I try not to write too many doom-and-gloom cybersecurity stories, but this week's vulnerabilities involving PHP are too big to ignore.

With the help of AI, PHP flaws that had been lying dormant for years were dredged up and exploited, resulting in parts of the internet going dark as IT experts attempted to fix the problem.

Although your Windows PC isn't in the direct line of fire this time, the sheer speed and ability of AI when it comes to discovering (and exploiting) flaws shouldn't go unnoticed.

I've put together this guide to help you be proactive rather than reactive towards whatever security crisis comes next.

ELI5: What's actually happening with PHP and the internet?

PHP is a programming language that's been around for more than three decades, and it quietly runs a large portion of the internet. Nearly 70% of websites with a known server language use PHP, including WordPress, Yahoo, Etsy, and Wikipedia. To say it's important is an understatement.

This week, two serious PHP security flaws known as "PHP2Shell" were made public. The exploits essentially allowed bad actors to take over servers and steal data. Once this news was public, countless bad actors began directing AI at the vulnerabilities.

The reaction? Some governments pulled their websites down to wait for a fix. IT teams worked countless hours to patch holes. Cloudflare fended off thousands of attempts to exploit the bugs, even before they were publicly announced.

The PHP Foundation released a patch on October 21, but it's only targeted at newer versions of PHP. There are countless millions of websites and servers running older versions of PHP that didn't get the fix (and may never be secure again).

Is PHP2Shell a one-time incident?

To give you an idea of what we're heading into (and not just in the middle of), Dan Lorenc, CEO of Chainguard, shared on LinkedIn a tale of his journey to find PHP vulnerabilities.

His team had the PHP news early, and it attempted to independently discover the vulnerability. All it took was a prompt for their frontier model to "find bad vulnerabilities in PHP" for this to happen.

No special AI voodoo. No deep knowledge of security systems. Just a powerful AI with a simple command. As Lorenc points out, "This is unfortunately the new normal for the industry."

I hate to fearmonger, but I'd rather help get you ahead of the next security flaw than pretend everything will work out fine.

Should you be concerned about PHP vulnerabilities?

There's no reason for the average Windows PC user to panic, but you should be aware of what's going on. Being proactive is the best line of defense.

PHP runs on servers, not your desktop or laptop PC, so ordinary users don't need to rush to patch their apps or browsers. However, if you use a website that's now vulnerable, personal information could be exposed.

What to do right now to protect yourself

As seemingly the entire internet goes into high-alert mode, there are three quick tips every regular PC user should be using to protect themselves against attacks.

1. Don't enter your credentials on websites that appear to be broken.
2. Keep an eye on your email inbox. Vulnerabilities like this often lead to spam and phishing emails. Don't download shady files or visit links you didn't expect to see.
3. Keep an eye on your bank statements for any shady activity.

These three tips will get you started, but there's a lot more you should be doing in order to prepare for the next big vulnerability.

How to prepare for the next big vulnerability

We're now entering an era of cybersecurity where you can assume that at some point you will be attacked. Your goal isn't to fend off every attack, but to make the fallout as easy to deal with as possible.

1. Use a password manager. Give each account a unique, complicated password.
2. Use an authenticator app or passkeys wherever possible. Two-factor authentication via SMS is becoming increasingly risky.
3. Keep your PC updated and Windows Security enabled.
4. Enable activity alerts from your banking apps.
5. Set up a new email address for anything financial.
6. Back up your data offline.
7. Update your Wi-Fi router's firmware.
8. Retire older hardware and devices that no longer receive security updates.
9. Remain vigilant.

The bottom line

AI is now able to find security flaws much faster than humans are able to fix them, and the PHP2Shell fallout from this week is very likely only the beginning of a wave of critical security issues that threaten the foundation of the internet.

It's not up to you or me to stop the next problem, but it is up to us to ensure that we mitigate risks.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Microsoft's redesigned File Explorer context menu could make navigating Windows 11 feel faster and more personal. The company has started testing a new right-click menu that reduces clutter by moving less common options out of the way while keeping frequently used actions easy to access.

That new context menu is available for Windows Insiders in the Beta channel. Microsoft also shipped four other Insider builds of Windows 11 today that includes

File Explorer (Beta)

Introducing the new, redesigned context menu in File Explorer

• We're rolling out an updated context menu experience in File Explorer, designed to feel faster, cleaner, and easier to tailor to the way you work. The new design reduces top-level clutter, keeps commonly used actions easy to access, and adds a new Settings experience that gives you more control over what appears in the menu. As we continue refining this experience with Insider feedback, our goal is to make right-click feel more responsive, predictable, and personal.
• We've also added a new teaching tip you might see as a first-time experience to help you learn about the customization options.

Settings (Beta)

• We're making performance improvements to the Settings home page which should result in reduced loading times in certain scenarios.

