When I wrote about using Windows 11 for a month as part of the ongoing OSNews fundraiser (keep donating to get me to do the same for macOS!), one of the things I mentioned was that “the modern desktop context menu has its own classic Win32 context menu”. This is, in fact, a long-standing complaint I’ve repeatedly used as the perfect example of just how chaotic and low-quality Windows has become. Thankfully, and naturally I fully attribute this to my repeated complaints (*), Microsoft has been working on a brand new, faster, configurable context menu, and Neowin actually reviewed it.

If you ask me, this revamped context menu addresses just about the biggest problem users had with the one in Windows 11, and that is the need to click through more buttons than necessary to do simple things like renaming a file or opening its properties. That problem is now basically gone.

I have no issues with the new design. It looks modern, it feels more consistent with the rest of Windows, and even though all the new sections can still make it look a little busy, you now have the option to make it as simple or as button-packed as you want. That should cover most use cases and preferences well. I’d even say that when the new context menu becomes available to everyone, my guide on how to bring back the classic context menu might become obsolete.

↫ Ivan Jenic at Neowin

The biggest reason I’m linking to this is not because I care about whatever monster of a context menu Windows users are having to deal with. No, I’m only linking to this because I never in my life imagined I’d be linking to a review of a context menu. I mean, at least it’s not the chess application icon. That would be embarrassing.

I get a perverse sense of joy out of this.

Raymond Chen explains what, exactly, the file winstart.bat in Windows 95 is used for.

In Windows 95, you could create a winstart.bat file in your Windows directory. During startup, the virtual machine manager initializes and creates the so-called “System virtual machine” (the “System VM”), which is the virtual machine that all Windows programs run in. But before running the user-mode kernel in that virtual machine, the virtual machine manager runs the winstart.bat batch file if it exists.

↫ Raymond Chen

Chen needs to use several diagrams to really explain what the batch file is used for, but as a very crude summary, it allows you to load TSRs that only apply to Windows programs, while not affecting any additional DOS command prompts you may load later after Windows is already running. While many think it’s a Windows 95 feature, it was already present in Windows 3.x.

A unique feature that I doubt many people made active use of.

This was bound to happen.

According to a new report from Taiwanese publication United Daily News (UDC,) Microsoft is raising the cost of Windows license fees for hardware makers by a much higher amount than normal. According to the report, certain OEMs are seeing licensing price hikes of between 7% and 10%.

↫ Zac Bowden at Windows Central

Like every other tech company diving head-first into “AI”, Microsoft is losing money on its gamble head-over-fist, with no profitability in sight. Since admitting betting the company on “AI” was a mistake is out of the question, Microsoft has to extract the money from somewhere else to make up for it. The cost of Windows licenses for OEMs is an obvious lever to pull, as OEMs really have nowhere else to turn to (yes, desktop Linux is making gains, but not in any meaningful numbers), so they’ll take hit and pass the cost on to consumers.

The end result will be that prices for laptops will increase even more than they already have thanks to the “AI”-induced RAM and component crisis, creating a double-whammy of price increases caused by “AI”, either directly or indirectly. It’s just another category of products we can add to the cost of living crisis that’s causing untold harm and damage to hardworking people all over the world.

The price of incompetence is rarely paid for by the incompetent.

There’s been a small flurry of articles from a variety of sources, all talking about more or less the same thing: Microsoft is trying to explain why Windows 11 is as difficult to develop as it is, in turn justifying why it’s become such a mess over the years. I’m picking this one from Windows Central, which is an interview with Microsoft’s CVP of Design and Research for Windows and Devices, Marcus Ash. Taking the long, still ongoing transition from the Control Panel to the Settings application as an example, Ash explains why this is such a long and difficult process.

Unsurprisingly, Ash says that the reason this has taken so long is that Microsoft prides itself on compatibility with legacy tooling and workflows, so it can’t just rush in and modernize everything without first ensuring the modern replacements maintain functionality with what came before.

↫ Zac Bowden at Windows Central

This isn’t really news to anyone. One of Windows’ prized strong points is its often excellent backwards compatibility. This doesn’t just apply to individual applications, but also to things like software makers adding settings panels to Control Panel, or complex business applications expecting certain entry points into the Control Panel to exist – and much, much more, all over the operating system. I’m exaggerating, but you can’t so much as move a single pixel in the taskbar without breaking some component of some obscure corporate middleware suite from 1999 that somehow still functions as the beating heart of like 187 Fortune 500 companies.

