Microsoft confirms: Office update may cause deactivation or uninstallation

Posted on by Martin Brinkmann

If you still run Office 2016, 2019 or 2021 on your devices, and there is little reason not to use these versions, then you may have experienced a rather odd issue.

Microsoft released KB5002907 recently, an optional update for out-of-date Microsoft 365 apps installations. The main purpose of the update was to “address issues with devices not receiving updates to Microsoft 365 Apps”.

However, on some devices the update was installed on, it caused issues with the Office installation. Microsoft writes:

As part of the repair action applied by this update, some devices were left without functioning versions of Microsoft 365 Apps or Office.

  • In some cases, the product may appear to be unlicensed.
  • In rare cases, the product may have been removed.

In other words, installation of the optional update for Office may have caused the activated program to deactivate itself or, in rarer cases, uninstall entirely.

Microsoft says that it has stopped the distribution of the update to investigate the issue. It has published instructions for affected customers, suggesting to either activate Office again or download and reinstall it.

The number of affected customers is not mentioned, which makes it difficult to determine its impact on the Windows community that run perpetual versions of Office. Considering that Microsoft stopped the update from being pushed via Windows Update, it is likely that the number is not insignificant.

Granted, the update does not install automatically via Windows Update, but many customers are probably installing all the updates that Microsoft is delivering to their devices.

So, if you are affected, follow the two links above to either re-activate the Office installation, if it has just been deactivated by the update, or download and install it anew.

Exempt sites from memory clean-ups in Brave Browser to avoid service interruptions

Posted on by Martin Brinkmann

Most modern web browsers support memory automatization to reduce the memory consumption by changing the status of loaded websites to inactive, if they have not been used for a period of time.

The main idea is to make sure that the browser does not use an ever increasing amount of memory on a device.

Brave Browser calls this feature Memory Saver and it is set to balanced by default. Balanced means, that the browser balances memory saving and the time before websites are set to inactive. The browser reloads the inactive website when its tab is selected by the user.

While the feature is helpful in taming memory use, it may interfere with sites that require constant activity. Maybe it is a live ticker, an auction site, or a chat site.

The most recent version of Brave Browser introduces an exclude list. You may use it to add sites to a list of exemptions. Any site put here is never set to inactive in the browser.

Using it is simple:

  1. Load brave://settings/system in the browser’s address bar.
  2. Find “Always keep these sites active” on the page that opens.
  3. Click on the “add” button to add a new site.
  4. Select any current site or add a site manually instead.
  5. Confirm the change with a click on the “add” button in the add-sites-interface.

Once you have added at least one site, you see it listed under the menu item. You may edit or remove each individually with a click on the three-dots icon next to the site name.

The free and open F-Droid 2.0 app for Android is here with big changes

Posted on by Martin Brinkmann

While most Android users rely solely on Google Play to install games and apps on their devices, some prefer less-privacy-invasive markets for that.

F-Droid is a small but popular choice when it comes to that. Once installed, it gives users access to hundreds of apps and games that they can install. While it may look like another store on first glance, it offers several advantages over Google Play:

  • Strictly free and open source software.
  • Apps and games are compiled by F-Droid from public source code with manual source code reviews.
  • Trackers, ads and telemetry are removed, if they exist.
  • Doesn’t rely on Google Play services.

One of the main downsides is the relatively low number of apps and games offered by F-Droid. Still, it is a good place to look for something before looking elsewhere.

F-Droid 2.0 promises a redesign of the official app, with key components rewritten to integrate better with current Android design patterns.

Existing users will notice that the navigation has been shortened to the three entry points Discover, Search and My Apps. Categories are found in Discover now and My Apps is the place to manage installed apps, updates and such.

Discover, one of the central features of F-Droid, has been redesigned in the new version to improve the experience. From new, smaller, categories to meta categories and a search that works better thanks to the inclusion of app descriptions, categories and translations.

Advanced users find filtering options to better find specific apps or games. Installs are also handled natively now, thanks to the EU’s Digital Market Act and Google’s changed stance on third-party app stores.

Lastly, users who run very old Android devices, Android 6.0 or earlier in particular, can’t use the new version anymore.

Windows Search may index folders automatically: how to turn it off

Posted on by Martin Brinkmann

Microsoft introduced a new Windows Search feature recently that aims to improve the indexing of content on Windows devices. For the unaware, search indexing has several goals, including improving the speed of searches on Windows and using more information to return results. Indexing records information about files in folders that do get indexed.

Microsoft explains:

Indexing is the process of looking at files, email messages, and other content on your PC and cataloging their information, such as the words and metadata in them. When you search your PC after indexing, it looks at an index of terms to find results faster.

Up until now, indexing ran on a base set of folders, such as the Documents and Music folders, and any folder the user or organization added to an allow-list.

This changes with recent Windows updates, starting with KB5120998 for the first users. The new feature “Automatically find additional relevant locations” is available on some devices already. It appears to be turned on by default and will add folders to the indexing runs on Windows devices.

