<![CDATA[Team IT Security - 📰 Alle Kategorien]]> de-DE Thu, 30 Jul 2026 11:06:21 +0200 Thu, 30 Jul 2026 11:06:21 +0200 15 2026 Team IT Security lakandor@tsecurity.de (Horus Sirius) lakandor@tsecurity.de (Horus Sirius) IT Security Cybersecurity Nachrichten Team IT Security RSS Generator v2.0 https://tsecurity.de/favicon.ico <![CDATA[Team IT Security - 📰 Alle Kategorien]]> <![CDATA[Your instant Android backup upgrade]]> https://tsecurity.de/de/3694774/ai-nachrichten/your-instant-android-backup-upgrade/ https://tsecurity.de/de/3694774/ai-nachrichten/your-instant-android-backup-upgrade/ Sat, 25 Jul 2026 19:50:10 +0200 🔧 AI Nachrichten tsecurity.de

Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

See?

Android backup documents
The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android backup options
Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

]]> <![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]> https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ Sat, 25 Jul 2026 19:50:08 +0200 🔧 AI Nachrichten tsecurity.de

OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.

The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.

Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.

OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.

Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.

Workforce impact

OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.

Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.

“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”

Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.

However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.

Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

Cost and operational risks

Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.

Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.

Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

This article first appeared on CIO.

]]> <![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]> https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/ https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/ Sat, 25 Jul 2026 19:50:07 +0200 🔧 AI Nachrichten tsecurity.de

AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.

AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its Helios AI platform is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).

The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  

AMD’s MI455X targets the AI memory wall

The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.

Compared to AMD’s current MI355X, the MI455X offers 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.

AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.

AMD Instinct chart showing generational leap in performance

AMD

The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.

The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

AMD’s Helios rack takes aim at Vera Rubin

AMD Helios rack

Dave Altavilla

Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.

In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.

These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.

AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.

While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.

Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.

Kind of like cowbell, AMD Venice gives agentic AI more CPU

Chart showing AMD EPYC CPU performance

AMD

AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.

Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.

Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.

Pensando networking and ROCm software advance

Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.

As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.

On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.

These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.

Customer commitments underscore rack-scale confidence

AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.

Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, Anthropic announced a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.

Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.

There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.

AMD expands its robotics and embedded foundation

AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.

The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.

Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.

Execution for AMD is now the test

AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.

AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.

As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[The Apple macOS Security Update Review]]> https://tsecurity.de/de/3694569/hacking/the-apple-macos-security-update-review/ https://tsecurity.de/de/3694569/hacking/the-apple-macos-security-update-review/ Sat, 25 Jul 2026 19:02:56 +0200 🕵️ Hacking tsecurity.de We’ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn’t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches.

For May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.

-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, “An app may be able to execute arbitrary code with kernel privileges.” The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).

-              CVE-2026-43668 (mDNSResponder) also piques my interest since, “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.” The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.

-              CVE-2026-28972 (Kernel) This one states that “An app may be able to cause unexpected system termination or write kernel memory.” An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.

Here’s a look at all the bugs released by Apple this month:

82Unique CVEs 79macOS Tahoe 26.5 45macOS Sequoia 15.7.7 42macOS Sonoma 14.8.7
CVE ID Component Impact macOS Tahoe 26.5 macOS Sequoia 15.7.7 macOS Sonoma 14.8.7
CVE-2026-28991 Accelerate An app may be able to cause a denial-of-service Yes No No
CVE-2026-28988 Accounts An app may be able to bypass certain Privacy preferences Yes No No
CVE-2026-28959 APFS An app may be able to cause unexpected system termination Yes Yes Yes
CVE-2026-28995 App Intents A malicious app may be able to break out of its sandbox Yes No No
CVE-2026-1837 AppleJPEG Processing a maliciously crafted image may lead to a denial-of-service Yes No No
CVE-2026-28956 AppleJPEG Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Yes Yes Yes
CVE-2026-39869 Audio Processing an audio stream in a maliciously crafted media file may terminate the process Yes Yes Yes
CVE-2026-28922 CoreMedia An app may be able to access private information Yes Yes Yes
CVE-2026-28936 CoreServices Processing a maliciously crafted file may lead to unexpected app termination Yes No Yes
CVE-2026-28918 CoreSymbolication Parsing a maliciously crafted file may lead to an unexpected app termination Yes No No
CVE-2026-28878 Crash Reporter An app may be able to enumerate a user's installed apps No Yes No
CVE-2026-28915 CUPS An app may be able to gain root privileges Yes Yes Yes
CVE-2026-43659 FileProvider An app may be able to access sensitive user data Yes Yes Yes
CVE-2026-28923 GPU Drivers A malicious app may be able to break out of its sandbox Yes Yes Yes
CVE-2026-28925 HFS An app may be able to cause unexpected system termination or write kernel memory Yes Yes Yes
CVE-2025-43524 Icons An app may be able to break out of its sandbox No Yes Yes
CVE-2026-43661 ImageIO Processing a maliciously crafted image may corrupt process memory Yes No No
CVE-2026-28977 ImageIO Processing a maliciously crafted file may lead to unexpected app termination Yes Yes Yes
CVE-2026-28990 ImageIO Processing a maliciously crafted image may corrupt process memory Yes Yes Yes
CVE-2026-28978 Installer A malicious app may be able to break out of its sandbox Yes Yes Yes
CVE-2026-28992 IOHIDFamily An attacker may be able to cause unexpected app termination Yes Yes Yes
CVE-2026-28943 IOHIDFamily An app may be able to determine kernel memory layout Yes Yes Yes
CVE-2026-28969 IOKit An app may be able to cause unexpected system termination Yes Yes Yes
CVE-2026-43655 IOSurfaceAccelerator An app may be able to cause unexpected system termination or read kernel memory Yes No No
CVE-2026-43654 Kernel An app may be able to disclose kernel memory Yes Yes Yes
CVE-2026-28908 Kernel An app may be able to modify protected parts of the file system Yes Yes Yes
CVE-2026-28954 Kernel A maliciously crafted disk image may bypass Gatekeeper checks Yes Yes Yes
CVE-2026-28897 Kernel A local user may be able to cause unexpected system termination or read kernel memory Yes Yes Yes
CVE-2026-28952 Kernel An app may be able to cause unexpected system termination Yes Yes Yes
CVE-2026-28951 Kernel An app may be able to gain root privileges Yes Yes Yes
CVE-2026-28972 Kernel An app may be able to cause unexpected system termination or write kernel memory Yes Yes Yes
CVE-2026-28986 Kernel An app may be able to cause unexpected system termination Yes Yes Yes
CVE-2026-28987 Kernel An app may be able to leak sensitive kernel state Yes Yes Yes
CVE-2026-28983 LaunchServices A remote attacker may be able to cause a denial of service Yes No No
CVE-2026-28929 Mail Drafts Replying to an email could display remote images in Mail in Lockdown Mode Yes Yes Yes
CVE-2026-43653 mDNSResponder An attacker on the local network may be able to cause a denial-of-service Yes No Yes
CVE-2026-28985 mDNSResponder An attacker on the local network may be able to cause a denial-of-service Yes No No
CVE-2026-43668 mDNSResponder A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Yes Yes Yes
CVE-2026-43666 mDNSResponder An attacker on the local network may be able to cause a denial-of-service Yes Yes Yes
CVE-2026-28941 Model I/O Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Yes Yes No
CVE-2026-28940 Model I/O Processing a maliciously crafted image may corrupt process memory Yes Yes No
CVE-2026-28961 Network Extensions An attacker with physical access to a locked device may be able to view sensitive user information Yes No No
CVE-2026-28906 Networking An attacker may be able to track users through their IP address Yes Yes Yes
CVE-2026-28840 PackageKit An app may be able to gain root privileges No Yes Yes
CVE-2026-43656 Quick Look Parsing a maliciously crafted file may lead to an unexpected app termination Yes Yes Yes
CVE-2026-43652 Sandbox An app may be able to access protected user data Yes No No
CVE-2026-39870 SceneKit Processing a maliciously crafted image may corrupt process memory Yes Yes Yes
CVE-2026-28846 SceneKit A remote attacker may be able to cause unexpected app termination Yes Yes Yes
CVE-2026-28993 Shortcuts An app may be able to access user-sensitive data Yes Yes Yes
CVE-2026-28848 SMB A remote attacker may be able to cause unexpected system termination Yes Yes No
CVE-2026-28930 Spotlight An app may be able to access protected user data Yes No No
CVE-2026-28974 Spotlight An app may be able to cause a denial-of-service Yes Yes No
CVE-2026-28996 Storage An app may be able to access sensitive user data Yes Yes Yes
CVE-2026-28919 StorageKit An app may be able to gain root privileges Yes Yes Yes
CVE-2026-28924 Sync Services An app may be able to access Contacts without user consent Yes Yes Yes
CVE-2026-39871 TV App An app may be able to observe unprotected user data Yes Yes Yes
CVE-2026-28976 UserAccountUpdater An app may be able to gain root privileges Yes No No
CVE-2026-43660 WebKit Processing maliciously crafted web content may prevent Content Security Policy from being enforced Yes No No
CVE-2026-28907 WebKit Processing maliciously crafted web content may prevent Content Security Policy from being enforced Yes No No
CVE-2026-28962 WebKit Processing maliciously crafted web content may disclose sensitive user information Yes No No
CVE-2026-43658 WebKit Processing maliciously crafted web content may lead to an unexpected Safari crash Yes No No
CVE-2026-28905 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28847 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28904 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28955 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28903 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28953 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28902 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28901 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28913 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28883 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28958 WebKit An app may be able to access sensitive user data Yes No No
CVE-2026-28917 WebKit Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28947 WebKit Processing maliciously crafted web content may lead to an unexpected Safari crash Yes No No
CVE-2026-28946 WebKit Processing maliciously crafted web content may lead to an unexpected Safari crash Yes No No
CVE-2026-28942 WebKit Processing maliciously crafted web content may lead to an unexpected Safari crash Yes No No
CVE-2026-28971 WebKit A malicious iframe may use another website's download settings Yes No No
CVE-2026-28944 WebRTC Processing maliciously crafted web content may lead to an unexpected process crash Yes No No
CVE-2026-28819 Wi-Fi An app may be able to execute arbitrary code with kernel privileges Yes Yes Yes
CVE-2026-28994 Wi-Fi An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets Yes Yes Yes
CVE-2026-28914 zip A maliciously crafted ZIP archive may bypass Gatekeeper checks Yes No No
CVE-2026-28920 zlib Visiting a maliciously crafted website may leak sensitive data Yes Yes Yes
CVEs marked with the scarab logo were reported through the TrendAI Zero Day Initiative program.

We’ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.

]]> <![CDATA[The April 2026 Security Update Review]]> https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/ https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/ Sat, 25 Jul 2026 19:00:42 +0200 📰 IT Security Nachrichten tsecurity.de It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for April 2026

For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.

Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority
APSB26-43 Adobe Acrobat Reader 1 Critical 8.6 Yes 1
APSB26-44 Adobe Acrobat Reader 2 Critical 8.6 No 2
APSB26-32 Adobe InDesign 9 Critical 7.8 No 3
APSB26-33 Adobe InCopy 2 Critical 7.8 No 3
APSB26-36 Adobe FrameMaker 11 Critical 8.6 No 3
APSB26-37 Adobe Connect 9 Critical 9.6 No 3
APSB26-38 Adobe ColdFusion 7 Critical 9.3 No 1
APSB26-39 Adobe Bridge 6 Critical 7.8 No 3
APSB26-40 Adobe Photoshop 1 Critical 7.8 No 3
APSB26-42 Adobe Illustrator 1 Critical 7.8 No 3
APSB26-34 Adobe Experience Manager Screens 9 Important 5.4 No 3
APSB26-41 Adobe DNG SDK 3 Important 5.5 No 3

Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed.

Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for April 2026

This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.

By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.

There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:

-    CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

-    CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability
This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

-   CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability
This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

-    CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

Here’s the full list of CVEs released by Microsoft for April 2026:

April 2026 Patch Tuesday
CVE Title Severity CVSS Public Exploited Type
CVE-2026-32201 Microsoft SharePoint Server Spoofing Vulnerability Important 6.5 No Yes Spoofing
CVE-2026-5281 * Chromium: CVE-2026-5281 Use after free in Dawn High N/A No Yes RCE
CVE-2026-33825 Microsoft Defender Elevation of Privilege Vulnerability Important 7.8 Yes No EoP
CVE-2026-23666 .NET Framework Denial of Service Vulnerability Critical 7.5 No No DoS
CVE-2026-32190 Microsoft Office Remote Code Execution Vulnerability Critical 8.4 No No RCE
CVE-2026-33114 Microsoft Word Remote Code Execution Vulnerability Critical 8.4 No No RCE
CVE-2026-33115 Microsoft Word Remote Code Execution Vulnerability Critical 8.4 No No RCE
CVE-2026-32157 Remote Desktop Client Remote Code Execution Vulnerability Critical 8.8 No No RCE
CVE-2026-33826 Windows Active Directory Remote Code Execution Vulnerability Critical 8 No No RCE
CVE-2026-33824 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability Critical 9.8 No No RCE
CVE-2026-33827 Windows TCP/IP Remote Code Execution Vulnerability Critical 8.1 No No RCE
CVE-2026-26171 .NET Denial of Service Vulnerability Important 7.5 No No DoS
CVE-2026-32226 .NET Framework Denial of Service Vulnerability Important 5.9 No No DoS
CVE-2026-32178 .NET Spoofing Vulnerability Important 7.5 No No Spoofing
CVE-2026-32203 .NET and Visual Studio Denial of Service Vulnerability Important 7.5 No No DoS
CVE-2026-33116 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Important 7.5 No No DoS
CVE-2023-20585 * AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability Important 5.3 No No RCE
CVE-2026-32072 Active Directory Spoofing Vulnerability Important 6.2 No No Spoofing
CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32171 Azure Logic Apps Elevation of Privilege Vulnerability Important 8.8 No No EoP
CVE-2026-32168 Azure Monitor Agent Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32192 Azure Monitor Agent Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32181 Connected User Experiences and Telemetry Service Denial of Service Vulnerability Important 5.5 No No DoS
CVE-2026-27924 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32152 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32154 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27923 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32155 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-23653 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Important 5.7 No No Info
CVE-2026-23653 * GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes Important 7.4 No No Info
CVE-2026-33096 HTTP.sys Denial of Service Vulnerability Important 7.5 No No DoS
CVE-2026-25250 * MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix Important 6 No No SFB
CVE-2026-26181 Microsoft Brokering File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32219 Microsoft Brokering File System Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32091 Microsoft Brokering File System Elevation of Privilege Vulnerability Important 8.4 No No EoP
CVE-2026-26152 Microsoft Cryptographic Services Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-33103 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32188 Microsoft Excel Information Disclosure Vulnerability Important 7.1 No No Info
CVE-2026-32189 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32197 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32198 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32199 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32184 Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26155 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability Important 6.5 No No Info
CVE-2026-27914 Microsoft Management Console Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26149 Microsoft Power Apps Security Feature Bypass Important 9 No No SFB
CVE-2026-32200 Microsoft PowerPoint Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-26143 Microsoft PowerShell Security Feature Bypass Vulnerability Important 7.8 No No SFB
CVE-2026-33120 † Microsoft SQL Server Remote Code Execution Vulnerability Important 8.8 No No RCE
CVE-2026-20945 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing
CVE-2026-33822 Microsoft Word Information Disclosure Vulnerability Important 6.1 No No Info
CVE-2026-33095 Microsoft Word Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-23657 Microsoft Word Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32081 Package Catalog Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-26170 PowerShell Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26183 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26160 Remote Desktop Licensing Service Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26159 Remote Desktop Licensing Service Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26151 Remote Desktop Spoofing Vulnerability Important 7.1 No No Spoofing
CVE-2026-32085 Remote Procedure Call Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32167 SQL Server Elevation of Privilege Vulnerability Important 6.7 No No EoP
CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability Important 6.7 No No EoP
CVE-2026-0390 UEFI Secure Boot Security Feature Bypass Vulnerability Important 6.7 No No SFB
CVE-2026-32220 UEFI Secure Boot Security Feature Bypass Vulnerability Important 4.4 No No SFB
CVE-2026-32212 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32214 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32079 Web Account Manager Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-33104 Win32k Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32196 Windows Admin Center Spoofing Vulnerability Important 6.1 No No Spoofing
CVE-2026-26178 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability Important 8.8 No No EoP
CVE-2026-32073 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26168 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26173 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26177 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26182 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27922 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-33099 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-33100 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32088 Windows Biometric Service Security Feature Bypass Vulnerability Important 6.1 No No SFB
CVE-2026-27913 Windows BitLocker Security Feature Bypass Vulnerability Important 7.7 No No SFB
CVE-2026-26175 Windows Boot Manager Security Feature Bypass Vulnerability Important 4.6 No No SFB
CVE-2026-32162 Windows COM Elevation of Privilege Vulnerability Important 8.4 No No EoP
CVE-2026-20806 Windows COM Server Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-26176 Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27926 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32070 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-33098 Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26153 Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32087 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32093 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32086 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32150 Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27931 Windows GDI Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-27930 Windows GDI Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32221 Windows Graphics Component Remote Code Execution Vulnerability Important 8.4 No No RCE
CVE-2026-27906 Windows Hello Security Feature Bypass Vulnerability Important 4.4 No No SFB
CVE-2026-27928 Windows Hello Security Feature Bypass Vulnerability Important 8.7 No No SFB
CVE-2026-26156 Windows Hyper-V Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32149 Windows Hyper-V Remote Code Execution Vulnerability Important 7.3 No No RCE
CVE-2026-27910 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27912 Windows Kerberos Elevation of Privilege Vulnerability Important 8 No No EoP
CVE-2026-26179 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26180 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32195 Windows Kernel Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26163 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32215 Windows Kernel Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32217 Windows Kernel Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-32218 Windows Kernel Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-26169 Windows Kernel Memory Information Disclosure Vulnerability Important 6.1 No No Info
CVE-2026-27929 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32071 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability Important 7.5 No No DoS
CVE-2026-20930 Windows Management Services Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26162 Windows OLE Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-33101 Windows Print Spooler Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32084 Windows Print Spooler Information Disclosure Vulnerability Important 5.5 No No Info
CVE-2026-27927 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26184 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32069 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32074 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32078 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26167 Windows Push Notifications Elevation of Privilege Vulnerability Important 8.8 No No EoP
CVE-2026-32158 Windows Push Notifications Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32159 Windows Push Notifications Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32160 Windows Push Notifications Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26172 Windows Push Notifications Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-20928 Windows Recovery Environment Security Feature Bypass Vulnerability Important 4.6 No No SFB
CVE-2026-32216 Windows Redirected Drive Buffering System Denial of Service Vulnerability Important 5.5 No No DoS
CVE-2026-27909 Windows Search Service Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26161 Windows Sensor Data Service Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-26174 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32224 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26154 Windows Server Update Service (WSUS) Tampering Vulnerability Important 7.5 No No Tampering
CVE-2026-26165 Windows Shell Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-26166 Windows Shell Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27918 Windows Shell Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32151 Windows Shell Information Disclosure Vulnerability Important 6.5 No No Info
CVE-2026-32225 Windows Shell Security Feature Bypass Vulnerability Important 8.8 No No SFB
CVE-2026-32202 Windows Shell Spoofing Vulnerability Important 4.3 No No Spoofing
CVE-2026-32082 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32083 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32068 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32183 Windows Snipping Tool Remote Code Execution Vulnerability Important 7.8 No No RCE
CVE-2026-32089 Windows Speech Brokered Api Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32090 Windows Speech Brokered Api Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32153 Windows Speech Runtime Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27907 Windows Storage Spaces Controller Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32076 Windows Storage Spaces Controller Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27908 Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27921 Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27915 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27919 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32075 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-27916 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27920 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32077 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27925 Windows UPnP Device Host Information Disclosure Vulnerability Important 6.5 No No Info
CVE-2026-32156 Windows UPnP Device Host Remote Code Execution Vulnerability Important 7.4 No No RCE
CVE-2026-32223 Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability Important 6.8 No No EoP
CVE-2026-32165 Windows User Interface Core Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-27911 Windows User Interface Core Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32163 Windows User Interface Core Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-32164 Windows User Interface Core Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-23670 Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability Important 5.7 No No SFB
CVE-2026-27917 Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32080 Windows WalletService Elevation of Privilege Vulnerability Important 7 No No EoP
CVE-2026-32222 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP
CVE-2026-21637 * HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers Moderate 7.5 No No SFB
CVE-2026-33119 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability Moderate 5.4 No No Spoofing
CVE-2026-33829 Windows Snipping Tool Spoofing Vulnerability Moderate 4.3 No No Spoofing
CVE-2026-5858 * Chromium: CVE-2026-5858 Heap buffer overflow in WebML Critical N/A No No RCE
CVE-2026-5859 * Chromium: CVE-2026-5859 Integer overflow in WebML Critical N/A No No RCE
CVE-2026-5272 * Chromium: CVE-2026-5272 Heap buffer overflow in GPU High N/A No No RCE
CVE-2026-5273 * Chromium: CVE-2026-5273 Use after free in CSS High N/A No No RCE
CVE-2026-5274 * Chromium: CVE-2026-5274 Integer overflow in Codecs High N/A No No RCE
CVE-2026-5275 * Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE High N/A No No RCE
CVE-2026-5276 * Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB High N/A No No SFB
CVE-2026-5277 * Chromium: CVE-2026-5277 Integer overflow in ANGLE High N/A No No RCE
CVE-2026-5279 * Chromium: CVE-2026-5279 Object corruption in V8 High N/A No No RCE
CVE-2026-5280 * Chromium: CVE-2026-5280 Use after free in WebCodecs High N/A No No RCE
CVE-2026-5283 * Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE High N/A No No SFB
CVE-2026-5284 * Chromium: CVE-2026-5284 Use after free in Dawn High N/A No No RCE
CVE-2026-5285 * Chromium: CVE-2026-5285 Use after free in WebGL High N/A No No RCE
CVE-2026-5286 * Chromium: CVE-2026-5286 Use after free in Dawn High N/A No No RCE
CVE-2026-5287 * Chromium: CVE-2026-5287 Use after free in PDF High N/A No No RCE
CVE-2026-5289 * Chromium: CVE-2026-5289 Use after free in Navigation High N/A No No RCE
CVE-2026-5290 * Chromium: CVE-2026-5290 Use after free in Compositing High N/A No No RCE
CVE-2026-5860 * Chromium: CVE-2026-5860 Use after free in WebRTC High N/A No No RCE
CVE-2026-5861 * Chromium: CVE-2026-5861 Use after free in V8 High N/A No No RCE
CVE-2026-5862 * Chromium: CVE-2026-5862 Inappropriate implementation in V8 High N/A No No SFB
CVE-2026-5863 * Chromium: CVE-2026-5863 Inappropriate implementation in V8 High N/A No No SFB
CVE-2026-5864 * Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio High N/A No No RCE
CVE-2026-5865 * Chromium: CVE-2026-5865 Type Confusion in V8 High N/A No No RCE
CVE-2026-5866 * Chromium: CVE-2026-5866 Use after free in Media High N/A No No RCE
CVE-2026-5867 * Chromium: CVE-2026-5867 Heap buffer overflow in WebML High N/A No No RCE
CVE-2026-5868 * Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE High N/A No No RCE
CVE-2026-5869 * Chromium: CVE-2026-5869 Heap buffer overflow in WebML High N/A No No RCE
CVE-2026-5870 * Chromium: CVE-2026-5870 Integer overflow in Skia High N/A No No RCE
CVE-2026-5871 * Chromium: CVE-2026-5871 Type Confusion in V8 High N/A No No RCE
CVE-2026-5872 * Chromium: CVE-2026-5872 Use after free in Blink High N/A No No RCE
CVE-2026-5873 * Chromium: CVE-2026-5873 Out of bounds read and write in V8 High N/A No No RCE
CVE-2026-5291 * Chromium: CVE-2026-5291 Inappropriate implementation in WebGL Medium N/A No No SFB
CVE-2026-5292 * Chromium: CVE-2026-5292 Out of bounds read in WebCodecs Medium N/A No No Info
CVE-2026-5874 * Chromium: CVE-2026-5874 Use after free in PrivateAI Medium N/A No No RCE
CVE-2026-5875 * Chromium: CVE-2026-5875 Policy bypass in Blink Medium N/A No No SFB
CVE-2026-5876 * Chromium: CVE-2026-5876 Side-channel information leakage in Navigation Medium N/A No No Info
CVE-2026-5877 * Chromium: CVE-2026-5877 Use after free in Navigation Medium N/A No No RCE
CVE-2026-5878 * Chromium: CVE-2026-5878 Incorrect security UI in Blink Medium N/A No No Spoofing
CVE-2026-5879 * Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE Medium N/A No No SFB
CVE-2026-5880 * Chromium: CVE-2026-5880 Incorrect security UI in browser UI Medium N/A No No Spoofing
CVE-2026-5881 * Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess Medium N/A No No SFB
CVE-2026-5882 * Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen Medium N/A No No Spoofing
CVE-2026-5883 * Chromium: CVE-2026-5883 Use after free in Media Medium N/A No No RCE
CVE-2026-5884 * Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media Medium N/A No No SFB
CVE-2026-5885 * Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML Medium N/A No No SFB
CVE-2026-5886 * Chromium: CVE-2026-5886 Out of bounds read in WebAudio Medium N/A No No Info
CVE-2026-5887 * Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads Medium N/A No No SFB
CVE-2026-5888 * Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs Medium N/A No No RCE
CVE-2026-5889 * Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium Medium N/A No No SFB
CVE-2026-5890 * Chromium: CVE-2026-5890 Race in WebCodecs Medium N/A No No RCE
CVE-2026-5891 * Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI Medium N/A No No SFB
CVE-2026-5892 * Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs Medium N/A No No SFB
CVE-2026-5893 * Chromium: CVE-2026-5893 Race in V8 Medium N/A No No RCE
CVE-2026-5894 * Chromium: CVE-2026-5894 Inappropriate implementation in PDF Low N/A No No SFB
CVE-2026-5895 * Chromium: CVE-2026-5895 Incorrect security UI in Omnibox Low N/A No No Spoofing
CVE-2026-5896 * Chromium: CVE-2026-5896 Policy bypass in Audio Low N/A No No SFB
CVE-2026-5897 * Chromium: CVE-2026-5897 Incorrect security UI in Downloads Low N/A No No Spoofing
CVE-2026-5898 * Chromium: CVE-2026-5898 Incorrect security UI in Omnibox Low N/A No No Spoofing
CVE-2026-5899 * Chromium: CVE-2026-5899 Incorrect security UI in History Navigation Low N/A No No Spoofing
CVE-2026-5900 * Chromium: CVE-2026-5900 Policy bypass in Downloads Low N/A No No SFB
CVE-2026-5901 * Chromium: CVE-2026-5901 Policy bypass in DevTools Low N/A No No SFB
CVE-2026-5902 * Chromium: CVE-2026-5902 Race in Media Low N/A No No RCE
CVE-2026-5903 * Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox Low N/A No No SFB
CVE-2026-5904 * Chromium: CVE-2026-5904 Use after free in V8 Low N/A No No RCE
CVE-2026-5905 * Chromium: CVE-2026-5905 Incorrect security UI in Permissions Low N/A No No Spoofing
CVE-2026-5906 * Chromium: CVE-2026-5906 Incorrect security UI in Omnibox Low N/A No No Spoofing
CVE-2026-5907 * Chromium: CVE-2026-5907 Insufficient data validation in Media Low N/A No No SFB
CVE-2026-5908 * Chromium: CVE-2026-5908 Integer overflow in Media Low N/A No No RCE
CVE-2026-5909 * Chromium: CVE-2026-5909 Integer overflow in Media Low N/A No No RCE
CVE-2026-5910 * Chromium: CVE-2026-5910 Integer overflow in Media Low N/A No No RCE
CVE-2026-5911 * Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers Low N/A No No SFB
CVE-2026-5912 * Chromium: CVE-2026-5912 Integer overflow in WebRTC Low N/A No No RCE
CVE-2026-5913 * Chromium: CVE-2026-5913 Out of bounds read in Blink Low N/A No No Info
CVE-2026-5914 * Chromium: CVE-2026-5914 Type Confusion in CSS Low N/A No No RCE
CVE-2026-5915 * Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML Low N/A No No SFB
CVE-2026-5918 * Chromium: CVE-2026-5918 Inappropriate implementation in Navigation Low N/A No No SFB
CVE-2026-5919 * Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets Low N/A No No SFB
CVE-2026-33118 Microsoft Edge (Chromium-based) Spoofing Vulnerability Low 4.3 No No Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

 

Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.

Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host.

More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.

Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.

The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP notes that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.

There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.

The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering.

No new advisories are being released this month.

Looking Ahead

I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

]]> <![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]> https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/ https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/ Sat, 25 Jul 2026 18:59:26 +0200 📰 IT Security Nachrichten tsecurity.de Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

Executive summary 

A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [1].

LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.

Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the Persistence and credential access section.

This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:

  • United States National Security Agency (NSA)
  • United States Federal Bureau of Investigation (FBI)
  • Netherlands Defence Intelligence and Security Service (MIVD)
  • Netherlands General Intelligence and Security Service (AIVD)
  • United States Cybersecurity and Infrastructure Security Agency (CISA)
  • United States Defense Counterintelligence and Security Agency (DCSA)
  • United States Department of Defense Cyber Crime Center (DC3)
  • United States Department of the Treasury
  • United States Naval Criminal Investigative Service (NCIS)
  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • United Kingdom National Cyber Security Centre (NCSC-UK)
  • Czech Republic National Cyber and Information Security Agency (NÚKIB)1
  • Danish Defence Intelligence Service (DDIS)2
  • Estonian Foreign Intelligence Service (EFIS)3
  • Finnish Defence Intelligence (FDI)4
  • Finnish Security and Intelligence Service (SUPO)5
  • French General Directorate for Internal Security (DGSI)6
  • French National Cybersecurity Agency (ANSSI)7
  • Italian External Intelligence and Security Agency (AISE)8
  • Italian Internal Intelligence and Security Agency (AISI)9
  • Security and Intelligence Service of the Republic of Moldova (SIS RM)10
  • Polish Foreign Intelligence Agency (AW)11
  • The Military Counterintelligence Service of Poland (SKW)12
  • Spain National Intelligence Centre (CNI)13
  • Sweden National Cyber Security Centre (NCSC-SE)14

The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the Mitigations section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed Indicators of compromise (IOCs).  

As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.

For a downloadable list of IOCs, see:

Cybersecurity industry tracking

The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:

  • LAUNDRY BEAR
  • Void Blizzard [2]
  • CL-STA-1114 [3]
  • TA488 (formerly UNK_PitStop) [4]

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

Background

Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [1] [2]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  

The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [T1078], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence & Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [T1557].  

Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [T1114]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:

  • Last 90 days of emails,
  • Email address,
  • Password [T1589.001],
  • Global Address List (GAL) [T1087],
  • Two-factor authentication (2FA) tokens, and
  • Newly-created Application Passcode [T1098].

The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.

Targeting details

LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:

  • the Defense Industrial Base (DIB),  
  • the federal and local government,
  • education,
  • energy,
  • law enforcement,  
  • media,  
  • non-governmental organizations, and
  • technology.

Technical details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM version 1.4.015. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and D3FEND tactics, techniques, and countermeasures.

Ulej is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit CVE-2025-66376 [Common Weakness Enumeration (CWE) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.

Reconnaissance

LAUNDRY BEAR uses the Ulej capability to exploit the CVE-2025-66376 vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [T1595] and fingerprinting datasets easily procured through various commercial vendors [T1596.005].  

After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [T1589.002] from datasets offered by commercial vendors [T1597.002], open source intelligence [T1593], or previously exfiltrated data [T1597].  

Resource development

The actors procure VPSs from a variety of providers [T1583.003], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [T1583] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for Ulej’s Flowerbed framework [T1608], which then receives and aggregates the data Ulej exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.

Flowerbed framework

Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:

  • Catcher,
  • Certbot,
  • Nginx, and
  • Gardener.

Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [T1048]. For additional information on Catcher, refer to the Exfiltration section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [T1048.002]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.

The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [T1588.007]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.

Initial access

To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566]. Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199], as shown in the email metadata in Figure 2. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.

Figure 1: Example of malicious email
Figure 1: Example of malicious email

Figure 2: Headers from an example malicious email
Figure 2: Headers from an example malicious email

According to the National Vulnerability Database (NVD), CVE-2025-66376 was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [5]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [T1587.004].  

Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.

Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [T1027.010], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [T1119]. The stages in order of appearance within the payload are as follows:

  1. sendStartPing,
  2. gather_email,
  3. gather_environment,
  4. gather_2fa_codes,
  5. gather_app_password,
  6. gather_device_status,
  7. gather_oauth_consumers,
  8. gather_autocomplete_password,
  9. enable_mail_protocols,
  10. gather_gal,
  11. sendArchives, and
  12. sendFinishPing. 

Figure 3: Malicious payload of example email
Figure 3: Malicious payload of example email

Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [T1587].

Persistence and credential access

To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the Exfiltration section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [T1550.004], and the Zimbra campaign follows a similar trend.

The script used in this campaign tries to discover the victim’s email address during the gather_email stage [T1087]. The script searches for this email address in two ways. First, it examines the batchInfoResponse variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the Collection section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [T1185] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of null over HTTPS and does not attempt DNS exfiltration.

During the gather_autocomplete_password stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in Figure 4 and Figure 5. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in Figure 4. If there is no value in that input field, it checks the password input field shown in Figure 5. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of null is sent over HTTPS and DNS exfiltration is not attempted.

Figure 4: First illegitimate login HTML element
Figure 4: First illegitimate login HTML element

Figure 5: Second illegitimate login HTML element
Figure 5: Second illegitimate login HTML element

LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.

ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the gather_app_password stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [T1556.006]. The SOAP request uses “ZimbraWeb” as the name of the application.

Additionally, the script also attempts to collect 2FA tokens. During the gather_2fa_codes stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.

Collection

As demonstrated in the Persistence and credential access section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the Persistence and credential access section, other SOAP commands executed to collect victim information are shown in Table 1.

Table 1: Additional SOAP commands used

SOAP Command 

Namespace 

Stage 

GetInfoRequest 

zimbraAccount 

gather_environment 

GetDeviceStatusRequest 

zimbraSync 

gather_device_status 

GetOAuthConsumersRequest 

zimbraAccount 

gather_oauth_consumers 

SearchGalRequest 

zimbraAccount 

gather_gal 

The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.

During the gather_environment stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in Table 2) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.

Table 2: ZCS webmail client types

Indicator 

Client Type 

Associated Value 

?client=advanced 

Advanced 

c 

/h/ 

Standard 

h 

/modern/ 

Modern 

m 

As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)”. The {DAY_OFFSET} value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of zd_comp_YYYY-MM-DD, and value of true, is saved to the window.top.localStorage property. This variable is saved regardless of whether the email is successfully exfiltrated.  

According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a {DAY_OFFSET} of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the Exfiltration section.

The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the Exfiltration section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of gather_gal:{VAL}:api. The {VAL} placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder {DAY_OFFSET}, with a format of sendArchive:day-{DAY_OFFSET}.

Exfiltration

At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [T1048.003] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.

Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  

DNS exfiltration

DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, Ulej maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in Figure 6. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.

Figure 6: Structure for information exfiltrated by DNS
Figure 6: Structure for information exfiltrated by DNS

When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. Table 3 lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  

Table 3: DNS exfiltration

Type of Information 

Exfiltration Stage 

Data Type 

Victim’s Email Address 

gather_email 

e 

Client Type 

gather_environment 

c 

Zimbra Version 

gather_environment  

v 

URL at Time of Exploitation 

gather_environment 

url 

2FA Scratch Codes 

gather_2fa_codes 

2fa 

Newly Created Application Password 

gather_app_password 

pa 

Harvested Autocomplete Password 

gather_autocomplete_password 

pw 

HTTPS exfiltration

Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in Table 4. Traffic associated with HTTPS exfiltration will use the URL scheme shown in Figure 7.  

Table 4: HTTPS exfiltration types

Content Type 

URL Path 

application/json 

/v/p 

application/octet-stream 

/v/d 

Figure 7: Structure for information exfiltrated by HTTPS
Figure 7: Structure for information exfiltrated by HTTPS

Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  

Table 5 provides a summary of the JSON-based exfiltration.

Table 5: HTTPS JSON exfiltration  

Type of Information 

Exfiltration Stage 

JSON Key(s) 

Victim’s Email Address 

gather_email 

email 

Client Type, Version, and Current URL 

gather_environment 

client, version, full_url 

Newly Created Application Password 

gather_app_password 

app_password 

Harvested Autocomplete Password 

gather_autocomplete_password 

autocomplete_password 

The script transmits all HTTPS exfiltration not identified in Table 5 using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. Table 6 summarizes the data exfiltrated in this format.

 Table 6: HTTPS binary exfiltration

Type of Information 

Exfiltration Stage 

X-Filename Header 

SOAP request for GetInfoRequest 

gather_environment 

zimbra_batch_analytics.json 

SOAP request for GetScratchCodesRequest 

gather_2fa_codes 

zimbra_batch_analytics.json 

SOAP request for GetDeviceStatusRequest 

gather_device_status 

zimbra_batch_analytics.json 

SOAP request for GetOAuthConsumersRequest 

gather_oauth_consumers 

zimbra_batch_analytics.json 

Victim Organization’s Global Address List 

gather_gal 

telemetry_{1-20}.json 

Last 90 Days of Victim’s Emails 

sendArchives 

telemetryData_{0-89}.json 

The script sends all exfiltrated data identified in Table 6 to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [T1560]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in Table 6 using the application/octet-stream content typing rather than application/json.

At the beginning and end of the collection and exfiltration activity, during the sendStartPing and sendFinishPing stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in Figure 2, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (start, finish, or error).  

Catcher

Ulej exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the Resource development section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.

Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the Resource development section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.

The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  

However, if a query includes a domain formatted as shown in Figure 6 and Figure 7, the service saves a log file in JSON format to disk containing the following details of the DNS query:

  • Time of query,
  • Source IP address for query,
  • Queried domain, and
  • Type of query.

The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in Figure 6 and Figure 7. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:

  • Time,
  • Source IP address,
  • Request method,
  • Host,
  • Path,
  • Query string,
  • Headers, and
  • Base64 payload.

These JSON event log files and binary output files are then initially saved to the directory /root/hits/tmp and later moved to the /root/hits/ready directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in Figure 8 also executes hourly to remove all files last modified at least two days ago from the /root/hits/ready directory.

Figure 8: Command used for automated directory cleanup
Figure 8: Command used for automated directory cleanup

Response strategies

Mitigations

In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.

All organizations that use the ZCS webmail service should immediately prioritize ensuring that their ZCS is not running a vulnerable version. A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS [D3-AH]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [d3f:Isolate].

System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [D3-AH]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including CISA’s Known Exploited Vulnerabilities Catalog and NCSC-UK’s Responding to active exploitation of vulnerabilities guidance.

Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [D3-CH]. However, Application Passcodes may still be necessary and should be monitored closely.  

Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [CPG 3.Q]. This will allow organizations to monitor for and identify suspicious network activity [CPG 4.B], such as:

  • Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [D3-NTA];
  • Frequent DNS queries for a suspicious domain with seemingly random subdomains [D3-DNSTA];
  • A sudden spike of connections to a server associated with a recently established domain [D3-NTCD]; and  
  • Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [D3-NTCD].

Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the Exfiltration section of this advisory.

Indicators of compromise (IOCs)

Flowerbed infrastructure

The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (Disclaimer: Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) Table 7 provides details about the server infrastructure used to host Flowerbed, and Table 8 lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [D3-IAA].

Table 7: Flowerbed server infrastructure

Domain 

IP Address 

First Seen 

Last Seen 

zmailanalytics[.]com 

216.252.238[.]104 

8 July 2025 

15 October 2025 

zimbra-metadata[.]com 

216.252.238[.]18 

20 August 2025 

14 October 2025 

analyticemailmeter[.]com 

37.120.247[.]228 

24 September 2025 

18 March 2026 

emailanalytics.com[.]ua 

185.86.79[.]95 

24 September 2025 

18 March 2026 

mailnalysis[.]com 

104.248.134[.]194 

11 November 2025 

17 February 2026 

zimbrastat[.]com 

64.226.124[.]190 

18 December 2025 

18 March 2026 

zimbrasoft.com[.]ua 

193.238.152[.]66 

20 January 2026 

18 March 2026 

synacorzimbra[.]nl 

216.252.238[.]64 

3 February 2026 

30 March 2026 

istc-cloud[.]com 

194.156.103[.]193 

5 February 2026 

30 March 2026 

Table 8: Flowerbed X.509 certificate SHA-1 hashes  

Associated Domain 

X.509 SHA-1 Hash 

First Seen 

Last Seen 

zmailanalytics[.]com 

2e4f314bc9943cab5005d6fde0b271c74d47bc9d 

8 Jul 2025 

6 Aug 2025 

*.i.zmailanalytics[.]com 

50a87d926621dd06389ba50d86e0ff574ed713a8 

6 Aug 2025 

13 Oct 2025 

*.i.zimbra-metadata[.]com 

c5a72420e7bb308d078e62128430897f82194c95 

20 Aug 2025 

14 Oct 2025 

*.i.analyticemailmeter[.]com 

8959c4d29e29f02ea94ea8bb21c8df2594c5549d 

24 Sep 2025 

8 Nov 2025 

*.i.emailanalytics.com[.]ua 

62eb76432597694edb01c1fe57aab0cfe03a7178 

25 Sep 2025 

27 Sep 2025 

*.i.mailnalysis[.]com 

cddf5c3be1e07f28140aed165b929bf2d614922a 

12 Nov 2025 

17 Dec 2025 

*.i.zimbrastat[.]com 

18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 

18 Dec 2025 

28 Dec 2025 

*.i.zimbrasoft.com[.]ua 

1b25041ececf2457eef0270fc1d785cec8ec9ded 

21 Jan 2026 

10 Feb 2026 

*.i.synacorzimbra[.]nl 

e4fe6466a4f9a4249fe330651e914e45bbdca44a 

5 Feb 2026 

22 Mar 2026 

*.i.istc-cloud[.]com 

b6b77c9a455225d525834a403ca9ef5481ed0447 

12 Feb 2026 

30 Mar 2026 

LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:

  • ivanka.zurabishvili@proton[.]me,
  • zmul1@buildandconsulting[.]com,
  • garrysmithme@pinmx[.]net, and
  • hostingclient@pinmx[.]net.