Windows Insider Program (Experimental)

• We've added the ability to filter Feature flags by enablement state.

Quick Settings (Experimental)

• We're beginning to roll out a new Mobile devices experience in Quick Settings, making it easier to take quick phone actions (such as ring your phone) without breaking your flow on Windows.
• With your supported Android phone connected, everyday actions are now just a click away. You can turn Do Not Disturb on before a meeting, change your phone's ringer mode, and play a sound to find your phone nearby.
• It's a simpler, faster way to manage your phone from the place you already use for quick Windows actions, helping your PC and phone work better together throughout the day.
• Capabilities can vary by phone platform and device configuration. The initial experience provides the most complete set of controls for Android phones, while iPhone support starts with a more limited status-focused experience.

Check your internet speed directly from Quick Settings

• We're making it faster and easier to check the performance of your internet connection in Windows. Windows Insiders can now run an internet speed test and see the results directly in Quick Settings, without being redirected to a browser.
• Start a test from the new Speed test Quick Setting, from the Wi-Fi or Cellular flyout, or by right-clicking the network icon in the system tray and selecting Test internet speed. While the test runs, Quick Settings shows its progress and results, including download speed, upload speed, and ping.
• Because the test runs against your active internet connection, you can quickly understand how your current connection is performing without leaving your workflow. This updated experience builds on the internet speed test we previously introduced for Windows Insiders, bringing the test and its results directly into Windows.

Magnifier (Experimental)

• We've added a Keyboard shortcut for Magnifier toggle in Settings > Accessibility > Magnifier. It lets you choose whether pressing Windows logo key + Plus (+) launches Magnifier.
• The shortcut stays on by default, so nothing changes unless you want it to. If you find that Magnifier starts by accident, or the shortcut conflicts with another app or keyboard layout, turn the toggle off. You can still start Magnifier from Settings, and you can turn the shortcut back on at any time.

Microsoft 365 subscription in Windows (Experimental)

• We're introducing a new inline experience that makes it easier for Microsoft 365 subscribers to manage their subscriptions in Windows. Subscribers who have recurring billing turned off can now turn it back on directly in Windows Settings, without leaving for a separate webpage. To get started, select Turn on recurring billing or Set up recurring billing from the Windows Settings Home page, the Accounts page, or the Start menu.

File Explorer (Experimental)

• Improved progress indication when navigating to locations that take longer to load, such as network drives, making it easier to see that loading is underway.

Narrator (Experimental)

• Narrator now supports additional languages for math reading, including Greek, Hungarian, Indonesian, Norwegian (Bokmål), Polish, Russian, Swedish, and Vietnamese.

Widgets (Experimental)

• The Widgets picker now has a standard Windows dialog frame and supports light and dark title bars. It also removes the blank space previously left for an icon.

Taskbar (Experimental)

• Fixed an issue with the previous update where explorer.exe wouldn't load after logging in, preventing the taskbar and other elements that rely on it from loading.

Unicode (Beta 26H1, (Experimental (26H1))

• This update provides Windows text shaping support for Unicode 17.0, helping Windows correctly display and shape newly encoded characters and scripts. Unicode 17.0 added 4,803 characters, including support for four newly encoded scripts: Beria Erfe, Sidetic, Tai Yo, and Tolong Siki. These updates help keep Windows text support current as the Unicode Standard evolves and improve support for languages and writing systems used by people around the world.

Start menu (Experimental (26H1))

• This update makes the Start menu more personal with several customizations.
• You can choose between a small or large Start menu, in addition to the Automatic (default) option that's available today. To customize this setting, go to Settings > Personalization > Start > Start menu size.
• The Recommended section is renamed Recent in the Start menu and on the Start settings page (Settings > Personalization > Start).
• You can now hide your name and profile picture in Start by going to Settings > Personalization > Start > Hide your name and profile picture on Start.
• The Start menu settings page is now redesigned with section-level toggles to independently show or hide Pinned, Recent, and All.

Manage camera, microphone, and location access for desktop apps (Experimental (26H1))

• Windows Insiders can now manage camera, microphone, and location permissions for individual desktop apps. Previously, access for traditional desktop applications was managed through a single device-wide setting.
• With this update, you can review and control access on an app-by-app basis, giving you greater visibility into which apps are requesting access to sensitive resources and more control over your privacy choices. Our goal is to make privacy permissions easier to understand and manage across the wide range of desktop apps people use every day.

Recovery (Experimental (26H1))

• We're adding a new entry point for Cloud Rebuild under Settings > System > Recovery, making it easier to access the feature from Settings.

File Explorer (Experimental (26H1))

• We've sharpened file thumbnails in the Recommended section on the Home page so they're crisper and easier to read.