Sometimes I wonder if Microsoft is going about this the wrong way entirely. Of course, I have no idea what I’m talking about, but I feel like Microsoft has so man tools at its disposal to deal with this issue that it’s not really using to their fullest potential. Specifically, Windows itself has a number of incredibly capable tools in its toolbox to make sure any application ever written for Windows and even DOS, regardless of how many bits it requires, can run. Windows has advanced and highly capable tools for virtualisation and containerisation, and on top of that, Windows NT has a very capable personalities system that feels underutilised, too.

Couldn’t these tools be harnessed to effectively isolate the entire backwards compatibility problem from the actual Windows operating system people use, and turn them into optional components installed and activated when required by an older application? Isolating backwards compatibility this way would then leave the Windows team much less shackled and more free to improve Windows at every level without having to worry so much about maintaining backwards compatibility. If the components an older application needs are virtualised, containerised, or part of a Windows NT personality and thus frozen in time, the Windows team would be free to work on the “current” version of said component without breaking the application in question.

I feel like Microsoft has tried to use these technologies to address backwards compatibility in the past, but in true Microsoft fashion, it always seems to do so halfheartedly, without any real coherent vision behind it. Again, I wish to reiterate I’m by no means qualified enough to make any definitive statements about this, but it sure does feel like Microsoft is underutilising a lot of the tools it already has at its disposal.

When I had to use Windows 11 for a month because you people paid me to do so, the one seemingly small thing that really ground my gears were Windows 11’s terrible right-click (context) menus. They were full of stuff I didn’t put there, slow to open, and in some places, a modern Windows 11 context menu would have its own old Win32 context menu with even more stuff. It seems Microsoft is finally going to fix all of this.

This new compact menu will be much faster and more reliable, as it foregoes needing to load in all the third-party actions that slow it down currently. Additionally, at the Windows Insider Meetup in London, Microsoft showed me a new context menu customization feature coming soon that will let users configure what apps and actions appear in the right-click menu.

↫ Zac Bowden at Windows Central

Look, I know to us non-Windows users this seem like an incredibly small and dumb thing to focus on, but when your operating system is as much of a trashfire as Windows has become, improved context menus are massive improvements that make a meaningful difference. Of course, Microsoft makes these types of promises all the time, so I’ll believe it when I see it.

It’s that time of the week again, I guess.

The year is 2026, and I’m still amazed when I find a new entry in my Start menu’s All apps list for an app I don’t remember installing. This time, it’s Microsoft again, and the product is OneDrive Photos, which appears to be yet another photo viewer and editor for Windows 11 that nobody asked to have installed automatically.

While searching for Microsoft Photos, a new app called “OneDrive Photos” showed up in my results out of nowhere. It appears to have arrived either via Windows Update or an update for the OneDrive sync client on Windows.

↫ Mayank Parmar at Windows Latest

Just don’t use Windows. You people paid me to use it and it was not a fun experience.

A Hermes AI agent was used to automate parts of a cyberattack targeting Thailand's Ministry of Finance, according to research by Hunt.io and security researcher Bob Diachenko. The investigation found evidence of an operator using the agent in unattended "YOLO" mode while staging exploit code, web shells, stolen credentials and a previously unreported Hades implant on exposed infrastructure. The research team identified three open directories on a Hong Kong-hosted server between July 9 and 13, 2026. The directories contained 585 files totaling about 470 MB of attack code and stolen credentials. The material included tools targeting the ministry's internal systems, multiple known vulnerabilities and payloads for both Windows and Linux environments.

Hermes AI Agent Ran Unattended Attack Operations

The investigation found logs showing the Hermes AI agent enumerating hosts associated with the Ministry of Finance, traversing files and collecting privilege escalation information from an adjacent system. Hermes was reportedly operated in YOLO mode, which removes prompts requiring human approval for potentially dangerous commands. Logs recovered from the exposed directories showed the agent using LinPEAS to assess privilege escalation opportunities and enumerate services, files and system information. Researchers also found evidence that the agent was instructed to search content connected to the Office of the Permanent Secretary for Finance. The material included PDF, DOC and XLS files, along with personnel records. However, the researchers said there was no evidence that these files had been exfiltrated. The investigation also identified a custom LinPEAS script configured to scan for several 2026 Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-31431 and CVE-2026-43284/CVE-2026-43500.