Phishing distribution

LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  

The following email addresses have distributed payloads attributed to this campaign:

  • c.laurent.ejfa@proton[.]me,
  • j.moreau.epsc@proton[.]me,
  • liberty.insights@proton[.]me,
  • certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and
  • certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).

Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:

  • 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,
  • 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,
  • b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and
  • 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.

Post-compromise artifacts

Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.

This Ulej capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the /opt/zimbra/log/mailbox.log file [D3-PA]. A significant amount of SOAP request activity that aligns with what was described in the Persistence and credential access and Collection sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:

  • Many SearchGalRequest command requests from a single user over a short period of time;
  • Use of the CreateAppSpecificPasswordRequest command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and
  • Use of the GetScratchCodesRequest command.

While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [D3-PA]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of zd_comp_YYYY-MM-DD, as explained in the Collection section of this advisory.

While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”

In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [D3-MA]. If an email that has a payload exploiting CVE-2025-66376 is discovered, steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  

Remediation

In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to CVE-2025-66376.

Organizations should use identifiers from the IOCs section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.

All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [CPG 3.B] and creating unique credentials [CPG 3.C], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.

Works cited

[1] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf

[2] Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

[3] Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. https://unit42.paloaltonetworks.com/russian-webmail-espionage/ 

[4] Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit

[5] Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  

Footnotes

1 Národní úřad pro kybernetickou a informační bezpečnost
2 Forsvarets Efterretningstjeneste
3 Välisluureamet
4 Sotilastiedustelu
5  Suojelupoliisi
6 Direction gĂŠnĂŠrale de la sĂŠcuritĂŠ intĂŠrieure
7 Agence nationale de la sécurité des systèmes d’information
8 Agenzia Informazioni e Sicurezza Esterna
9 Agenzia Informazioni e Sicurezza Interna
10 Serviciul de Informații și Securitate al Republicii Moldova
11 Agencja Wywiadu
12 Służba Kontrwywiadu Wojskowego
13 Centro Nacional de Inteligencia
14 Nationellt Cybersäkerhetscenter
15 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.

Acknowledgements

The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.

Disclaimer of endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

United States organizations 

  • National Security Agency 
    Cybersecurity Report Feedback: CybersecurityReports@nsa.gov 
    Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov 
    Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov 
  • Cybersecurity and Infrastructure Security Agency 
    CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472). 
  • Federal Bureau of Investigation 
    If you or someone you know has fallen victim to this campaign, file a complaint with IC3. 
  • Defense Counterintelligence and Security Agency  
    DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: DCSA.CI.CyberOps@mail.mil 
    Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. 
    Media/Public Inquiries: dcsa.quantico.dcsa-hq.mbx.pa@mail.mil  
  • Department of Defense Cyber Crime Center  
    Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil 
    Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil 
    Media Inquiries / Press Desk: DC3.Information@us.af.mil 
  • Naval Criminal Investigative Service 
    To report criminal activity impacting the United States Navy, go to www.ncis.navy.mil and click “Submit a Tip”

Dutch organizations 

Australian organizations 

  • Australian Signals Directorate 
    Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. 

Canadian organizations 

  • The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  
    Report an incident or suspicious activity to the Cyber Centre by email at contact@cyber.gc.ca, online via the reporting tool Report a cyber incident - Canadian Centre for Cyber Security or by phone at 1-833-CYBER-88 (1-833-292-3788). 

New Zealand organizations 

United Kingdom organizations 

Estonia organizations 

Finnish organizations 

French organizations 

  • French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

Italian Organizations 

Moldovan organizations 

  • Security and Intelligence Service of the Republic of Moldova (SIS RM): cybersec@sis.md 

Polish organizations 

Appendix A: MITRE ATT&CK tactics and techniques

See Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory.

Table 9: Reconnaissance 

Technique Title 

ID 

Use 

Gather Victim Identity Information: Credentials 

T1589.001 

The payload attempts to intercept a victim’s password from their password manager. 

Gather Victim Identity Information: Email Addresses 

T1589.002 

The payload attempts to grab the victim’s email address from various data stores. 

Search Open Websites/Domains 

T1593 

This group likely leverages public information to support target development. 

Active Scanning 

T1595 

Port scanning can be used by this group to assist with determining exploitability of identified targets. 

Search Open Technical Databases: Scan Databases 

T1596.005 

Various public datasets can provide information to support discovery of exploitable targets. 

Search Closed Sources 

T1597 

Previously exfiltrated data can be used to enhance target development efforts. 

Search Closed Sources: Purchase Technical Data 

T1597.002 

Commercial datasets can also be used to support target development efforts. 
Table 10: Resource Development 

Technique Title 

ID 

Use 

Acquire Infrastructure 

T1583 

This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. 

Acquire Infrastructure: Virtual Private Server 

T1583.003 

This group procured VPS servers from a variety of vendors. 

Develop Capabilities 

T1587 

The Ulej capability was developed likely for use by this group to conduct spear phishing campaigns. 

Develop Capabilities: Malware 

T1587.001 

Development of a novel payload that steals a victim’s emails and other sensitive account information. 

Develop Capabilities: Exploits 

T1587.004 

Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. 

Obtain Capabilities: Tool 

T1588.002 

Open source tools, such as Evilginx2, have also been used by the group. 

Obtain Capabilities: Artificial Intelligence 

T1588.007 

The group appears to have leveraged AI to support development efforts. 

Stage Capabilities 

T1608 

Flowerbed is deployed to a procured server in the cloud. 

Table 11: Initial Access 

Technique Title 

ID 

Use 

Valid Accounts 

T1078 

This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  

Trusted Relationship 

T1199 

The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  

Phishing 

T1566 

The actors used spear phishing to lure users into opening malicious email. 

Table 12: Execution 

Technique Title 

ID 

Use 

Exploitation for Client Execution 

T1203 

An XSS vulnerability was leveraged to execute the JavaScript payload. 

Table 13: Persistence 

Technique Title 

ID 

Use 

Account Manipulation 

T1098 

Enabling IMAP and Application Passcodes provides persistent access to the compromised account. 

Modify Authentication Process: Multi-Factor Authentication 

T1556.006 

Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

Table 14: Privilege Escalation 

Technique Title 

ID 

Use 

Valid Accounts 

T1078 

This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  

Table 15: Stealth 

Technique Title 

ID 

Use 

Obfuscated Files or Information: Command Obfuscation 

T1027.010 

Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. 

Obfuscated Files or Information: Encrypted/Encoded File 

T1027.013 

The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. 

Obfuscated Files or Information: SVG Smuggling 

T1027.017 

The payload was contained in an “onload” attribute within an SVG image included in the malicious email. 

Use Alternate Authentication Material: Web Session Cookie 

T1550.004 

Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. 

Table 16: Credential Access 

Technique Title 

ID 

Use 

Modify Authentication Process: Multi-Factor Authentication 

T1556.006 

Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

Adversary-in-the-Middle 

T1557 

Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. 

Table 17: Collection 

Technique Title 

ID 

Use 

Data Staged: Remote Data Staging 

T1074.002 

Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. 

Email Collection 

T1114 

This group has emphasized collection of emails. 

Email Collection: Remote Email Collection 

T1114.002 

Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. 

Automated Collection 

T1119 

Upon execution, the JavaScript payload automatically collects all relevant information in stages. 

Browser Session Hijacking 

T1185 

The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. 

Archive Collected Data 

T1560 

Emails are exfiltrated with GZIP compression. 

Table 18: Discovery 

Technique Title 

ID 

Use 

Account Discovery 

T1087 

Stolen Global Access Lists provide the group with new users to target. 

Table 19: Exfiltration 

Technique Title 

ID 

Use 

Exfiltration Over Alternative Protocol 

T1048 

Victim information was exfiltrated over both HTTPS and DNS. 

Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol 

T1048.002 

Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. 

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol 

T1048.003 

Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. 

Appendix B: MITRE D3FEND countermeasures

See Table 20 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

Table 20: MITRE D3FEND Countermeasures 

Countermeasure Title 

ID 

Description 

Application Hardening 

D3-AH 
  • Organizations should immediately prioritize patching CVE-2025-66376.  
  • Organizations should promptly apply software updates to all email systems. 

Isolate 

d3f:Isolate 

Organizations that cannot feasibly patch should use alternative mail clients. 

Credential Hardening 

D3-CH 

Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. 

Network Traffic Analysis 

D3-NTA 

Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. 

DNS Traffic Analysis 

D3-DNSTA 

Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. 

Network Traffic Community Deviation 

D3-NTCD 
  • Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. 
  • Organizations should monitor for connections to internal services, such as webmail, from VPN providers. 

Identifier Activity Analysis 

D3-IAA 

Organizations should search for the listed known IOCs. 

Process Analysis 

D3-PA 
  • Organizations should search ZCS log files for specific commands used by the malicious script. 
  • Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. 
Message Analysis D3-MA Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.
]]> <![CDATA[AI success requires a full-stack CIO]]> https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/ https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/ Sat, 25 Jul 2026 18:57:42 +0200 📰 IT Security Nachrichten tsecurity.de

Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

The full-stack CIO: Leading with clarity

A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

And those who execute best lead with clarity, Talasaz says.

“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

Reducing organizational friction

Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

Operating model as strategy enabler

AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

Closing the gap between strategy and execution

Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

]]> <![CDATA[Stop asking AI nicely: Here’s how to get work-ready results every time]]> https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/ https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/ Sat, 25 Jul 2026 18:55:51 +0200 📰 IT Security Nachrichten tsecurity.de

Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation for reliable, measurable outcomes. I want to share the techniques that consistently delivered the biggest gains in my projects, complete with real before-and-after examples, copy-paste templates, lessons from failures and guidance on when to evolve beyond prompting to agentic systems.

Why advanced prompting still matters in enterprise settings

Sophisticated prompting remains essential for control, reliability and compliance. If you “ask nicely” and hope for the best, you need deterministic behavior, auditable reasoning and minimal risk of hallucination. Here’s what worked for me.

1. Chain-of-Thought (CoT) and its variants: Unlocking step-by-step reasoning

The problem: Models would jump to conclusions on complex analysis tasks, especially involving data interpretation or multi-step logic.

What I did: I started explicitly instructing the model to “think step by step” and show its reasoning.

Before (basic prompt): “Analyze last quarter’s sales data and recommend three actions.”

After (CoT prompt):

“You’re a senior business analyst. Analyze the following sales data step by step: [data]. First, identify the key trends. Second, calculate the rates and anomalies. Third, link findings to business context. Finally, recommend the three prioritized actions with expected impact. Explain your reasoning at each step.”  

Results: Accuracy and depth improved dramatically.

Variants that worked well: Self-consistency. I ran the same CoT prompt multiple times and took the majority consensus. This reduced variability significantly.

Template you can use:

You are [expert role]. Solve this problem by thinking step by step.

[Task or question]

For each step:

1. State your observation or calculation.

2. Explain the implication.

3. Proceed only when confident.

Final answer in this format: [structured output]

2. Tree-of-Thoughts (ToT): Exploring multiple reasoning paths

For truly complex decisions such as resource allocation or risk assessment, linear CoT isn’t enough. Tree-of-Thoughts lets the model generate and evaluate multiple branches.

Example: I was helping a client evaluate three potential vendor platforms for an AI deployment. A standard prompt gave a superficial comparison. With ToT

Prompt Snippet:

Explore three different reasoning paths for selecting the best vendor platform:

Path 1: Focus on cost and scalability.

Path 2: Focus on security, compliance and integration.

Path 3: Focus on innovation and long-term roadmap.

For each path, evaluate pros/cons against our requirements [list].

Then, compare the paths and recommend the strongest overall option with justification.

Outcome: The model surfaced nuanced trade-offs (e.g., one vendor had superior security, but higher integration cost).

When to use: Strategic planning, troubleshooting or scenarios with high uncertainty and multiple viable approaches.

3. ReAct (Reason+ Act) and prompt chaining: Moving toward agentic behavior

One of the biggest leaps I have noticed comes from combining reasoning with tool use and chaining prompts.

ReAct example: (used in data analytics workflow)

You are an AI analyst with access to tools. For the query below:

1. Reason about what information you need.

2. Choose the appropriate tool or action.

3. Observe the result.

4. Repeat until you can answer confidently.

Query: [user request]

In practice, I chained this with retrieval tools. One automated quarterly compliance reporting; the system reasoned about required data, pulled relevant records, validated them, and generated the reports.

4. Meta-prompting and self-reflection: Letting the model improve itself

Use the model to refine its own prompt. This is a huge time-saver.

You are an expert prompt engineer. Improve the following prompt for clarity, structure and effectiveness with [target model]. Make it more precise while preserving intent.

Original prompt: [paste]

Provide the improved version and explain your changes.

Self-reflection loops (asking the model to critique its own output and revise) are a game-changer for content generation and code-review tasks.

5. Multimodal and structured output techniques

With vision-enabled models, I started combining text with images (e.g., uploading architecture diagrams or dashboards).

