Hacker News

points by greyhound1 2 days ago | 0 comments

Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.

I did the same, then ran:

Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

But I can only get Microsoft.Paint 11.2609.401.0 and Microsoft has said different things in different places, so it's not even clear if this has the fix or not.

This article has more info on the confusion they're causing: https://windowsforum.com/news/cve-2026-83844-windows-11-pain...

[–] iririririr 2 days ago

why get package after something that is obviously a malicious backdoor?

If I still mamaged any windows host, i would be deploying a remove-package script asap to the entire fleet.

[–] Natsu 1 day ago

Get-AppxPackage gives you the currently-installed packages for a Windows profile in PowerShell. It does not, in fact, download or install anything.

The whole command I gave gives you the currently installed version of MS Paint so you can see if you're already vulnerable or not.

[–] izacus 2 days ago

What kind of nonsense are you writing here right now? When the next Linux kernel CVE happens, you'll also delete all the kernels from your fleete because they're a malicious backdoor?

When did y'all stop using some basic sense before writing? -_-

[–] Natsu 1 day ago

Maybe we can blame PowerShell a bit for confusing names on this one. Get-AppxPackage does not download or install anything, contrary to what one might wrongly assume.

[–] trashb 2 days ago

Great time to jump to the openbsd kernel!

[–] BSDobelix 2 days ago

>When did y'all stop using some basic sense before writing? -_-

Yeah samesame:

-Compares a kernel with paint

-Uses a program with telemetry/spyware instead of installing on of the 1000s alternatives

[–] izacus 2 days ago

It's a built-in tool of the OS, not some random spyware. Stop with the bizarre hyperbole.

[–] BSDobelix 2 days ago

>It's a built-in tool of the OS, not some random spyware

Oh no dont get me wrong, it's definitely not some random spyware, it's deliberately made by Microsoft targeted at Windows Users who cant buy a Enterprise License.

[–] pjmlp 2 days ago

Windows Update and Store are slowly becoming the same, and Paint gets delivered via the store for quite some time, there was even some drama related to it.

https://interestingengineering.com/culture/rip-microsoft-pai...

[–] lossyalgo 2 days ago

Ugh so I have to unblock the Store in my firewall just to get patched. What a PITA.

[–] aDyslecticCrow 1 day ago

or block ms paint aswell.

[–] gadrev 2 days ago

Did the same and it quickly updated itself when I went into the "Paint" page (but I had to go there first). No indication of what just happened a few seconds later.

[–] pixelpoet 2 days ago

If MS knew it would drive people to actually use their app store, they would have created the CVE themselves.

[–] nik282000 1 day ago

They kinda did.

[–] ManuelKiessling 2 days ago

For a split second, I visualized you walking into a brick and mortar Microsoft Store to get your security update done on your laptop, and somewhere in the middle of that split second I caught myself thinking „typical Microsoft“, and then I came to my senses.

[–] supriyo-biswas 2 days ago

For some reason, I had the same idea.

[–] alt227 2 days ago

You made a slip. Thats Apple you are talking about, and it actually happens.

[–] IAmBroom 1 day ago

If brick and mortar Apple stores are staffed by "Geniuses"...

[–] neuroelectron 2 days ago

Wow, what a weird confluence of events