Tonight’s technology rundown is all about friction—and whether it protects you or merely gets in the way. Android is adding a one-day pause before power users can install apps from unverified developers, Microsoft is investigating game crashes after its August Windows update, Cloudflare is letting people trim optional OAuth permissions, GitHub has a more honest label for vulnerabilities contained by outside controls, and G.Skill settlement payments are landing after a dispute over advertised RAM speeds.
Reporting cutoff: August 20, 2026 at 5:03 p.m. EDT (21:03 UTC). Live Microsoft, Cloudflare, GitHub, Android and settlement-related sources were rechecked immediately before this edition was prepared. Company claims and unresolved investigations are labeled as such.
Listen to the 5 PM recap
This narration was synthesized locally from the same fact-checked script as the article.
The five-minute rundown
- Android sideloading: Google’s advanced flow includes a one-time, one-day wait, a restart and reauthentication before a power user can allow apps from unverified developers.
- Windows gaming: Microsoft is investigating crashes, hangs, access-violation errors and unexpected restarts reported in a limited number of games after KB5121003 and later updates.
- Cloudflare OAuth: Developers can mark scopes optional so users can approve a narrower permission set—but the complete requested set remains selected by default.
- GitHub security: A new “Mitigated” dismissal reason distinguishes externally contained vulnerabilities from “Won’t fix.” It does not mean the vulnerable code was repaired.
- G.Skill settlement: Payments reported around $20–$25 are arriving from a $2.4 million settlement tied to allegations about advertised DDR4/DDR5 speeds and overclocking disclosures; G.Skill denied wrongdoing.
1. Android’s 24-hour sideload pause is rolling out
Google’s official advanced-flow description says power users can keep installing apps from unverified developers, but first must enable developer mode, pass a coercion check, restart and reauthenticate, wait one day, then confirm with biometrics or the device PIN. After that one-time process, access can be enabled for seven days or indefinitely. Google says the delay is designed to interrupt phone scams that depend on panic and continuous coaching.[5]
9to5Google reported on August 18 that the first version is rolling out gradually through the Android Developer Verifier app. Its reporting says ADB installs are not affected and that the broader developer-verification requirements begin September 30 in Brazil, Indonesia, Singapore and Thailand before a wider rollout next year.[6]
The good
The flow preserves a path for power users while deliberately breaking the real-time pressure loop used by scammers.
The caution
A blanket 24-hour pause is still frustrating for legitimate testing, repairs and open-source installs. Availability is gradual, so menus and timing may differ by device.
What to do: Do not begin the process while anyone is pressuring you by phone, text or remote-control software. Verify the developer, obtain the APK from its canonical project page, scan it, and treat “Install Anyway” as an informed exception—not a routine button. Read our full guide to Android’s 24-hour sideload wait.
2. Microsoft is investigating August-update game crashes
Microsoft’s Windows release-health page says it received reports after the August 11, 2026 update KB5121003 and later releases. The company lists a limited number of games—including ARC Raiders, MARVEL Tōkon: Fighting Souls and The Finals—and symptoms including an unresponsive game, a sudden close, EXCEPTION_ACCESS_VIOLATION, or an unexpected device restart. Windows 11 versions 24H2 and 25H2 are listed as affected; Microsoft’s status remains Investigating and says it is still determining whether Windows caused the issue.[7]
That wording matters. Reports are real enough for an official known-issue entry, but causation and scope are not final. Windows Latest independently documented the investigation and game-studio reports, while Microsoft asks affected users to file through Feedback Hub.[8]
The good
Microsoft has acknowledged the reports publicly, identified affected Windows versions and created a central status record.
The caution
Uninstalling a security update can reopen fixed vulnerabilities. Do not use rollback as a first reflex on a work PC or a machine with sensitive data.
What to do: Update the game, launcher, graphics driver and controller utilities first; preserve crash details; then file Feedback Hub data. If a rollback is being considered, weigh the security tradeoff and use Microsoft’s current guidance. Our detailed troubleshooting article is Microsoft Investigates Windows 11 Game Crashes After August Update.
3. Cloudflare lets users trim optional OAuth permissions
Cloudflare announced task-based OAuth consent on August 20. Client owners can label configured scopes as required or optional; during authorization, a user can deselect optional scopes from the set the application actually requested. Existing clients keep their previous behavior unless the owner opts in, and the full requested scope set remains selected by default.[1]
If the user narrows the grant, the resulting token contains only the approved scopes. Cloudflare tells developers to inspect the granted scope after the code exchange and make the app handle partial grants gracefully. That follows OAuth 2.0’s long-standing rule that an authorization server may grant less scope than requested and must report the actual scope when it differs.[2]
Evidence rail: Cloudflare proves what it announced and how its flow is intended to work. RFC 6749 confirms the protocol permits narrower grants. Neither source independently proves adoption, real-world denial rates or flawless application behavior.
Good: This is a practical least-privilege improvement for SaaS integrations, command-line tools, agents and MCP servers. Caution: Developers decide what is truly optional, the broad set is still selected by default, and a brittle app may fail or pressure the user to reauthorize everything. Cloudflare’s “thousands of apps” and “more than a million authorizations” figures are company-reported.