Tip from experience: Be extremely specific in describing what the models should focus on.

Best practices I learned the hard way

  • Start simple, then layer complexity: Over-engineered prompts from Day One usually backfire.
  • Model specific tuning: Some models respond better to XML delimiters; others to explicit reasoning.
  • Evaluation and versioning: Treat prompts like code if you track versions and run automated evals.
  • Security guardrails: Always include instructions against prompt injections and respect data boundaries.
  • When to stop prompting: For repetitive, high-stakes workflows, move to full agents or an orchestration framework.

Final takeaways for technical leaders

Advanced prompt engineering has now become a core competency for anyone responsible for enterprise AI outcomes. Start by picking one technique and apply it rigorously to a real business problem. Document before/ after and you will notice why it’s worth mastering.

The field continues evolving towards more automated and agentic systems, but the ability to precisely direct AI reasoning remains foundational.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]> https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ Sat, 25 Jul 2026 18:55:50 +0200 📰 IT Security Nachrichten tsecurity.de

OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.

The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.

Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.

OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.

Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.

Workforce impact

OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.

Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.

“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”

Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.

However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.

Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

Cost and operational risks

Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.

Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.

Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

]]> <![CDATA[Model Context Protocol is going stateless to make scaling simpler]]> https://tsecurity.de/de/3694388/it-security-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ https://tsecurity.de/de/3694388/it-security-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ Sat, 25 Jul 2026 18:55:48 +0200 📰 IT Security Nachrichten tsecurity.de

Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.

The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.

“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said Muskan Bandta, cloud associate at ZopDev.

“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.

Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.

“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.

This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to Amit Jena, AI development manager at IT consulting firm Kanerika.

Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.

It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.

MCP’s new features

Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.

Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.

Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.

They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.

MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.

Rebuilding the trust boundary

The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.

The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.

“Sampling let MCP servers invoke the LLM through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”

The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”

Updated MCP SDKs

To accompany the protocol update, there are updated MCP SDKs for Python, Typescript, Go, and C#. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.

That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.

Identifying and auditing those session dependencies may not be easy, Jena warned.

“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.

This article first appeared on InfoWorld.

]]> <![CDATA[IoT Penetration Testing: From Hardware to Firmware]]> https://tsecurity.de/de/3694236/it-security-nachrichten/iot-penetration-testing-from-hardware-to-firmware/ https://tsecurity.de/de/3694236/it-security-nachrichten/iot-penetration-testing-from-hardware-to-firmware/ Sat, 25 Jul 2026 18:52:21 +0200 📰 IT Security Nachrichten tsecurity.de As Internet of Things (IoT) devices continue to permeate every aspect of modern life, homes, offices, factories, vehicles, their attack surfaces have become increasingly attractive to adversaries. The challenge with testing IoT systems lies in their complexity: these devices often combine physical interfaces, embedded firmware, network services, web applications, and companion mobile apps into a [...]

The post IoT Penetration Testing: From Hardware to Firmware appeared first on Hacking Tutorials.

]]> <![CDATA[Microsoft stoppt die Einführung einiger Teams- und Outlook-Funktionen]]> https://tsecurity.de/de/3694180/it-security-nachrichten/microsoft-stoppt-die-einfuehrung-einiger-teams-und-outlook-funktionen/ https://tsecurity.de/de/3694180/it-security-nachrichten/microsoft-stoppt-die-einfuehrung-einiger-teams-und-outlook-funktionen/ Sat, 25 Jul 2026 18:51:54 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft, Logo, Office, Outlook, Synchronisation, Cloudsynchronisation, Teams, Microsoft Teams, Kontakte, Synchronisierung, Sync, Synchronisieren, Microsoft Teams Logo Microsoft bremst bei Teams und Outlook erneut neue Funktionen aus: Geplant waren unter anderem eine @Mentions-Suche und Copilot-Hinweise in der Outlook-Suche. Unklar ist, warum der Konzern die Einführung nun stoppt. (Weiter lesen)]]> <![CDATA[CVE-2026-34573 | parse-community parse-server up to 8.6.67/9.7.0-alpha.11 Query algorithmic complexity]]> https://tsecurity.de/de/3694074/sicherheitsluecken/cve-2026-34573-parse-community-parse-server-up-to-8667970-alpha11-query-algorithmic-complexity/ https://tsecurity.de/de/3694074/sicherheitsluecken/cve-2026-34573-parse-community-parse-server-up-to-8667970-alpha11-query-algorithmic-complexity/ Sat, 25 Jul 2026 17:03:08 +0200 🕵️ Sicherheitslücken tsecurity.de parse-community parse-server up to 8.6.67/9.7.0-alpha.11 and classified as problematic. This issue affects some unknown processing of the component Query Handler. The manipulation leads to inefficient algorithmic complexity. This vulnerability is listed as CVE-2026-34573. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.]]> <![CDATA[CVE-2025-62842 | QNAP HBS 3 Hybrid Backup Sync 25.1.1.673/25.1.4.952 file inclusion (qsa-25-46 / EUVD-2026-0662)]]> https://tsecurity.de/de/3694045/sicherheitsluecken/cve-2025-62842-qnap-hbs-3-hybrid-backup-sync-25116732514952-file-inclusion-qsa-25-46-euvd-2026-0662/ https://tsecurity.de/de/3694045/sicherheitsluecken/cve-2025-62842-qnap-hbs-3-hybrid-backup-sync-25116732514952-file-inclusion-qsa-25-46-euvd-2026-0662/ Sat, 25 Jul 2026 16:33:23 +0200 🕵️ Sicherheitslücken tsecurity.de critical has been discovered in QNAP HBS 3 Hybrid Backup Sync 25.1.1.673/25.1.4.952. This affects an unknown function. Executing a manipulation can lead to file inclusion. The identification of this vulnerability is CVE-2025-62842. The physical device can be targeted for the attack. There is no exploit available. It is advisable to upgrade the affected component.]]> <![CDATA[17 Things to know for Android developers at Google I/O]]> https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/ https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/ Sat, 25 Jul 2026 10:15:45 +0200 🤖 Android Tipps tsecurity.de
Posted by Matthew McCullough, VP, Product Management, Android Developer

Today at Google I/O, we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcements for Android developers; you can also see what was announced last week in The Android Show: I/O Edition. Stay tuned over the next two days as we dive into all of the topics in more detail!

Build High Quality Android Apps Using Agents

1: Android CLI: helping you build with any agent, LLM, and tool

Android CLI is now stable. It offers programmatic tools that allow any AI agent, including Claude Code, Codex, or Antigravity, to perform core Android tasks much more easily and efficiently. With today’s release, it also provides a bridge to tap directly into the "heavy-lifting" power of Android Studio to give you the production-ready polish needed for professional Android development. By leveraging the new android studio commands, developers can now grant their preferred agents the ability to perform semantic symbol resolution, analyze files for warnings, and even render Jetpack Compose previews. This release also enables official support for "Journeys" through new Android skills, which enables agents to execute end-to-end UI tests under your direction. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.    

You can now easily install Android CLI for use with Google Antigravity 2.0.

2: Build production-ready apps with ease in Google AI Studio

Developers and creators can now build native Android apps, simply with a prompt in Google AI Studio. The apps are built with development best practices like Jetpack Compose, Kotlin, and APIs that leverage our recommended developer patterns. Google AI Studio enables developers to prototype, iterate via an embedded emulator, and deploy to physical devices without heavy local installations. Developers are then able to take those apps and share them to Android devices, as well as share them with others for testing through Google Play Console’s internal testing track. If a developer wants to prepare their app for a wider release, they’re able to take it to Android Studio for advanced debugging, testing, and UI polish. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.

Use the embedded Android Emulator to create Android apps in Google AI Studio

3: Accelerating AI coding assistance with Android Bench

Android Bench is our LLM leaderboard for Android development challenges. The goal is to accelerate model improvements, so you have more useful options for AI assistance. Many of you have been using open-weight models for AI assistance, so we’re now adding commonly used ones, such as Gemma 4, to the leaderboard, so you can see how LLMs that offer offline access and additional flexibility for power-users measure up. We're continuously working on increasing the difficulty of challenges we’re giving LLMs, to continue encouraging more useful improvements. 

4: Convert iOS apps to Android with the Migration Assistant in Android Studio

The Migration Assistant in Android Studio is designed to port apps from platforms like iOS, React Native, or web frameworks to native Android. By simply selecting an existing project, developers can have the agent intelligently map features, convert assets like storyboards and SVGs, and implement Android best practices using Jetpack Compose and our recommended Jetpack libraries. This effectively transforms what used to be weeks of manual porting into a streamlined agentic workflow that only takes hours. We shared a preview of the incoming feature in the developer keynote. 
A sneak peek of the Migration Assistant converting an iOS app into a native Android app

Building AI Into Your Apps

5: Building Intelligent Apps with generative AI

Generative AI enables you to create apps that are more intelligent, personalized, and agentic than ever before. This year, we introduced the latest advancements in on-device intelligence with a preview of Gemini Nano 4 for tasks like data extraction and summarization. We also expanded cloud capabilities via Firebase AI Logic, allowing developers to leverage Gemini models with robust grounding (including URL, Maps, and web search) to build smarter, more capable assistants. Furthermore, we unveiled our hybrid inference approach and the new Agent Development Kit (ADK) for Android, alongside communication protocols like AG-UI and A2UI that simplify the creation of autonomous, agentic experiences. To start integrating these powerful features, explore the developer documentation, and watch the technical deep dive session where we showcase all these technologies.

6: Experiment with AppFunctions today

AppFunctions is an Android platform API with an accompanying Jetpack library to simplify building Android MCP integrations. It empowers your apps to behave like on device MCP servers, contributing functions that act as tools for use by agents and assistants. AppFunctions integration with Gemini is currently in a private preview with trusted testers, and you can begin preparing your apps already. You can sign up for the Early Access Program and start experimenting using the API guidance, sample, and skill today.

The Future is Adaptive

7: Android is now Compose First; Views are now in maintenance mode.

Compose is our standard for UI development, and we are moving to a Compose-first approach for all future guidance and libraries. Building on five years of evolution, the latest releases deliver a more mature toolkit, from the highly customizable Styles API to refined shared element transitions and enhanced input support. These updates allow you to build beautiful, adaptive apps with less code and better performance. Learn more about what Compose-first means for Android Development in our blog post. 

Build Android UI with Compose

8: Building seamless Android experiences across devices with Jetpack Compose

The Android ecosystem is now Adaptive by Default, moving fluidly across phones, foldables, tablets, cars, XR, and expanding usages with Googlebook and connected displays. With over 580 million large-screen devices, and users on multiple devices spending up to 14x more on apps, the investment in adaptive design presents a massive opportunity. Jetpack Compose is the definitive engine for this transition, offering core tools like our latest Jetpack Navigation 3 release, new experimental Grid and FlexBox layouts, enhanced non-touch input support, and CameraX for correct camera previews across any window size. Furthermore, new skills in Android Studio make updating your existing app to adopt these adaptive patterns easier than ever. Notability’s Android debut sets a new standard for premium productivity apps. Built with Jetpack Compose, Navigation 3, and Kotlin Multiplatform, it delivers an intuitive, adaptive experience across devices.

9: Create seamless experiences for Googlebook

Last week we announced Googlebook, a high-performance laptop that provides a large-screen canvas for your existing apps. Building with adaptive principles today helps ensure your app will work on Googlebook. Get started by reviewing relevant design guidance and developer guidelines for desktop experiences. Try out the new Desktop Emulator available in the Android Studio Canary to to test your apps for this form factor today.

New Desktop Android Emulator

10: Unified widget development experience with Jetpack Glance

Android 17 marks a shift toward a single, Compose-based development model for all widgets. By unifying the experience across mobile, Wear OS, and cars through Jetpack Glance, you can soon scale UI components across the ecosystem with a familiar workflow.

The breakthrough this year is the integration of RemoteCompose. On mobile and cars, it powers high-fidelity animations, while on Wear OS, it allows Wear Widgets (formerly Tiles) to render complex UI logic natively on remote surfaces. This ensures peak performance on low-power hardware while allowing a cohesive user journey—like checking a flight status on your car dashboard and seeing gate change updates on your wrist.

Four widgets are shown cycling through in the Android Auto interface. A clock, a contact card, Google Home favorites and a photo.

11: Expand your reach on the road with Android for Cars
To help you expand your reach when you build in-car experiences, we're making it easier to build once and deliver your apps to Android Auto and Android Automotive OS. With the latest releases of the Car App Library, you can build customized, distraction-optimized templated media apps for both platforms. We're introducing new components and template capabilities to give you increased flexibility and more options for laying out content. Parked experiences are expanding too, with immersive video playback coming to Android Auto for phones running Android 17. You can easily adapt your video apps for these parked experiences; apply now to the early access program to publish in these beta categories and learn more about the latest updates in our blog.

12: Accelerate your development with Android XR Developer Preview 4

Inspired by the innovative experiences you’ve built for the platform, we’re continuing to mature our tools with Developer Preview 4 of the Android XR SDK. A key milestone in this journey is the transition of our core libraries, XR Runtime, Jetpack SceneCore, and ARCore for Jetpack XR, moving to Beta soon to provide a more stable and performant foundation. We are also accelerating hardware access through the Android XR Developer Catalyst Program, where you can apply for XREAL’s Project Aura, audio glasses, or display glasses developer kits. Watch The latest in Android XR session or read our blog to see how these updates help you build experiences across the ecosystem.

Early preview of the Geospatial API in ARCore for Jetpack XR, enabling high-precision anchoring of digital content to real-world locations.

13: Android is your new home for professional-grade media experiences

Android 17 streamlines the entire media lifecycle with a production-ready toolkit. High-fidelity capture is now simplified with the CameraXViewfinder Composable, which handles complex scaling and responsiveness on foldables and tablets. For post-production, the new Media3 AI Effects library provides a single interface for premium features like Magic Eraser and Studio Sound, automatically optimizing for the device's hardware.

