AntiMalwareSeptember 21, 2026🇷🇺Translated from Russian

Windows File System Tunneling Preserves Old File Metadata for Legacy Compatibility

Many Windows users have noticed a strange behavior: after creating a new file, its properties show a creation date from the previous day or even earlier. Microsoft confirms this is not a bug but the result of File System Tunneling, a feature the operating system has used for decades.

When a file is deleted or renamed, Windows briefly stores its metadata in a special cache. If another file with the same name is created in the same folder within roughly 15 seconds, the new file inherits the original creation date and the mapping between long and short filenames. The actual content of the deleted file is not recovered.

The mechanism serves two main purposes. First, many applications save documents safely by writing changes to a temporary file, deleting the original, and then renaming the temporary file to the original name. Without tunneling, Windows would treat the document as brand new each time and update its creation date.

Second, the feature maintains compatibility with programs from the DOS and 16-bit eras that relied on the classic 8.3 filename format. Tunneling preserves the link between short and long names during rapid file operations.

The tunneling cache is temporary and gradually cleared, so a file deleted weeks or months earlier will not transfer its date to a new file with the same name. The behavior only triggers under specific combinations of delete, create, and rename actions within one folder.

Related articles

HabrOther

Implementing 2FA Kubernetes Access via Gateway API, Dex and MULTIDIRECTORY

A Russian cybersecurity company replaced static kubeconfig files with corporate accounts and mandatory 2FA for its Talos Linux Kubernetes clusters. The solution routes all authentication through a single FQDN using NGINX Gateway Fabric, Dex as an OIDC provider connected to MULTIDIRECTORY via LDAP, and kube-oidc-proxy for token validation and impersonation. Groups stored in the directory are passed directly into RBAC bindings, eliminating manual certificate management. A lightweight Python service dynamically generates kubeconfig files that contain no secrets. The team documented several Gateway API migration pitfalls including namespace route restrictions and BackendTLSPolicy hostname validation. The approach keeps the entire configuration in Git and avoids modifying kube-apiserver flags.

HabrOther

Amazon Confirms Irrecoverable Data Loss in UAE and Bahrain Data Centers After Drone Attacks

Amazon Web Services has officially confirmed that data stored in specific availability zones within its Middle East regions was permanently destroyed following physical attacks on data centers in the UAE and Bahrain. The incidents began on March 1 and continued through April and July, damaging infrastructure tied to AI development projects. In the UAE region mec1, only zone mec1-az2 was completely destroyed with no external backups, while mec1-az3 suffered severe damage and mec1-az1 remained operational but overloaded. All three zones in the Bahrain region me-south-1 were rendered inoperable. AWS had spent six months attempting recovery before issuing the final statement on September 15, 2026, and has advised customers to migrate workloads to unaffected regions. The event highlights growing risks to data from physical-world attacks beyond traditional network threats.

HabrOther

Bots Overload OT Commerce Store on OT Box, Spike Paid OTAPI Calls Mistaken for DDoS Attack

An online store running OT Commerce experienced CPU loads reaching 98-100% and a 6-7x increase in paid OTAPI calls over three days due to automated bot traffic rather than a traditional DDoS. The site owner had already deployed a paid anti-bot module on the VPS, yet behavioral bots continued to bypass protections and force expensive calls to the external OTAPI platform for product data from Taobao, Tmall, 1688 and other marketplaces. Traffic analysis after switching to the CRONARMOR WAF revealed that 41.9% of page requests were automated, with 99.3% of early-stage automation blocked before reaching the origin server. Only 0.5% were behavioral bots visible in analytics, while legitimate search crawlers accounted for 27,190 requests that were explicitly allowed. The WAF approach stopped requests at the reverse proxy layer, preventing PHP execution, database queries and OTAPI billing events on the origin. Post-deployment CPU dropped to single digits for most of the day, eliminating both performance issues and the anomalous rise in paid API usage.

SecuritylabOther

Teenage Smartphone Addiction: Causes, Consequences, and Treatment Approaches

Smartphone use has become an integral part of adolescent life, but problematic usage patterns rather than device ownership itself are the focus of concern. Medical experts avoid the term smartphone addiction and instead address issues like disrupted self-control, social media overuse, and gaming disorder that interfere with sleep, studies, relationships, and mental health. Data from Pew Research indicates nearly 50% of U.S. teens aged 13-17 are online almost constantly, while CDC findings link four or more hours of daily screen time to elevated anxiety and depression symptoms. Family digital habits strongly influence teen behavior, and rigid bans often fail without addressing underlying issues such as boredom, anxiety, or social isolation. Parents are advised to track specific disruptions over a week and consider professional help when signs of depression, bullying, or self-harm appear alongside device overuse.