What to do: When approving an integration, remove permissions that do not match the current task. Developers should test every meaningful partial-grant combination and show a clear, non-alarming explanation when a missing permission disables one feature.
4. GitHub adds “Mitigated”—but a bridge is not a repair
GitHub added a Mitigated code-scanning dismissal reason for cases where vulnerable code remains but an external control—such as a web application firewall or network policy—reduces the risk. GitHub positions it as distinct from “Won’t fix” and says it can support formal exception and risk-acceptance processes.[3]
GitHub’s general documentation explains that dismissed alerts move to the closed list, their reason is recorded, and an optional dismissal comment can be retained and retrieved through the REST API. At the 5:03 p.m. cutoff, the canonical documentation did not yet visibly explain an expiry or mandatory review date for the new reason.[4]
Good: “Mitigated” is more honest than hiding a live vulnerability under “Won’t fix.” Bad: a WAF rule, network path or deployment assumption can drift while the alert stays closed. What to do: record the control, owner, proof, assumptions, review date, expiry date and permanent-remediation plan. Reopen the alert when the compensating control changes.
5. G.Skill’s $2.4 million RAM settlement is paying out
Tom’s Hardware reported on August 20 that payments around $20–$25 are reaching claimants from a $2.4 million settlement. The underlying lawsuit alleged that certain DDR4 and DDR5 kits were marketed at speeds that generally require an overclocking profile such as Intel XMP or AMD EXPO. G.Skill denied the allegations and maintained that its products were properly labeled; a settlement is not an admission of wrongdoing.[10]
The settlement’s official site remains the authoritative place for notices and case administration.[9] The practical hardware lesson is broader: the speed printed on a memory kit is not a promise that every CPU, motherboard, BIOS and four-DIMM configuration will run that profile stably.
Good: clearer XMP/EXPO disclosures can help buyers understand that advertised profile speed may require configuration and platform support. Caution: a payout amount seen by another claimant does not prove your eligibility or amount, and new claims should not be assumed open. What to do: check your motherboard QVL, CPU memory specification and BIOS support; enable XMP/EXPO deliberately; then run a real memory-stability test. Read our full explainer: What DDR4 and DDR5 buyers should know.
What Florida homes and small businesses should do next
- Do not sideload under pressure. End the call, remove remote access and verify the developer independently.
- Preserve Windows evidence. Record the exact game, error, Windows build and recent update history before changing the machine.
- Trim connected-app permissions. Grant only the OAuth scopes the task truly needs and review old integrations quarterly.
- Put an expiry on mitigations. A firewall rule or network policy needs an owner, monitoring and a review date.
- Validate memory settings. XMP and EXPO are configuration profiles, not universal stability guarantees.
- Back up before troubleshooting. A recoverable system makes careful testing possible without gambling the data.
Need a careful second set of eyes?
The IT Guys helps homes and small businesses in Port Saint Lucie, Jensen Beach, Fort Pierce and Vero Beach with Windows troubleshooting, device security, network reviews and PC upgrades. Schedule an appointment before a rushed workaround becomes tomorrow’s outage.
Frequently asked questions
Does Android now ban sideloading?
No. Google’s advanced flow preserves a route for power users to install apps from unverified developers, but it adds a one-time one-day waiting period and identity confirmation. ADB installs were reported as unaffected.
Should I uninstall KB5121003 if a game crashes?
Not automatically. Microsoft is still investigating causation and scope, and removing a cumulative update can also remove security fixes. Update the game and drivers, collect evidence and consult current Microsoft guidance before rollback.
Are optional OAuth scopes automatically safer?
They create a safer choice, but the developer still decides which scopes are optional and the complete requested set remains selected by default. Safety depends on a user trimming access and an application handling the smaller grant correctly.
Does “Mitigated” mean a GitHub code-scanning alert is fixed?
No. It means an external control reduces the risk while the vulnerable code remains. The control can fail or drift, so the exception should have evidence, an owner and an expiry or review date.
Does a RAM kit always run at the speed printed on the box?
No. The advertised speed may require enabling XMP or EXPO, and successful operation still depends on the CPU’s memory controller, motherboard, BIOS, DIMM count and the specific kit.
Sources
- Cloudflare — From all-or-nothing to task-based OAuth consent (published August 20, 2026 at 17:03:03 UTC; checked at cutoff)
- IETF — RFC 6749, OAuth 2.0 Authorization Framework §3.3
- GitHub Changelog — Code scanning adds a mitigated alert dismissal reason (published August 20, 2026 at 08:14:31 PDT)
- GitHub Docs — Resolving code scanning alerts (checked at cutoff)
- Android Developers Blog — Android developer verification: Balancing openness and choice with safety (published March 19, 2026; rechecked August 20)
- 9to5Google — Google ‘gradually’ rolling out Android’s ‘advanced’ sideloading (published August 18, 2026 at 2:50 p.m. PT)
- Microsoft — Windows 11, version 25H2 known issues and notifications (issue last updated August 19, 2026 at 6:10 p.m. PT; rechecked at cutoff)
- Windows Latest — Windows 11’s August update is breaking games, and Microsoft is investigating… (published August 20, 2026)
- G.Skill DRAM Settlement — official settlement website (checked at cutoff)
- Tom’s Hardware — G.Skill pays out $2.4M settlement… (published August 20, 2026)