The pipeline is completed by CodecDB, offering chipset-specific encoding recommendations to eliminate export noise, and a new Scrubbing Mode in ExoPlayer for ultra-smooth seeking. Whether you’re compositing multi-asset edits with Media3 Transformer or using the streamlined CastPlayer API, these updates ensure a professional-grade experience with significantly less development overhead.

Low Light Boost and Magic Eraser in action

14: Increase app discovery and engagement on Google TV

Pointer remotes, which enable motion-controlled input, will be a future way for users to interact with Google TV as it unlocks faster user navigation. App developers can start declaring support for pointing input to ensure their apps are discoverable on future TVs with pointer remotes. Additionally, the Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement. It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. Get all the details in our blog.

15: Performance: the foundation of a great app experience

To help developers navigate memory limits in Android 17, we've launched a suite of optimization tools. The R8 Configuration Analyzer identifies keep rules that are bloating your binary, while ProfilingManager and the integrated LeakCanary in Android Studio streamline memory leak detection. Furthermore, the new Android Performance Analyzer offers advanced AI integration for complex trace analysis and automated SQL query generation to pinpoint performance bottlenecks.     

And The Latest on Driving Business Growth 

16: What’s new in Google Play

Today's updates from Google Play help expand your reach and scale your business with less complexity. We’re redefining Play Store discovery with an immersive, short-form video format called Play Shorts, while expanding your audience beyond the store with app discovery in the Gemini app on Android and web. Plus, we’re introducing powerful new capabilities like agentic catalog management for seamless bulk price and SKU updates, and using Gemini models to enable Play Console to pre-populate store listings from imported documents—making global localization effortless.

Gemini will provide users with app suggestions during a search

17: And of course, Android 17

Android 17 includes new performance & system architecture improvements (in addition to app memory limits) like a lock-free MessageQueue and a GC with more frequent, less intensive young-generation collections to ensure system-wide stability and smoother UIs. The new contact picker and eyedropper API help minimize the use of sensitive permissions and unnecessary access to user data.

Review the behavior changes to make sure your app is ready for Android 17, including background audio hardening and SMS OTP protection. Get ready to target Android 17 (API 37) with changes such as mandatory large-screen resizability, certificate transparency by default, and restricted local network access. You can start testing today by enrolling your device in the Beta or using the latest 17.0 emulator images.

One more thing. the third beta of our Android 17 quarterly platform release (QPR1) just came out, and it contains a minor SDK release to support a few features that just couldn't wait for QPR2.

Check out all of the Android & Play Content at Google I/O 

This was just a preview of some of the updates for Android developers at Google I/O. Tune into What’s New in Android for the latest news and announcements and follow Google I/O for much more over the following week!

]]> <![CDATA[Prioritizing Memory Efficiency: Essential Steps for Android 17]]> https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/ https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/ Sat, 25 Jul 2026 10:15:41 +0200 🤖 Android Tipps tsecurity.de
Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer

While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.

To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.

Beyond these forced terminations, unoptimized memory usage inevitably degrades the user experience. When the app approaches heap memory limits, it triggers frequent garbage collection—leading to noticeable UI stutters. Furthermore, when a device runs out of available memory, the system scrambles to reclaim pages, causing CPU strain, UI latency, and battery drain. If the memory shortage is too severe, it can cause Low Memory Killer (LMK) events that abruptly terminate background processes and force apps to have slow cold starts and lose user state.

To build highly performant apps and avoid these forced terminations, we recommend that you adopt the following memory optimization strategies:

  1. Maximize bytecode optimization with R8
  2. Optimize image loading
  3. Detect and fix memory leaks with Android Studio
  4. Trim memory when app leaves visible state
  5. Advanced memory observability with ProfilingManager

A condensed version of this blog post is also available in video format, go check it out!

Understanding Android 17 app memory limits

App memory limits are being introduced in Android 17 to prevent "one bad actor" from destroying the multitasking experience and stability of the user’s entire device.

Here is a breakdown of the reasons driving this architectural change:

  • Preventing cascading kills: When an app becomes bloated or leaks memory while holding a privileged state (e.g. it’s running a Foreground Service), it is initially shielded from the system's Low Memory Killer (LMK). As this single app grows unchecked and hoards RAM, the LMK is forced to compensate by killing off dozens of smaller, well-behaved cached apps and background jobs to reclaim space for the memory hog.
  • Preserving multitasking and user state: When the system is forced to purge cached apps to accommodate a single leaking process, the multitasking experience is severely degraded. Users returning to prior cached applications encounter sluggish cold starts instead of near-instant warm resumes. This inefficiency generates more CPU strain and accelerates battery depletion. It can also destroy the user’s context in recently used apps, such as scroll positions, navigation stacks, and in-game progress.

To determine if your app session was impacted by these constraints in the field, you can call getDescription() within ApplicationExitInfo. If the system applied a limit, the exit reason is reported as REASON_OTHER and the description string will contain "MemoryLimiter:AnonSwap". You can also leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached. Furthermore, Android is actively working to surface more in-field memory metrics to developers within the Google Play Console.

We have also expanded our memory limits documentation to include local debugging commands, allowing you to simulate memory constraints in your local environment and validate your application's behavior under any memory limit enforcement. 

Maximize bytecode optimization with R8

A highly effective way to reduce your app's memory footprint is to enable the R8 optimizer. By shrinking classes, methods, and fields into shorter names and stripping out unused code and resources, R8 significantly reduces your app's memory footprint by minimizing the amount of resident code required during execution. 

R8 minimizes resident code, shrinking the memory footprint and lowering LMK termination risk. This results in more frequent warm starts over slow cold starts. Additionally, streamlined bytecode reduces main-thread CPU overhead, directly cutting ANR rates for a more fluid user experience. For example, the digital bank Monzo enabled full R8 optimization and saw a 35% reduction in their ANR rate, a 30% improvement in cold start rate, and a 9% reduction in overall app size.

The digital bank Monzo enabled full R8 optimization and boosted performance metrics by up to 35%.

To properly configure R8 in your build.gradle file:

  • Set isShrinkResources = true and isMinifyEnabled = true.
  • Use proguard-android-optimize.txt instead of the legacy proguard-android.txt, which actually prevents optimizations and is no longer supported in Android Gradle Plugin 9.
  • Remove android.enableR8.fullMode = false from your gradle.properties.

If you are using reflection in your code base, then add Keep rules to prevent R8 from optimizing those parts of the code. Make sure to scope the keep rules narrowly to get the maximum optimization.

To get the maximum optimization, make sure to follow these best practices in your keep rule file.

  • Remove global options like -dontoptimize, -dontshrink, and -dontobfuscate that prevent R8 from optimizing the entire codebase 
  • Remove keep rules that prevent optimizing Android components like Activity, Services, Views or Broadcast receivers.
  • Refine the broad package wide keep rules to target only specific classes or methods.

To see more best practices, view our keep rules documentation.

Library Developer R8 Best Practices

If you are a library developer, strictly place the rules your consumers need into your consumer-rules file, and keep your library's internal protection rules in your proguard-rules.pro file. For more information on how to optimize libraries, see Optimization for library authors.

R8 Configuration Analyzer

To audit your R8 optimization, use the Configuration Analyzer. Configuration analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores. With configuration analyzer, you can also understand how many classes, methods or fields are prevented from optimization by each keep rule. Refine these broad package wide keep rules to unlock the maximum optimization.

Using configuration analyzer, you can also identify keep rules that are subsuming other keep rules, redundant keep rules and unused keep rules.

The Configuration Analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores.

R8 Agent Skill 

You can also leverage the R8 Agent Skill with Android Studio agent or other AI tools to resolve misconfigurations and refine your rules resulting in improved app performance. (Insights from AI-driven skills will require technical verification)

Optimize image loading

Bitmaps are usually the largest common objects residing in your app's memory. They represent the final stage of the image loading process where compressed files, like JPEGs or PNGs, are decoded into raw pixel data for display. This means a tiny 100KB compressed image can balloon into several megabytes of RAM because memory consumption is determined by the image's pixel dimensions and color depth. Since bitmap operations are frequently on the critical path to drawing frames, unoptimized images cause severe memory bloat and UI jank.

Google recommends leveraging image loading libraries Coil for Kotlin-first projects, particularly when developing with Jetpack Compose and Glide for Java-based applications.

Adopt these five best practices

  1. Downsample images: If you’re loading bitmaps manually, avoid loading a massive image into a tiny thumbnail view; use inSampleSize to load a smaller version. Glide and Coil downsamples images by default and you can configure this downsample strategy using DownsampleStrategy and ImageLoader respectively.
  2. Cropping: Avoid embedding padding directly into an image file for letterboxing purposes (e.g., creating a transparent border to expand an image dimensions). Rather than baking in these borders, utilize InsetDrawable or apply padding directly within the View or Composable containing the bitmap.
  3. Config: Balance memory and quality by choosing the right pixel format. Use RGB_565 when transparency isn't needed, which uses half the memory of the default ARGB_8888 format. In Glide you can configure this by using DecodeFormat and in Coil you can use bitmapConfig property.
  4. Prioritize vector drawables: For basic geometric assets, leverage ShapeDrawable as a lightweight alternative to decoding rasterized bitmaps. By defining these assets once via XML, you ensure they scale seamlessly across all display densities while effectively eliminating resource-driven memory bloat.
  5. Reuse: If your application manages Bitmaps manually then to minimize memory churn, when a bitmap is no longer required, the app should call bitmap.recycle() and immediately discard the Bitmap reference. If you use an image loading library like Glide or Coil, return the bitmap to the library’s managed pool. By providing an existing buffer for future memory needs, the pool effectively avoids the overhead of new allocations.

Check out our documentation on Optimizing performance for images to learn more.

Android Studio tooling

You can also eliminate redundant bitmaps using Android Studio Narwhal 4. Here is how to hunt them down in five simple steps:

  1. Open the Profiler tab in Android Studio
  2. Click Heap Dump (or "Analyze Memory Usage") and hit record to take a snapshot of your app’s current memory state.
  3. Scan the analysis results for the yellow warning triangle ⚠️, which Android Studio uses to flag duplicate bitmaps being stored multiple times. Alternatively, navigate to the profiler header, choose "Filter by:" and pick the "Duplicate Bitmaps" setting.
  4. Click on any flagged entry to open the Bitmap Preview pane, allowing you to see exactly which image is the repeat offender.
  5. Use that visual confirmation to track down the redundant loading logic in your code and implement a better caching strategy.
Look for the yellow warning triangle ⚠️ in heap dumps when using the Android Studio Profiler.

Detect and fix memory leaks with Android Studio

Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).

Android Studio Panda 3 features a dedicated LeakCanary profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.

The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.

LeakCanary memory leak analysis contextualized with Go to declaration for debugging

Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.

Examples of common memory leaks 

Memory leaks occur when an object persists in memory beyond its intended lifespan. This typically happens due to:

  • Retaining references to Fragments, Activities, or Views that are no longer in use.
  • Mismanaging Context references.
  • Failing to properly unregister observers, listeners, and receivers.
  • Creating static references to objects that are bound to components with shorter lifecycles.

Here are a few example scenarios:

Scenario

Compose-based example

View-based example

Leaking Context

Example:
Passing LocalContext.current to a ViewModel

Fix:
Keep Context dependent logic within the UI layer. For non-UI layers, refactor to use dependency injection or observe UI state using Kotlin flow.

Example:
Storing an Activity in a companion object or static variable.

Fix:
Don’t hold static references to UI components. Refactor to use dependency injection or observe UI state using Kotlin flow.

Leaking Listeners

Example:
Using DisposableEffect to start a listener but leaving onDispose empty.

Fix:
Perform the unregistration and cleanup logic inside the onDispose block.

Example:
Registering for SensorManager updates and forgetting to unregister.

Fix:
Manually call unregisterListener() in onStop() or onDestroy() lifecycle.

Leaking Views

Example:
Holding a reference to a legacy View inside an AndroidView without a release strategy.

Fix:
Use the release block of the AndroidView composable to clean up the legacy View.

Example:
Keeping a reference to a view binding object after the Fragment is destroyed.

Fix:
Set the binding variable to null inside the onDestroyView() lifecycle method.

Trim memory when app leaves visible state

Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in Overview of memory management. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.

If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the ComponentCallbacks2 interface. You can implement onTrimMemory in your Activity, Fragment, Service, or even your custom Application class. Using it in the Application class is highly effective for global cache management.

The provided onTrimMemory() callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.

In terms of memory lifecycle management, your implementation should focus exclusively on TRIM_MEMORY_UI_HIDDEN and TRIM_MEMORY_BACKGROUND. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.

TRIM_MEMORY_UI_HIDDEN: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.

TRIM_MEMORY_BACKGROUND: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.

import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}

Note: The onTrimMemory integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the game memory optimization documents.

Advanced memory observability with ProfilingManager

To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the ProfilingManager API. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.

For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to provide feedback.

Android 17 introduces new event-driven triggers, most notably TRIGGER_TYPE_OOM and TRIGGER_TYPE_ANOMALY:

  • The OOM trigger automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the registerForAllProfilingResults callback.
  • The Anomaly trigger detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.
  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer { profilingResult ->
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)

Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the Perfetto UI. To streamline your memory debugging workflow, use the Heap Dump Explorer, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.

Use the Heap Dump Explorer’s embedded flamegraph to visually inspect and navigate through objects with the highest heap allocations.

Conclusion

Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised memory guidance.

]]> <![CDATA[Build intelligent Android apps: Introduction to Jetpacker]]> https://tsecurity.de/de/3693498/android-tipps/build-intelligent-android-apps-introduction-to-jetpacker/ https://tsecurity.de/de/3693498/android-tipps/build-intelligent-android-apps-introduction-to-jetpacker/ Sat, 25 Jul 2026 10:15:26 +0200 🤖 Android Tipps tsecurity.de
Posted by Jolanda Verhoef, Senior Developer Relations Engineer, Android Developer Relations


Building GenAI features in your app usually means navigating through various models, APIs and architecture choices: 

  • Execution location: Where does your model run? On device, in the cloud, or both?
  • Complexity: How complex is your setup? Are you doing a single inference call or do you need a more agentic flow?
  • In-app or Android System: Should your feature be built into your Android app or does it fit better as an Android system integration?

