Hacker News Reader

Comment by greyhound1 | Hacker News Reader

Had to go to Microsoft Store to get the fixed version, Windows Update didn't show anything.

I did the same, then ran:

Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version

But I can only get Microsoft.Paint 11.2609.401.0 and Microsoft has said different things in different places, so it's not even clear if this has the fix or not.

This article has more info on the confusion they're causing: https://windowsforum.com/news/cve-2026-83844-windows-11-pain...

why get package after something that is obviously a malicious backdoor?

If I still mamaged any windows host, i would be deploying a remove-package script asap to the entire fleet.

What kind of nonsense are you writing here right now? When the next Linux kernel CVE happens, you'll also delete all the kernels from your fleete because they're a malicious backdoor?

When did y'all stop using some basic sense before writing? -_-

>When did y'all stop using some basic sense before writing? -_-

Yeah samesame:

-Compares a kernel with paint

-Uses a program with telemetry/spyware instead of installing on of the 1000s alternatives

It's a built-in tool of the OS, not some random spyware. Stop with the bizarre hyperbole.

>It's a built-in tool of the OS, not some random spyware

Oh no dont get me wrong, it's definitely not some random spyware, it's deliberately made by Microsoft targeted at Windows Users who cant buy a Enterprise License.

Great time to jump to the openbsd kernel!

Maybe we can blame PowerShell a bit for confusing names on this one. Get-AppxPackage does not download or install anything, contrary to what one might wrongly assume.

Get-AppxPackage gives you the currently-installed packages for a Windows profile in PowerShell. It does not, in fact, download or install anything.

The whole command I gave gives you the currently installed version of MS Paint so you can see if you're already vulnerable or not.

Windows Update and Store are slowly becoming the same, and Paint gets delivered via the store for quite some time, there was even some drama related to it.

https://interestingengineering.com/culture/rip-microsoft-pai...

Ugh so I have to unblock the Store in my firewall just to get patched. What a PITA.

or block ms paint aswell.

Did the same and it quickly updated itself when I went into the "Paint" page (but I had to go there first). No indication of what just happened a few seconds later.

If MS knew it would drive people to actually use their app store, they would have created the CVE themselves.

They kinda did.

For a split second, I visualized you walking into a brick and mortar Microsoft Store to get your security update done on your laptop, and somewhere in the middle of that split second I caught myself thinking „typical Microsoft“, and then I came to my senses.

For some reason, I had the same idea.

You made a slip. Thats Apple you are talking about, and it actually happens.

If brick and mortar Apple stores are staffed by "Geniuses"...

Wow, what a weird confluence of events

Reply on news.ycombinator.com