Hades Implant Found in Windows and Linux Payloads

The 10 July directory contained 62 compiled binaries for Windows and Linux. Analysis of two recovered samples confirmed that they belonged to the same custom malware codebase, which the operator referred to as the Hades implant. The malware communicates over HTTPS and uses URI paths designed to resemble legitimate web traffic. Its communications are encrypted using AES-256-GCM with a hardcoded key for each build. The Windows and Linux versions also included different persistence and execution capabilities. The Windows build supported persistence through Registry Run keys and scheduled tasks, while the Linux version used cron jobs. The Windows sample also supported screenshot capture and process hollowing, while both versions included interactive shell, SOCKS proxy and file transfer capabilities. The recovered samples contained hardcoded command-and-control addresses that researchers said linked the malware to additional infrastructure identified through TLS certificate analysis.

Attackers Targeted Thailand's Ministry of Finance Infrastructure

Custom scripts found across the exposed directories referenced Thailand's Ministry of Finance systems, including an administrative web panel, Hadoop infrastructure and the Ambari management platform. Researchers identified tooling designed to target Apache HiveServer2 using hardcoded credentials and a malicious Hive user-defined function capable of executing commands. Additional scripts targeted an internal GlassFish application server and attempted to deploy web shells. The investigation also uncovered scripts testing mailbox credentials against ministry mail infrastructure, along with session material associated with an internal administration panel and document management platform. The attackers had also staged exploit code targeting several known vulnerabilities, including CVE-2021-3156, CVE-2021-4034 and CVE-2017-7269. The research noted that the tooling indicated preparation for privilege escalation and further movement within targeted systems.

Researchers Link Infrastructure to Ongoing Activity

Hunt.io identified three exposed directories hosted on 43.246.208[.]207, an IP address associated with infrastructure in Hong Kong. TLS certificate analysis connected the activity to two additional servers in Malaysia and Hong Kong. The researchers also identified a separate IP address in the Hermes configuration that appeared to have been used to connect to the staging server. According to the investigation, the activity appeared to be ongoing when the exposed directories were discovered. The combination of an autonomous AI agent, a cross-platform implant and custom tools targeting specific Ministry of Finance systems indicated significant preparation by the operator. The initial method used to gain access to the Ministry of Finance network remains unknown. Researchers said they found no evidence confirming that data had left the network. Thailand's national CERT and National Cyber Security Agency were notified on July 15, 2026, and acknowledged receipt the same day. The research was published following a standard seven-day disclosure window. The investigation assessed with low to medium confidence that the actor may be Chinese-speaking or closely familiar with the Chinese language, based on the infrastructure history and language-related indicators. Researchers said they would continue tracking the activity and associated infrastructure.

Dave Farquhar published an article today about Windows NT 3.1’s place in the market when it was originally released, and while the article is interesting and a fun read, it does mention this:

[…] Microsoft took its nascent code that it intended to form the base of OS/2 3.0, renamed it Windows New Technology, and eventually released it as Windows NT 3.1.

↫ Dave Farquhar

While Microsoft did, in fact, use the “New Technology” branding as a marketing trick, this is not what “NT” originally stood for. Two developers from the original Windows NT development team, Mark Lucovsky and David Thompson, explained all the way back in 2003 that “NT” came from the codename for Intel’s then-new RISC platform, the Intel i860 (Raymond Chen confirmed the veracity of their story). The i860 was the first target platform for Windows NT, and it was codenamed “N-10” – NT.

Finally, it was time to start writing some code. “We checked the first code pieces in around mid-December 1988,” Lucovsky said, “and had a very basic system kind of booting on a simulator of the Intel i860 (which was codenamed “N-Ten”) by January.” In fact, this is where NT actually got its name, Lucovsky revealed, adding that the “new technology” moniker was added after the fact in a rare spurt of product marketing by the original NT team members. “Originally, we were targeting NT to the Intel i860, a RISC processor that was horribly behind schedule. Because we didn’t have any i860 machines in-house to test on, we used an i860 simulator. That’s why we called it NT, because it worked on the ‘N-Ten.'”