In this blog post series we'll navigate these choices with you. We will take you along on a journey, starting with a basic mobile app and transforming it into a personalized, intelligent, and agentic experience.

Jetpacker: a demo travel app

Jetpacker is a technical showcase app that our team built from the ground up for this year's Google I/O (built using Antigravity). At its core, Jetpacker helps users plan, explore, and enjoy their next big adventure. It shows an overview of your trips, the itinerary of each trip, and details of each event on that trip. Of course following all best practices of Android development, including a beautifully expressive Material UI design.

And best of all? It's fully open source!

Today we are publishing a series of technical blog posts diving deep into each of these features. We’ll provide detailed implementation steps, code snippets, and architectural insights to help you build your own intelligent Android applications.

On-device intelligence

On-device features in Jetpacker: Summarizing trip itineraries, managing expenses, and voice notes

Using an on-device model comes with no additional cloud inference costs, means you don't have to worry about internet connectivity, and lets users be confident that private information will be processed locally, on the device, without any of their data being sent to the cloud.

In Jetpacker, we chose on-device inference for three of our features:

  • The trip overview feature transforms a messy, multi-day itinerary into a concise, actionable summary. It leverages Gemini Nano through the ML Kit GenAI APIs to process data locally on the device. We consider this a nice-to-have feature where we don't want to incur extra cloud costs, making on-device inference the right choice.
  • The expense tracker automatically extracts structured data from receipt images to help users track their travel spending. It uses the multimodal capabilities of Gemini Nano 4 through the ML Kit GenAI APIs. We choose an on-device solution so that any privacy-sensitive information on the receipt images never leaves the user's device.
  • The audio diary records, transcribes, and categorizes voice notes into relevant trip activities. It is powered by the ML Kit Speech Recognition and GenAI Prompt APIs. We chose an on-device solution for privacy and connectivity reasons.

Cloud & hybrid inference













Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and hotel support chat featuring custom-routed live translation.

Sometimes your use-case requires AI models with greater world knowledge or a much larger context window and with greater ability in handling complex tasks. In that case, we can switch from running an on-device model to using a cloud model instead.

Or, if you want to get the best of both worlds, you can use hybrid inference to dynamically choose either a cloud or on-device model at runtime. This allows us to lower costs by moving inference to the device when it is available, but at the same time support all Android devices running the app.

In Jetpacker, we implemented several features using cloud or hybrid inference:

  • The place Q&A feature answers user questions about specific locations by grounding responses in real-world data. It uses Firebase AI Logic integrated with Google Maps and web context. Using a cloud model is necessary here for its greater world knowledge.
  • The review drafting feature helps users compose detailed reviews for the places they have visited. It leverages both on-device and cloud models through Firebase AI Logic's new Hybrid inference API. This is a feature we wanted to make available to all app users, so we're using a cloud model as a fallback when an on-device model is unavailable.
  • The automatic chat translation dynamically translates chat messages in real time to facilitate seamless communication, demonstrating custom hybrid inference logic. Again, we want this feature to be available to all app users, but at the same time have some specific considerations on when to choose on-device versus cloud.

System integration

While not a feature you see in the app itself, the Android system integration opens up the app's core capabilities directly to the Android operating system. It uses the AppFunctions API to integrate with system-level intelligence.

In-app agentic workflows (coming soon!)

The booking assistant shows several in-progress flight bookings, asking the user for input before making a final booking.

Agenticness introduces a higher level of autonomy, enabling models to act as agents. Instead of a single inference call, an agent works towards a specific goal via an orchestration loop that allows it to reason, use tools, and adapt its path. Depending on your requirements, these intelligent agents can run either in the cloud, directly on-device, or in a hybrid setup.

For Jetpacker we added a booking assistant that automates end-to-end booking workflows directly within the application to streamline reservations. It is built using A2UI and ADK running in the cloud. The Android app functions as a front-end to the multi-agentic system running in the cloud.

Learn more

Check out the other parts of this blog post series:

Part 1 (this post!): Introduction of the app and a high-level overview.
Part 2: On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.
Part 3: Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.
Part 4: System integration. Integrating with the Android intelligence system using AppFunctions.
Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.

Interested in more on Android Development? Follow Android Developers on YouTube or LinkedIn!

]]> <![CDATA[Community Office Hours: Exchange Email Support]]> https://tsecurity.de/de/3693439/video/community-office-hours-exchange-email-support/ https://tsecurity.de/de/3693439/video/community-office-hours-exchange-email-support/ Sat, 25 Jul 2026 10:05:14 +0200 🎥 Video tsecurity.de Author: Mozilla Thunderbird - Bewertung: 15x - Views:697

Welcome to the last Community Office Hours of 2025! In this edition, Heather and Monica welcome Sr. Software Engineer Brendan Abolivier and Software Engineer Eleanor Dichary from the Desktop Team. We’re discussing the recent Exchange Web Support for email that just landed in Thunderbird Monthly Release 145. Learn how the team landed this feature and discover future plans for Calendar and Contact support, as well as Graph API

Chapters:
00:00 Intro
03:50 What is Microsoft Exchange
05:07 Why it took so long to add Exchange
14:33 Exchange in Thunderbird 145
18:20 Config options and authorization
27:10 Attachments and storage
32:30 Sync and folder operations
36:10 Filters and notification
39:10 Search
40:20 Feedback and bug reporting
43:00 Mobile and Graph API
49:09 JMAP and future protocols
55:50 Calendar and address book
59:57 Roadmap and EWS deprecation
62:23 Closing

Resources:
Exchange Mozilla Support Article: https://support.mozilla.org/en-US/kb/thunderbird-and-exchange
Exchange Mozilla Wiki Post (with call for testing): https://wiki.mozilla.org/Thunderbird%3AExchange
Reach out on Matrix: https://matrix.to/#/#thunderbird:mozilla.org
Bugzilla (use Exchange component for reporting): https://bugzilla.mozilla.org/enter_bug.cgi?product=MailNews%20Core

]]> <![CDATA[The Rust Programming Language Blog: Announcing Rust 1.96.0]]> https://tsecurity.de/de/3693296/tools/the-rust-programming-language-blog-announcing-rust-1960/ https://tsecurity.de/de/3693296/tools/the-rust-programming-language-blog-announcing-rust-1960/ Sat, 25 Jul 2026 08:37:36 +0200 💾 Tools tsecurity.de The Rust team is happy to announce a new version of Rust, 1.96.0. Rust is a programming language empowering everyone to build reliable and efficient software.

If you have a previous version of Rust installed via rustup, you can get 1.96.0 with:

$ rustup update stable

If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.96.0.

If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (rustup default beta) or the nightly channel (rustup default nightly). Please report any bugs you might come across!

What's in 1.96.0 stable

New Range* types

Many users expect Range and related core::ops types to be Copy, but this is not the case: they implement Iterator directly, and it is a footgun to implement both Iterator and Copy on the same type so this has been avoided. RFC3550 proposed a set of replacement range types that implement IntoIterator rather than Iterator, meaning they can also be Copy. The standard library portion of that RFC is now stable, introducing:

  • core::range::Range
  • core::range::RangeFrom
  • core::range::RangeInclusive
  • Associated iterators

A Rust version in the near future will also add core::range::RangeFull and core::range::RangeTo as re-exports from core::ops (these do not implement Iterator and already implement Copy), and core::range::legacy::* as the new home for the current ranges. Range syntax like 0..1 still produces the legacy types for now, but will be updated to core::range types in a future edition.

With these stabilizations, it is now possible to store slice accessors in Copy types without splitting start and end:

use core::range::Range;

#[derive(Clone, Copy)]
pub struct Span(Range<usize>);

impl Span {
    pub fn of(self, s: &str) -> &str {
        &s[self.0]
    }
}

The new RangeInclusive also makes its fields public, unlike the legacy version which avoided exposing the exhausted iterator state. This isn't a concern with the new type since it must be converted to begin iteration.

Library authors should consider making use of impl RangeBounds in public API, which accepts both legacy and new range types. If a concrete type is needed, prefer using new ranges as this will eventually become the default.

Assert matching patterns

The new macros assert_matches! and debug_assert_matches! check that a value matches a given pattern, panicking with a Debug representation of the value otherwise. These are essentially the same as assert!(matches!(..)) and debug_assert!(matches!(..)), but the printed value improves the possibility of diagnosing the failure.

These new macros have not been added to the standard prelude, because they would collide with popular third-party crates that provide macros with the same name. Instead, they should be manually imported from core or std before use.

use core::assert_matches;

/// [Random Number](https://xkcd.com/221/)
fn get_random_number() -> u32 {
    // chosen by a fair dice roll.
    // guaranteed to be random.
    4
}

fn main() {
    assert_matches!(get_random_number(), 1..=6);
}

Changes to WebAssembly targets

WebAssembly targets no longer pass --allow-undefined to the linker which means that undefined symbols when linking are now a linker error instead of being converted to WebAssembly imports from the "env" module. This change prevents modules from linking unless all linking-related symbols are defined to catch bugs earlier and prevent accidental issues with symbol naming or similar.

Undefined linking-related symbols are often indicative of build-time related bugs or misconfiguration. If, however, the old behavior is intended then it can be re-enabled with RUSTFLAGS=-Clink-arg=--allow-undefined or by editing the source code and using #[link(wasm_import_module = "env")] on the block defining the symbol.

This change was previously announced on this blog, and now takes effect in Rust 1.96.

Stabilized APIs

Two Cargo advisories

Rust 1.96 contains fixes for two vulnerabilities for users of third-party registries.

  • CVE-2026-5223 is a medium severity vulnerability regarding extraction of crate tarballs with symlinks.

  • CVE-2026-5222 is a low severity vulnerability regarding authentication with normalized URLs.

Users of crates.io are not affected by either vulnerability.

Other changes

Check out everything that changed in Rust, Cargo, and Clippy.

Contributors to 1.96.0

Many people came together to create Rust 1.96.0. We couldn't have done it without all of you. Thanks!

]]> <![CDATA[Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202]]> https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/ https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/ Sat, 25 Jul 2026 08:37:35 +0200 💾 Tools tsecurity.de Highlights
  • The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
    • This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
    • You will be able to manage this feature in Settings under Sync (for now)
      • Firefox settings page showing the Backup feature in dark mode. Backup is enabled, with details of the most recent backup and a “Backup now” button. The page displays the backup file name and a backup location folder path, along with “Choose…” and “Show in folder” buttons. A “Sensitive data” section includes an option to back up passwords and payment methods with encryption, and a disabled “Change password” button.
    • You can read more about the feature here
  • As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
  • Adaptive autofill has been enabled on Nightly.
    • Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
  • Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
    • dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
    • it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom
    • Firefox Responsive Design Mode on Desktop displaying the Mozilla homepage in a mobile viewport. The toolbar at the top shows a simulated Android device (including the dynamic toolbar) with a viewport size of 376 × 464 pixels and a device pixel ratio of 3. The page content is shown in French, featuring the Mozilla logo, a “Menu” link, a “Pause animation” button, and the headline “Bienvenue chez Mozilla” with accompanying text about trusted technology and digital rights.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

  • Amin Amir
  • aoia7rz7l
  • Chukwuka Rosemary
  • DrSeed
  • FrĂŠdĂŠric Wang NĂŠlar
  • japandi
  • John Iweh
  • jonathancabera
  • Josh Aas
  • Keji Bakare
  • kofoworola shonuyi
  • konyhĂŠa
  • liz
  • Mathew Hodson
  • Okhuomon Ajayi
  • Oluwatobi
  • ROSHAAN
  • Sam Johnson

New contributors (🌟 = first patch)

 

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons
  • In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014
    • NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes
WebExtensions Framework
  • Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173
    • Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!
  • Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329
    • Thanks to Simon Farre for promptly investigating and fixing this recent regression!
WebExtension APIs
  • Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125
    • Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!

DevTools

Fluent

  • We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!
  • Stacked area chart titled “Are We Fluent Yet?” showing the number and type of localization strings available in Firefox from 2018 to 2026. The chart tracks Fluent strings (green), Properties strings (blue), DTD strings (pink), and a small number of INI strings. Over time, Fluent strings steadily increase while DTD and Properties strings decline. A tooltip at April 26, 2026 shows 10,372 Fluent strings, 3,997 Properties strings, and no remaining DTD or INC strings, illustrating Firefox’s ongoing migration to the Fluent localization system.

Migration Improvements

New Tab Page

Search and Urlbar

  • Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
  • Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
  • Work also continues on the new Nova layouts.

Smart Window

  • uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect
    • jump to bottom of conversation 2028692
    • stop streaming button 2029204
    • back/forward navigation from assistant 2029229
    • dark mode for various chips 2024499
  • search engine switching from smart bar 2021973
  • Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

UX Fundamentals

  • The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
  • In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

]]> <![CDATA[Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204]]> https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/ https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/ Sat, 25 Jul 2026 08:37:31 +0200 💾 Tools tsecurity.de Highlights

Firefox context menu video controls like Pause, Unmute, Speed and Loop.

Tooltip in Firefox DevTools for mismatched syntax with attr()

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

  • Sam Johnson
  • Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons
  • As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767
WebExtensions Framework
  • Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
  • Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054
    • Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.
WebExtension APIs
  • Fixed handling of <all_urls> as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

WebDriver

Lint, Docs and Workflow

New Tab Page

Picture-in-Picture

Performance Tools (aka Firefox Profiler)

  • Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.