Magnifier (Experimental (26H1), Experimental (Future Platforms))

• A new contrast theme toggle for a lower-glare screen. If bright screens are uncomfortable, many people use color inversion to reduce glare. However, inversion changes everything on screen, including photos, charts, and videos. With this update, we're introducing a new contrast theme toggle in Magnifier.
• Reduce glare with a single toggle. Turn on a contrast theme directly from the Magnifier toolbar for a more comfortable viewing experience.
• Choose the contrast theme that works best for you. The dark theme is applied by default, and you can choose which contrast theme the toggle uses under Settings > Accessibility > Magnifier.
• Photos, videos, and charts keep their original colors. Unlike color inversion, the contrast theme recolors the interface without touching your photos, charts, or videos, so they keep their real colors.
• Color inversion is still here. This isn't a replacement. If you use inversion today, it works exactly as it always has. The contrast theme is a separate, purpose-built option to reduce glare when you want a darker interface without inverting colors.

Family Safety (Experimental (Future Platforms))

• Improved family safety messaging when applications are blocked because of age-restricted parental controls.

Windows Setup (Experimental (Future Platforms))

• The digital safety of users and supporting families is central to how we think about the Windows experience. We're improving information on parental controls and their availability during Windows setup, so families can more easily understand available protections and make informed choices from the very beginning.

Network (Experimental (Future Platforms))

• Fixed an issue causing internet access to stop working for some Insiders after the last two flights.

Hyper-V (Experimental (Future Platforms))

• Fixed an issue where some applications that used HCS-managed virtual machines experienced issues when sharing host folders with Linux VMs using Plan9. Folders shared from the Windows host using Plan9 didn't appear or couldn't be accessed in the guest environment.

Other (Experimental (Future Platforms))

• Fixed an issue causing some Insiders to see an unexpectedly high volume of ESENT events after the latest flights.
• Fixed an underlying issue in the latest flights causing Insiders using VMware to experience frequent green screen bugchecks with error PFN_SHARE_COUNT.

Microsoft has been hard at work decluttering Windows 11. While those efforts continue, it seems Microsoft is putting more emphasis on improving the built-in Windows 11 apps as well. Even the Camera app received some updates recently.

File Explorer is a core part of the Windows 11 experience, so it's nice to see it being upgraded as well.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

HDR is a feature that's becoming ever more useful for Windows users who want to boost brightness, improve color, and deepen contrast. Unfortunately, Windows 11's handling of HDR is too annoying for many users to bother with.

GitHub user VantaCode420 has created a solution with their Smart HDR Manager app, available for free to download and enjoy.

It so far has 218 stars on GitHub despite still being in the relatively early stages of development, and I can see why now that I've been using it on a couple of PCs.

Smart HDR Manager turns HDR into a "set and forget" perk on Windows 11

Smart HDR Manager essentially bridges the gap between Windows HDR and the content you're playing or viewing on your PC.

When a game launches or an HDR video starts playing, Smart HDR Manager automatically makes the switch from SDR to HDR on your system. When you close the game or finish watching a video, it automatically reverts Windows to SDR.

Within the app, you can automatically scan your system for games held in apps like Steam, Xbox, and Epic, or you can manually add each one that you want to enjoy in HDR.

A separate "Apps" tab is home to video players, web browsers, creative apps, and streaming software like OBS Studio and Streamlabs.

On the note of web browsers, those who don't mind a couple of minutes of extra work can create a Tampermonkey script to automatically recognize YouTube HDR videos within Edge or Chrome. The GitHub page has full instructions on how to do this.

One final trick for those with NVIDIA RTX GPUs is RTX Video HDR support. It can turn SDR videos into HDR automatically, just as long as you have HDR enabled in the NVIDIA app's RTX Video Enhancements section.

Windows Central's take

I didn't care much about HDR until I upgraded full-time to an OLED monitor. Now, with the deep color and contrast afforded by the OLED panel, it's something that I want to use as much as possible, where applicable.

That's really the biggest issue that most Windows users have with HDR; it doesn't kick on automatically when HDR content is being displayed. You have to enable it manually before viewing or playing content, and it doesn't turn off when you're finished.

Leaving HDR enabled across Windows without any actual HDR content in view leads to washed-out colors and odd SDR mapping. It's something that I imagine just about everyone who's mucked around with stock HDR implementation on Windows has experienced.

Smart HDR Manager is a work in progress, but I haven't yet had any issues while playing games or while watching videos. It turns HDR on when I need it, and turns it off when I don't.

Why isn't this a native feature of Windows? That's a question I can't answer. I'm just glad someone took care of the problem. Try out Smart HDR Manager on standard Windows or Windows on ARM. The latter is still in an experimental stage, but it seems to be working well so far.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

When Microsoft announced the first wave of RTX Spark laptops, many were intrigued by the superchips inside the PCs. But I went a bit more surface-level, pun intended. During the Windows and Surface event, eagle-eyed viewers spotted a striking wallpaper across the new laptops.