↫ Paul Thurrott

The i860 was one of Intel’s many attempts over the years to replace x86 with something more modern, but – as would become tradition with Intel and attempting to replace its x86 architecture – it suffered from endless delays, missed targets, and lacklustre performance. It saw only sporadic use in the market, and ended up on the chopping block after only a few years. Intel tried to replace x86 again soon after with Itanium, which suffered an identical fate.

Still, the engineers working on the i860 platform in the late ’80s and early ’90s at Intel can at least take some pride in that to this day, the most popular desktop operating system in the world got its name from the product they developed. Intel’s i860 might barely even be worthy of a footnote today, but billions of PC users log into their Windows “N-10” machines every day, unwittingly carrying a torch for the failed x86 replacement.

The Verge reviewed the latest Surface Laptop, which only comes with 8GB of RAM at a higher price than the previous 16GB model, and they conclude that Windows isn’t really usable on 8GB of RAM. Whether that’s true or not I do not know – I would assume it depends a lot on your usage – but this quote from the review I found quite peculiar:

I was on a Microsoft Teams call (using the app, not a browser) when the host streamed a brief video, which made the whole laptop hang for several seconds. At the time, I had about 10 Chrome tabs open across two desktops, alongside Slack and Signal — not an obscene level of multitasking.

↫ Antonio G. Di Benedetto at The Verge

Excuse me, but that is actually an obscene level of multitasking because every single one of those “applications” is a complete Chrome browser. Just in the paragraph above, there’s four individual complete Chrome browsers running, with little to no optimisation. Why would anyone be surprised this scenario strains a mere 8GB of RAM? This isn’t merely a Windows problem; this is a programmers choosing suboptimal tooling × managers have no idea what they’re doing problem.

If Teams, Slack, and Signal had been proper, native applications instead of websites running in terrible frameworks, Windows 11 would have handled this scenario just fine.

Well, this is new – but not at all unexpected considering the state of Windows and the wider technology industry. When you connect certain LG monitors to a Windows machine, Windows Update will pull in a bunch of adware promoting antivirus trash. Of course, all done without any consent, because Silicon Valley inherently does not understand nor respect consent.

Windows Update first installed LG extension and software component packages. Windows Reliability Monitor showed that LG Monitor App Installer appeared one minute later. The installation did not display a consent prompt or require the user to approve the download.

Gamers Nexus tested the application across 32 consecutive system boots. It displayed a McAfee promotion during 31 of them. On the remaining boot, it promoted one of LG’s own monitor utilities. The McAfee popup offered a 30-day trial that would convert into a paid subscription.

↫ WhyCry at VideoCardz

Don’t use Windows.

In what should be a surprise to absolutely nobody, Microsoft assigns a persistent identifier to every Windows installation, tying it to its user, and the company has no issues handing it over to law enforcement. Abhijith M B at windows Latest dove into the details, and it’s just as bad as you would expect.

Am I glad Stokes got caught? Yes, without hesitation. Thirty-five pages of a teenager bragging about diamond chains spelling out “HACK THE PLANET” while extorting a jewelry store don’t leave much room for sympathy, whatever role Microsoft’s telemetry played in building the case.

But that doesn’t make the GDID okay. Every company selling you software has some version of this, and a persistent device identity is a reasonable thing to build into activation and fraud systems. What gets me is that most people had never come across the term GDID before a federal court filing such as this. Microsoft wrote one sentence about it in an Azure Monitor reference table meant for enterprise IT admins pulling update reports, not for the 1.6 billion or so regular people whose PCs are generating this data.

You might be tech savvy enough to turn off Activity History, pick a local account, and strip out every scrap of optional telemetry, but none of it changes the fact that the identifier exists, and that it answers to your Microsoft Account instead of you. Microsoft only told the public about it once a court forced the issue.

↫ Abhijith M B at windows Latest

The thing is, even without this GDID, I can’t imagine Microsoft would have much trouble tying a Windows installation to a specific user. Consequently, I’m afraid the following is going to happen: this story gains even more traction, Microsoft removes the GDID, and everyone thinks the problem is resolved. Of course, in reality, any one of the hundreds of other metrics and data Microsoft collects can and will still be used in the exact same way as this GDID thing in this case.

If my experiences with Windows 11 weren’t clear enough – don’t use Windows. Just don’t.