The idea is to add folders that are used often by the user, so that Windows Search can return information from these folders more reliably.

While that may be a good idea on devices where users do not touch the indexing configuration at all, Windows users who want to stay in control may want to turn the feature off to decide which folders do get indexed on the system.

Here is how you check for the existence of the feature and how you turn it off, if it exists:

  • Open the Settings app via the Windows button or by pressing Windows-I.
  • Go to Privacy & security > Search
  • Search for “Automatically find additional relevant locations”.
  • Switch the feature to off, if turned on and existing.

Note that this won’t disable indexing on the Windows system, but that it will prevent Windows from adding new locations to the indexing process without user say in the matter.

There is a new way to create a local account in Windows 11 Home, but it may not last

Posted on by Martin Brinkmann

For the past few years at the very least, Microsoft tried to eliminate any option that allowed customers to create a local account in Windows 11 Home and also Pro editions.

While some loopholes remained, it was obvious that Microsoft picked data collecting and binding customers to Microsoft accounts over choice.

A new option to create a local account during setup in Windows 11 Home was discovered earlier this month. While Microsoft has not made any mention of the new option or commented on reports on sites like Windows Latest, it appears that customers may create a local account right away, at least for now and if they use the latest installation media and Insider version.

Apparently, all it takes is to click on the “learn more” link that is prominently displayed on the setup page that asks you to create a Microsoft account. Instead of following the instructions, you activate the link and are taken directly to the local account creation page.

Clearly, this looks more like an oversight on Microsoft’s part and not a change used to regain the trust of the many disgruntled Windows customers and admins out there.

Still, with Microsoft introducing some changes that part of the userbase requested for years, there is a slim chance that this could be more than just an oversight on Microsoft’s part.

Windows users who prefer reliable options may want to stick to trusted options, such as using the open source software Rufus to prepare the installation media to support the creation of local accounts right during setup.

Google Search testing another AI push

Posted on by Martin Brinkmann

When you use Google Search currently, there is a good chance that you get an AI overview at the top of the search results page. It lists some text and a “show more” button to expand the full AI generated content. The organic results are shown below the fold already, which has led to a organic traffic decline for many sites. For Google, it is an opportunity to keep searchers on its own website, which increases revenue.

Google is now testing a change on its search results pages that has the potential to be even more damaging to websites around the world, reports Seroundtatble. The change expands the display of the AI reply on the results page. Users do not have to click on the “show more” button anymore to display the entire reply, as it is displayed automatically.

According to several Google employees, the automatic expansion is only happening “for topics where our systems determine it to be most useful”. Users who started to scroll already will notice that the expansion of AI content has stopped, according to the company.

This in turn means that the organic results are pushed down even further on the search results page, which may lead to even less traffic.

Google confirmed the test but it is unclear at this point whether it is going to make it the standard going forward. If I had to guess, I’d put a large sum on Google making it the new default for certain searches at the beginning before it gets expanded further.

It is clear that Google is pushing AI on Search and other company products. It has made and is making large investments in AI infrastructure and these are not paying for themselves.

For publishers, being listed in Google Search is becoming less and less of an attractive option to attract users and increase revenue at the same time.

Some have begun to block AI from indexing their websites, but unless other content discovery services are taking over, many may see a decline in the coming years or vanish entirely from the Internet.

Another Windows Issue: Microsoft Defender Antivirus is turned off notification, but it is actually enabled

Posted on by Martin Brinkmann

The latest optional update for Windows 11 may cause several issues. Microsoft had to admit earlier that the update could cause certain games to become unresponsive. Two days ago, Microsoft admitted that users might also experience a gigantic mouse cursor instead of custom ones.

Yesterday, the company confirmed that the built-in security tool Microsoft Defender Antivirus might cause a notification to be displayed that is untrue.

The app might show the notification “Microsoft Defender Antivirus is turned off” even when it is enabled and working correctly.

Microsoft writes:

After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that “Microsoft Defender Antivirus is turned off,” even though the antivirus is functioning correctly and all settings show it as active. These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.

The issue may occur in any version of Windows and Windows Server with Microsoft Antivirus running. Microsoft says that it is investigating the issue and plans to release a fix in a future Microsoft Defender Antivirus update.

For now, there is no workaround or other option to resolve the issue. Affected users may want to ignore the notification until the issue gets fixed by Microsoft engineers.

Note that the optional update should be considered a beta release. The three confirmed issues show why. Most Windows users may want to skip them entirely, as the changes are usually included in the upcoming month’s security update for the operating system.

Whether the issues are resolved then remains to be seen. At least the RGB issue is resolved and should not affect Windows users installing the September 2026 security updates.

Brave Accounts and Email Aliases launch

Posted on by Martin Brinkmann

Brave Software, maker of Brave Browser, announced the launch of Brave Accounts yesterday. While the main idea of introducing native accounts is similar to how other browsers handle user accounts, that is, allowing users to sync data and use other services associated with the account, Brave Software uses technology that is vastly different.

