[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmHramo3r801ENEIs5tW44hXU73twaYJOcZHYPjeL6QU":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"88e5d4ed-b1b7-400f-97f0-eef47f6d6246","Windows, Linux, Android File Notification Systems Leak User Activity","windows-linux-android-file-notification-systems-leak-user-activity-efebb5","Researchers show that file-change notification systems can leak keystroke timing, browsing activity, and WhatsApp media events. The post Windows, Linux, Android File Notification Systems Leak User Activity appeared first on SecurityWeek.","Researchers have discovered that file-change notification systems in Linux, Android, Windows, and macOS can be exploited to monitor user activity, including keystroke timing and browsing habits, without requiring elevated privileges. While file contents are not exposed, the timing and names of file events are sufficient to reconstruct user actions. Microsoft considers the Windows behavior to be by design, while fixes are partially available for Linux, and none are listed for Android or macOS.","File notification systems on Windows, Linux, Android, and macOS can leak user activity.","https:\u002F\u002Fwww.securityweek.com\u002Fwindows-linux-android-file-notification-systems-leak-user-activity\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fsoftware-leak-operating-system.jpeg","2026-09-25T10:53:32+00:00","2026-09-25T12:00:28.990573+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Windows","product",{"name":21,"type":19},"Linux",{"name":23,"type":19},"Android",{"name":25,"type":19},"macOS",{"name":27,"type":19},"WhatsApp",{"name":29,"type":19},"Firefox","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2025-68788","Linux kernel fix for file notification system hardening",[18,21,23],{"controls":55,"vendors":114},[56,85],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":86,"name":87,"problem":88,"products":89},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",[115,121,126],{"slug":116,"name":117,"logo_path":118,"roles":119},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[120],"affected",{"slug":122,"name":123,"logo_path":124,"roles":125},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[120],{"slug":127,"name":128,"logo_path":129,"roles":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[120],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":148},"file-notification-apis-silently-expose-user-behavior-across-major-oses","File Notification APIs Silently Expose User Behavior Across Major OSes","Researchers found that file-change notification systems — built into Linux, Android, Windows, and macOS — can be abused by unprivileged processes to infer user activity such as keystrokes and browsing patterns through timing and file event metadata alone. The root cause is that these OS-level APIs were designed for developer convenience without sufficient access controls or privacy guardrails, meaning any installed application can silently observe behavioral signals. Microsoft's decision to treat this as 'by design' highlights a systemic gap where security and privacy implications of foundational OS features are underweighted during design. This matters because attackers or malicious apps can profile user behavior without triggering traditional privilege-escalation alerts, making detection extremely difficult.",[136,137,138,139,140,141,142,143,144,145,146,147],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 10: Malware Defenses","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SC-39: Process Isolation","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","NIST CSF PR.PT-3: Principle of Least Functionality","MITRE ATT&CK T1056.001: Keylogging","MITRE ATT&CK T1082: System Information Discovery",{}]