The wallpaper is reminiscent of Windows 11's Bloom wallpaper, but it stands out for having a single curve and contrasting colors. As much as I like the Bloom wallpaper, it's been remixed several times by Microsoft and enthusiasts, so it's time for a new Windows wallpaper.

Sadly, Microsoft did not release the image after unveiling the new laptops. I waited with anticipation for the release of the RTX Spark laptops, but even when the Surface Laptop Ultra review went live, the new wallpaper was nowhere to be found. Microsoft even mocks us by having a blacked-out version of the wallpaper on the retail listing of the Surface Laptop Ultra.

Desperate to get my hands on the new wallpaper, I scoured reviews of the ASUS ProArt P16, HP OmniBook Ultra 16, and Surface Laptop Ultra only to be disappointed.

But a hero emerged, saving me from settling for an AI recreation of the wallpaper. Discord user TechosaurusRex discovered the wallpaper in the app files for Microsoft's Retail Demo Experience. Seemingly, Microsoft's plan was to tease us by showing the wallpaper on display retail units but not include the image on purchased PCs.

Luckily, TechosaurusRex stepped up and shared the wallpaper, ending my quest. Sadly, the above version is compressed to ensure our site loads quickly. I'll share the full resolution version as soon as possible.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Microsoft is working on a small yet meaningful change to the lock screen and sign-in experience on Windows 11 that will streamline the authentication process that users must go through to log into their desktop.

The current Windows sign-in flow requires the user to manually select the method of authentication they wish to use to login. If you've set up a PIN, face unlock, and fingerprint unlock, the only method of authentication that is active is the one you manually click on to use on the lock screen.

This is a huge gripe of mine, and it's super frustrating when you want to login using your face, but Windows has selected PIN or fingerprint. It means your webcam isn't looking for you in that moment, and you have to manually switch to face unlock to force Windows into checking for your face and logging in.

Well, it looks like this is finally changing. In the latest Windows 11 preview builds, a hidden feature ID enables a new experience that automates this. Now, by default, the PIN box is always on show, but face unlock and fingerprint unlock are also active and ready to authenticate at the same time.

This means users no longer need to manually select the login method of their choice. Windows will automatically capture whichever biometric authentication method is set up, even when the PIN box is on screen. This also means the lock screen looks cleaner as a result, as the options to choose which authentication method you want to use is no longer displays as it's not necessary. It's also faster for those with biometric authentication enabled.

I really like this change, as it encourages Windows to keep trying my face unlock even if it fails the first time. Of course, there's an eventual timeout if it fails too many times, but I find it is able to log me in before it ever reaches that point. Also, being able to just type my PIN without having to manually select the PIN option first is also great.

Microsoft is yet to announce this new sign-in flow, but I suspect it won't be long until it's officially put into testing as it's already very polished and has been in the works for a number of months now. What do you think? Is this a good change for the Windows lock screen? Let us know in the comments.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

In what may be one of the year's least surprising stories, Microsoft's VP of Product Design, Diego Baca, has explained how AI is being used to help designers after being asked whether it's possible to launch a "fleet of viable agents" to address issues in Windows 11.

Now, this all comes shortly after an Xbox Business Strategist spiraled on X over how everyone is using AI, expressing frustration with the pretense that people aren't. That said, I do appreciate Baca’s honesty here. I always find that kind of candor refreshing.

Windows 11 still has a consistency problem

Interestingly, Baca's post on X (formerly Twitter) also acknowledged something Windows users have been complaining about for years in his reply to tech enthusiast Chris Pirillo, and that's consistency:

“Consistency across Windows is something we all want, and it’s an active workstream we’re continuing to accelerate,” he explained.

And to be fair, I have to agree. Windows 11 is now five years old (that's made me feel so old), yet parts of the operating system still feel like they're lacking the modern stylings, almost as though some of it still belongs in Windows 7, or even earlier, as Windows Latest points out in its own take.

Don't get me wrong, Microsoft has made progress, particularly with its efforts to modernize Windows Search, Run, and other legacy interfaces using WinUI 3. But I do wish these inconsistencies had been addressed before Windows 11 launched, though perhaps I’m wishing for too much.

Baca also acknowledged the criticism, admitting, “Finally, I completely recognize that people expect more from Windows. We expect more from ourselves, too.”

Finally, he added that Microsoft hopes to “earn back your enthusiasm for Windows through what we deliver, not just what we say.” It’s a refreshingly open response, and one I massively appreciate. How do you feel about Diego Baca's comments? Let me know in the comments and be sure to take part in our poll below:

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.