Instead of sending hashes or encrypted passwords to remote servers, Brave Software says that passwords never leave the browser in the first place. It is “never transmitted”, which eliminates the need to trust a company securely storing password data in the first place.

Brave writes:

Here’s the short version: when you sign in to a service built on Brave Accounts, your password itself is never sent to our servers: not encrypted, not hashed, nor “briefly held in memory and then discarded”. The password is never transmitted, so you don’t have to “trust” that we are keeping it safe for you. We don’t know it at sign-up, we don’t know it at login, and if someone were to steal our entire password database tomorrow, with high probability they still wouldn’t know it.

Brave uses OPAQUE, “an augmented password-authenticated key exchange” for that. The underlying idea is that it allows the client — the browser in this case — to prove that the password is known without revealing it.

Technically the system relies on an Oblivious Pseudorandom Function.

This means that: you blind your password with a random value and send the blinded version of it; the server applies a secret key it holds and sends the result back; then, your device unblinds it. The output is a value derived from both your password and our server-side secret (the secret key), but the server learned nothing about your password, and you learned nothing about the key.

There are three advantages to using this method instead of the traditional password-hash checking according to Brave Software:

  • Passwords are never transmitted.
  • Attackers can’t use password dictionaries in their attacks.
  • The export key can be used for other tasks, such as end-to-end encryption.

Email Aliases

One of the first features to make use of the new account system is email aliases. It allows Brave users to keep their personal email addresses private by creating aliases.

Sites communicate only with the alias, which forwards messages to your “real” email address.

After you create a new Brave account, you get the option to use email aliases right in settings or while signing up for a new account on any website.

The main new address seems to be bravealias.com, which should work for the time being on most sites. Eventually, some sites will start to block and it would be a good idea to get additional options regarding the alias domain that one can pick for the alias.

All users get five free email aliases once they have set up a Brave account. Brave Software plans to introduce a paid upgrade option in the future, but has not revealed any details on that at the time of writing. It is very likely that it will feature higher limits, if any, and maybe also other alias options.

Microsoft confirms: Latest .NET updates may cause printing issues

Posted on by Martin Brinkmann

Microsoft released security updates for .Net on August 11 to address six unique vulnerabilities. After installing the update on supported systems, users may notice printing issues.

Microsoft confirmed the issue in the release notes for the update. There, the company notes that “some WPF applications may fail with a System.IO.FileFormatException when printing or generating PDF/XPS content that uses certain fonts, including Calibri” after installing the update.

WPS refers to Windows Presentation Foundation, “UI framework that’s resolution-independent and uses a vector-based rendering engine, built to take advantage of modern graphics hardware.”

The issue is under investigation currently and there is no workaround for users at the time. App developers, who use WPF, may make use of a workaround to mitigate the issue.

Doing so will “disable security productions introduced in the August 2026 update”, which may increase the exposure to the addressed vulnerabilities.

Uninstalling the update could also restore printing functionality, but I have not tested this as I could not replicate the issue on my devices. Considering that disabling the security fixes is a recommended workaround by Microsoft, I’d say there is a good chance that this could work.

Chrome

The Chrome Web Store has a fake VPN extensions problem

Posted on by Martin Brinkmann

Security researchers at Socket have uncovered a large impersonation and browser traffic redirection campaign in the Chrome Web Store.

According to a news post on the official website, the campaign uploaded 737 VPN extensions to the Chrome Web Store and managed to lure more than 75,000 users to installing them on their devices.

The extensions impersonated 66 legitimate privacy and VPN brands—such as NordVPN, Proton VPN, and Surfshark—to deceive users into downloading them.

Core Threat Behaviors

  • Traffic Interception: Once activated, the extensions route the victim’s entire browser session through a SOCKS5 proxy controlled by a single threat actor. This places the attacker in a position to read and monitor all browser traffic.
  • Subscription Fraud: The extensions funnel users toward a paid subscription tier that promises premium server locations (such as Japan, Canada, and Australia). However, Socket found that none of these premium servers actually exist.

Deceptive Tactics & Evasion

  • DNS-over-HTTPS Evasion: The extensions use Cloudflare and Google’s DNS-over-HTTPS to silently resolve proxy IPs, preventing the victim’s machine from emitting plaintext DNS queries that security software might flag.
  • Store Review Gaming: The developers submitted false justifications to Chrome Web Store reviewers and used post-approval code substitution to sneak in the malicious proxy behaviors.
  • Hidden Domains: An internal developer manual accidentally left inside one of the extensions revealed explicit instructions to staff to never hardcode the actual domains into the extension, ensuring they stay hidden from automated scanners.

The campaign specifically targets Russian-speaking users who are trying to bypass internet censorship to access blocked services like YouTube, Instagram, and ChatGPT. By impersonating trusted anti-censorship tools, the attackers successfully tricked thousands of users into handing over full visibility of their web browsing activity to a threat actor based in Russia.