down versus letting it stay on in sleep mode. Additionally, your phone eats up a small burst of battery when booting up, so unless you'll have your phone off for 8-plus hours — such as when you're asleep — we don't recommend powering your phone off just for the battery advantages.

Another scenario where fully turning off your phone's power can help is if it's overheating badly. If your phone is throttling performance due to graphic-intensive work or using the device outside in the sun, then closing all system operations is the best way to cool it down. If you restart your phone in this case, even if the background process shut down once, they'll simply restart — compared to shutting it off, where all stress on the phone will cease until you turn it back on. You may also need to turn the power off when you're fixing your phone at home, such as when you're replacing a battery or before entering the Android recovery menu.

source

Microsoft built Windows 11 around web wrappers and Electron apps. Now it's trying to undo that.

Microsoft is trying to repair Windows 11's reputation and overhaul its app ecosystem, and both efforts center on one idea: get back to fundamentals and make the OS feel like a fast, coherent, native-first platform again. That shift runs from Satya Nadella's pledge to "win back fans" to internal engineers publicly declaring that "Native apps are back!" for Windows 11.

During Microsoft's fiscal Q3 2026 earnings call, Nadella put consumer Windows front and center. As part of Microsoft's broader push to reconnect with users across its platforms, he framed the Windows strategy as a back-to-basics project around performance, quality and core UX. "When it comes to our consumer business, we are doing the foundational work required to win back fans and strengthen engagement across Windows, Xbox, Bing, and Edge. In the near term, we are focused on fundamentals, prioritizing quality and serving our core users better," the CEO said.

He cited work already underway in Windows 11, including performance improvements for lower-memory devices, a streamlined Windows Update experience, and a renewed emphasis on "core features and fundamentals that matter most to our customers."

Those remarks came as Microsoft reported that monthly active Windows devices have surpassed 1.6 billion, a figure that includes Windows 10 and older versions. Nadella argued that, over time, "Windows value will extend to deliver unmetered intelligence at the edge," positioning the OS as the local substrate for AI workloads instead of just a thin client for cloud services.

For longtime Windows users, though, the more immediate concern has been day-to-day friction: ads and upsells in the out-of-the-box experience, UI inconsistencies, and system components that feel sluggish compared with older releases.

Inside the Windows organization, the response is showing up as a mix of OS-level and app-level changes that all point in the same direction: less web wrapper, more native code.

Microsoft has already teased at least 18 notable improvements for Windows 11 in 2026, several of which are rolling out to early adopters. The company is testing a "quieter" Windows with fewer upsells and ads in the setup flow, along with a more streamlined first-time setup that takes fewer clicks to reach the desktop, including the ability to skip updates during OOBE.

Other work focuses on fundamentals: reducing baseline RAM usage, fixing dark mode inconsistencies across legacy dialogs and tools like Registry Editor, and moving more Control Panel functionality into the modern Settings app without breaking older hardware and workflows.

Performance problems haven't been limited to the OS shell. The Microsoft Store's evolution into a framework-agnostic distribution channel made it easier to ship Progressive Web Apps and Electron-style wrappers, but it also pushed many popular services away from native WinUI implementations. Netflix and WhatsApp are among the apps that moved from native frameworks to WebView2-based PWAs on Windows 11, with testing showing WhatsApp using around 600MB of RAM on an 8GB machine while idle.

Electron-based Discord can use up to 4GB of RAM and includes a mechanism to restart itself when usage gets too high. Users have been complaining for some time on forums like Reddit that this shift to web-centric clients has hurt overall OS responsiveness, especially on mid-range hardware.

Microsoft's own apps face similar issues. The web-based Copilot experience on Windows 11 pulls in a full Edge stack and, in testing, has been observed using roughly 500MB of RAM in the background and up to 1GB under active use.

The company's answer is not to retreat from rich clients but to rebuild them with native tooling. Rudy Huyn, a Partner Architect working on the Store and File Explorer, has said he is forming a team focused on building better Windows 11 apps and has confirmed that new experiences from that group will be "100% native."

That push gained a public signal boost when David Fowler, a distinguished engineer at Microsoft known for his work on .NET and ASP.NET Core, posted a simple message on X: "Native apps are BACK!"

Inside the Windows community, the comment has been read as an indication that Microsoft intends to move key experiences away from web wrappers and back to native frameworks such as WinUI.

One visible example is the Windows 11 Start menu, which is shifting from React-based components to WinUI to cut latency and improve reliability, alongside plans to make it resizable again, as it was in Windows 10.

Under the hood, .NET 10 and its Native AOT (ahead-of-time compilation) support are expected to be central to this strategy. Native AOT is designed to reduce startup times and memory footprints for .NET applications compared with traditional JIT-heavy .NET deployments, which could directly address the overhead seen in today's WebView2 and Electron apps.

If Microsoft can demonstrate those benefits in its own in-box apps – File Explorer, communications clients, utilities – it will be in a stronger position to convince third-party developers to follow.

The more difficult problem is ecosystem inertia. Developers have grown used to cross-platform web stacks that let them target Windows, macOS, and mobile with a single codebase, even if that comes with higher resource usage on Windows.

To shift that calculus, Microsoft will likely need more than architectural guidance; it will have to show that 100% native Windows 11 apps can deliver clear performance and UX gains without giving up reach, and possibly sweeten the deal with Store visibility or other incentives.

For now, Nadella's focus on "foundational work" and Fowler's assertion that native apps are back describe the same direction: a Windows 11 that feels less like a cluster of web views and more like a coherent, responsive operating system.

source

Microsoft is now rolling out its Xbox mode to all Windows 11 PCs. The new Xbox mode adds a full-screen interface to the Xbox PC app, much like Steam’s Big Picture Mode, and originally debuted as the Xbox Full Screen Experience (FSE) with Asus’ Xbox Ally devices.

“Some players in select markets will be able to download the Xbox mode experience today, with availability expanding to more players in those markets over the next several weeks,” says the Xbox team. You’ll be able to get the Xbox mode by installing the latest Windows update for Windows 11.

Xbox mode aims to try and bridge the gap between Xbox consoles and Windows, but its original debut felt like a beta on the Xbox Ally devices. “Since first introducing Xbox mode, formerly known as ‘full screen experience,’ on Windows handhelds, we’ve been listening closely to player feedback and continuing to evolve the experience across devices,” says the Xbox team. “Those learnings directly shaped Xbox mode on Windows 11 PCs.”

Microsoft is also rolling out improvements to the Xbox Ally X handheld today, including a preview of its Auto SR upscaling technology. Xbox console owners are also getting a new dashboard update today, with the ability to disable Quick Resume on individual games and a feature to add custom colors to the dashboard.

source