How long can a software vulnerability survive before someone finally notices? Hidden flaws may persist as technology changes and could expose your company’s devices and sensitive information. Learn how old operating system bugs can create trouble for businesses.
Big Brands Aren’t Immune to Software Flaws
It’s easy to assume that widely used software products have already undergone exhaustive inspection, but that isn’t always the case. Researchers from Graz University of Technology in Austria recently uncovered file security flaws affecting all major operating systems. Under certain conditions, threat actors can exploit these vulnerabilities to steal login credentials or determine which websites someone visits.
The issue involves what’s known as a side-channel attack. Rather than breaking directly into a system, a cybercriminal observes how the technology behaves and looks for indirect clues that reveal sensitive information.
Side-channel techniques can analyze subtle activity such as a processor’s power consumption. Those patterns may reveal information that should remain private, including passwords.
Which Operating Systems Are Affected?
Does your establishment rely on Windows PCs, Macs, Android devices, or Linux systems? The researchers found that all four operating systems contain affected file-notification mechanisms, and some of these components date back decades.
Windows has the oldest identified issue, with its ReadDirectoryChangesW feature dating back to 2000. Linux’s inotify followed in 2005, and Apple’s FSEvents arrived two years later. Android’s FileObserver has carried the weakness since 2008. Normally, these tools support file handling by notifying applications about changes. The trouble starts when exposed information provides clues about what a user is doing.
Researchers also found different possibilities, depending on the platform. File activity on Windows, for example, could expose websites another user visited through Firefox. On Android, an app without permissions could monitor certain file-related activity within another app’s storage. Linux presented another concern: keystroke timing attacks. Tests involving macOS, meanwhile, revealed less information than the other systems.
Don’t Expect a Fix From Every Vendor
The researchers relayed their findings to the vendors’ security teams between August and October 2025. Linux developers took the most concrete action by introducing a partial fix for CVE-2025-68788 in December 2025. The change prevents certain access and modification events involving special files, although it doesn’t address every identified attack technique.
According to the researchers, Microsoft considers ReadDirectoryChangesW behavior “by design” and doesn’t view cross-user file-path monitoring as a vulnerability that requires a patch. Apple and Android also received the disclosure but have not introduced an apparent mitigation yet.
Is Your Business at Risk?
Even though old operating system bugs don’t automatically endanger your digital spaces, they still deserve your attention. Other risks, including path traversal and malicious files, reinforce the need for secure data handling.
Consider the following simple yet effective strategies:
- Remove apps your employees no longer use.
- Limit what untrusted programs can access.
- Separate sensitive work from lower-trust applications.
- Review software permissions instead of accepting defaults.
- Watch for vendor fixes as they become available.
Taking a proactive stance toward cybersecurity can mean the difference between staying ahead of emerging risks and scrambling to respond after they cause damage.