Search and Urlbar

Nova UI refresh
Suggest
  • Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
  • 2040561, 2039753, 2035614, 2038843
Adaptive autofill
  • James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
  • 2040819, 2037177
Quick actions
  • Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
  • Caleb added Calculator support for certain unicode operators.
  • 2023169, 1928635, 1923383, 2033861
Multi Context Address Bar
  • Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
  • 2039297, 2036095, 2039844, 2037933, 2030050
Other
Search
  • Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
  • Caleb fixed multiple documentation issues and added a test covering searches from a private window.
  • 1904613, 2035878, 2037942, 2033545, 2005724
Places
  • Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
  • Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
  • 2039534, 1505800, 2008829, 2029541, 2035084
]]> <![CDATA[The Rust Programming Language Blog: crates.io: development update]]> https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/ https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/ Sat, 25 Jul 2026 08:37:18 +0200 💾 Tools tsecurity.de Another six months have passed since our last development update, and the crates.io team has been busy. Here's a summary of the most notable changes and improvements made to crates.io since then.

Source Code Viewer

Crate pages now have a "Code" tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that cargo downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized Cargo.toml files that cargo generates.

Source code viewer showing the "Code" tab of the serde crate

The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable #L10-L20 URLs.

Under the hood, the server now builds a zip file for every published version. Since the .crate files that cargo consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too.

The rendering library behind the code viewer is a diff renderer at heart, and that's no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned!

Untangling crates.io Accounts from GitHub

At the end of May, the crates.io team accepted RFC #3946. Crates.io accounts always have been tightly coupled to GitHub: signing in means "Log in with GitHub", and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers.

The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps.

Advisories and Suggestions

In our January update we introduced the "Security" tab, which shows security advisories from the RustSec database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to Dirkjan Ochtman for implementing this feature!

Unmaintained warning banner on the ansi_term crate page

Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like lazy_static, which has been superseded by std::sync::LazyLock since Rust 1.80. Crate pages of such crates now show a friendly "You might not need this dependency" banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint.

"You might not need this dependency" banner on the lazy_static crate page

The dataset behind this feature lives in the new rust-lang/std-replacement-data repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable std, core, or alloc API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too.

Ferris

The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes:

Ferris' eyes following the mouse cursor on the error page

Getting a 404 error on crates.io is now slightly less sad.

Svelte Frontend Migration Completed

In our January update, we announced that we were experimenting with porting the crates.io frontend from Ember.js to Svelte. This experiment has concluded successfully: the new frontend reached feature parity, went through a public testing phase in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository.

We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates.

We want to thank the Ember.js team for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable.

Miscellaneous

These were some of the more visible changes to crates.io over the past six months, but a lot has happened "under the hood" as well:

  • Search performance: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts.

  • Reverse dependencies performance: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error.

  • New ARCHITECTURE.md: If you've ever wondered how crates.io actually works, our ARCHITECTURE.md document got a complete rewrite. It is now organized around the high-level systems that make up crates.io and how they fit together, and includes walkthroughs of what happens when you run cargo publish, why a typical crate download never touches our API servers, and how download counts are derived from CDN access logs.

  • Definition lists: READMEs now render Markdown definition lists, a widely used Markdown extension. Our markdown renderer comrak already supported them, the extension just wasn't enabled yet. Thanks to @mistaste for this contribution!

  • CDN cache tags: Files uploaded to our static CDN now carry cache-tag metadata, allowing us to invalidate all cached files of a crate or a specific release in a single operation, instead of issuing one invalidation per file URL.

  • Caching improvements: We removed a global Vary: Cookie response header that was preventing our CDNs from caching public API responses and frontend assets effectively. Per-user responses now use Cache-Control: no-store instead, resulting in better cache hit rates at the CDN edge.

  • Accessibility: We have made crates.io friendlier to screen readers: decorative icons are now hidden from the accessibility tree, heading hierarchies have been fixed, and lists are marked up as proper lists. ARIA snapshot tests now ensure that regressions can't slip in unnoticed. We plan to continue to improve crates.io accessibility over the coming months.

  • Git index performance: The background worker's local clone of the git index is now a bare and shallow repository, eliminating roughly 250,000 checked-out files and the full commit history from its disk, improving its performance as we see increased rates of crate publication. The periodic index squashing now goes through the GitHub API instead of generating large git packs locally, which had previously caused out-of-memory failures on the production worker.

Feedback

We hope you enjoyed this update on the development of crates.io. If you have any feedback or questions, please let us know on Zulip or GitHub. We are always happy to hear from you and are looking forward to your feedback!

]]> <![CDATA[Matrix 2.0 — How we're making Matrix go voom!]]> https://tsecurity.de/de/3693271/videos/matrix-20-how-were-making-matrix-go-voom/ https://tsecurity.de/de/3693271/videos/matrix-20-how-were-making-matrix-go-voom/ Sat, 25 Jul 2026 08:36:49 +0200 🎥 Videos tsecurity.de Author: Matrixdotorg - Bewertung: 395x - Views:15995

NOTE: we'll update the FOSDEM 2023 playlist as we gather all the talks. Stay tuned for more Matrix content.

This video was recorded during FOSDEM 2023, and can also be found here: https://fosdem.org/2023/schedule/event/matrix20/

Matrix is an open standard for secure, decentralised communication, which may be familiar from powering the online editions of FOSDEM in 2021 and 2022 (and hybrid-FOSDEM this year!).

In this talk we will explain the fundamental changes which are landing in Matrix 2.0, which speeds up Matrix to be at least as snappy as the fastest proprietary messaging apps - all while handling thousands of rooms spanning millions of users.

During 2022 we've been on a mission to completely rework the slowest bits of Matrix, aiming that nobody can ever complain about Matrix being sluggish again. In practice this means fundamental changes in:

- How Matrix syncs data - "sliding sync", where servers only sync the bare minimum data to clients required to render the UI, providing instant login and instant sync (MSC3575)

- How room joins work over federation - "faster joins", where servers only sync the bare minimum data such that clients can start participating in the room as soon as possible (MSC3902)

- How auth works - switching Matrix to use OIDC natively for all authentication, registration and account management (MSC3861)

- How VoIP works - switching Matrix to natively support multiparty decentralised E2EE VoIP as the primary calling mechanism (MSC3401 and MSC3898)

The end result is transformational, and by far the biggest change to Matrix since the project began in 2014. So, we're calling it Matrix 2.0, and this talk will give a guided tour of everything that's changed - and show off the new reference matrix-rust-sdk client SDK, which powers the new flagship mobile Matrix client, codenamed Element X.

00:00 Hello!
00:41 Matrix and its ecosystem
06:33 Spec update
08:10 Matrix is taking over the world
09:26 Demo: Element X is blazing fast
13:25 Behind the scenes of the demo
15:02 How sliding sync works
21:20 One matrix-rust-sdk to rule them all
23:45 Faster remote room joins
25:12 MatrixRTC, Element Call, Matryoshka Widgets
26:37 Demo: Element Call!
28:34 Demo: raiding Element Call with waterfall — Selective Forwarding Units for Matrix
31:02 OpenID Connect: authentication done right
32:04 The future: Digital Markets Act, MIMI, MLS, P2P Matrix
36:32 Demo: P2P Matrix
40:31 Demo: ThirdRoom — Matrix beyond chat and voice
47:16 What's next?

Support Matrix!
🪙 Donorbox for individuals - https://donorbox.org/keep-matrix-exciting
💶 Matrix Foundation (paid) membership for orgs - https://forms.gle/Yy345QkB5pifJJNy6

(This Week in) Matrix
🐘 https://mastodon.matrix.org/@matrix
🐦️ https://twitter.com/matrixdotorg
[m] https://matrix.to/#/#thisweekinmatrix:matrix.org

]]> <![CDATA[7 CRM trends for 2026: AI brings decisive action to customer workflows]]> https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/ https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/ Sat, 25 Jul 2026 06:53:15 +0200 📰 IT Nachrichten tsecurity.de

Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of customer relationship management (CRM), the platform that manages sales, marketing, and customer service.

“Last year, everybody was dipping their toes into the water,” says Keith Kirkpatrick, research director at The Futurum Group. This year, agentic AI has built momentum from the boardroom down, with companies recognizing that having an AI strategy is imperative. “They feel like if they don’t embrace it now, their competitors will.”

Harry Datwani, a principal at Deloitte Digital, adds that enterprise CRM customers have transitioned from “proof of concept” to “scale and execution.”

“Across sales, service, marketing, even in the commerce space, enterprises are really using AI and agentic,” he says.

“CRM in 2026 is undergoing a structural shift, not just an incremental evolution,” says Forrester analyst Kate Leggett, noting that AI is becoming a core part of CRM infrastructure, not just a feature or an add-on. According to Forrester data, around 70% of companies are already using AI in their CRM systems, she says.

Here are the hot AI-driven trends in CRM this year.

CRM becomes an action hero

CRM platforms have traditionally served as passive, static systems of record. Now, agentic AI is transforming CRM into a powerful, real-time solution that can act autonomously.

“Organizations that rethink CRM as a real-time, AI-powered system of action — and embrace agentic AI to handle complex, unpredictable work — are better positioned to deliver exceptional customer experiences,” says IDC analyst Neil Ward-Dutton. “This approach not only enhances satisfaction and loyalty but also drives operational efficiency and business agility.”

Forrester’s Leggett says that AI-powered CRM platforms have advanced from simple data capture to real-time decision-making and execution. Standard capabilities include next-best action recommendations, call summaries, automated updates, generated emails, knowledge creation, predictive forecasting, and deal scoring.

She adds that AI agents can now execute workflows, such as routing cases, sending follow-ups, and updating records (with human oversight). They can also handle end-to-end service and sales tasks autonomously, including case resolutions and sales development activities.

Agentic drives workforce changes

AI use in CRM systems is also impacting workforce strategies.

“We used to hire for deep expertise,” says Constellation Research analyst Liz Miller. “AI has commoditized expertise because I can take all that data from my CRM and train my AI models to go deep, to know everything about any product I’ve ever sold, from what has worked, what hasn’t, every price, every sale.”

Now, instead of hiring candidates with deep expertise, organizations are looking for candidates who can go wide. “I can train a model to have deep expertise. What I can’t train for is experience, because experience is what happens when a person has gone broad across a lot of different scenarios and faced complexity across that broad scenario,” says Miller.

For example, AI systems can automate many aspects of marketing, Miller notes, but there’s no substitute for creativity: people who can interrogate the data and come up with innovative marketing campaigns that connect with customers.

Terence Chesire, group vice president of ServiceNow CRM and industry workflows, says that organizations are using agentic AI to free up team members from repetitive, lower-value activities. Those employees have now moved to higher-level roles “where they’re working on transformational deals rather than just building a spreadsheet.”

“That’s what we’re seeing as super-exciting as organizations not just free up people, but the speed and effort reduction and the friction reduction in what they can do,” he adds.

Data layer takes center stage

AI’s promise to deliver actionable customer and marketing intelligence has placed even greater emphasis on the importance on sound data management practices for CRM.

“The light bulb has flashed on very brightly for our clients,” says Deloitte’s Datwani. “Everyone is talking about AI agents, but your ability to really extract value is inextricably linked to the quality of your data and the ability to make that data accessible. What we’re finding is that despite large investments over time our clients still have fragmented data. And so, they are data rich and insight poor.”

The good news, says Datwani, is that AI agents themselves can help clean up and organize data. And vendors such as Snowflake and Databricks, along with the traditional CRM powerhouses, are offering powerful data analytics solutions. “Everyone is battling for that data layer,” Datwani says.

Forrester’s Leggett adds that CRM platforms are converging with customer data platforms (CDPs), real-time event streams, and external data sources to create connected customer data networks. These real-time, connected data models can help organizations deliver hyper-personalization at scale.

Agentic ushers in pricing complexity

The shift from license- or subscription-based pricing to an outcome or consumption pricing model has the potential to help CIOs tie their CRM costs to specific business metrics, such as the number of customer service calls resolved per hour. But it has also introduced a new level of complexity when it comes to budgeting for CRM costs.

For example, Chesire says ServiceNow’s CRM pricing plan starts with a baseline subscription model, and on top of that, customers get a certain number of AI tokens per user and can buy additional tokens as AI usage ramps up.

Meanwhile, Salesforce has rolled out pay-per-resolution pricing with its recently unveiled AI Help Agent and last month acquired usage-based billing specialist m3ter. Oracle is also piloting outcome-based AI pricing.

All these approaches undercut the predictability of the subscription model, which will complicate CIOs’ cost calculus, Deloitte’s Datwani says. “Now, as you start to think about consumption and tokens, costs might look different. As folks are opening up the architecture with things like headless CRM, what will the cost model look like for API calls or MCP server calls? So, there’s many more variables,” he adds.

The rise of multi-agent orchestration

To act autonomously, agents need to access multiple data sets and software platforms seamlessly. As a result, the proliferation of agents, some embedded within specific vendor platforms and some created in-house, is going to require an orchestration layer, Futurum’s Kirkpatrick says.

He points out that organizations need to monitor and manage agents, enforcing the same type of policy-based access control that exists for people. Organizations also need to set limits on what domains a specific agent can get into, what types of data they can access, what lines can’t they cross.

Kirkpatrick predicts that a new class of orchestration tools will emerge, although it’s not clear whether that orchestration layer will be provided by the leading CRM vendors, hyperscalers, or third parties.

Datwani agrees. “The orchestration layer is an interesting area, where the traditional vendors are in on it, the hyperscalers are also offering it, and there are third parties. It’s my belief that there’s not going to be a clear winner.”

The interface becomes conversational

Enterprise users who have traditionally had to manually wrangle with CRM systems are likely to find the ability to employ voice commands using a natural language interface to be a game changer. For starters, a salesperson can say, “I have a meeting today with Customer X. Help me prepare.” The agent will collect relevant data, ingest it, and provide a summary with recommendations.

ServiceNow’s Chesire says voice-enabled CRM systems have an “almost magical” ability to record, transcribe, and understand the content of a call between a salesperson and a customer or potential customer. The system can then “build a quote” based on that conversation.

On the customer service side of the equation, AI-driven voice technology enables customers to speak to an AI agent, describe the problem using natural language, and get a response. The agent has the capability to, for example, solve a credit card dispute, order a replacement product, send out a service rep, or do whatever is needed to resolve the issue, says Chesire.

Beyond that, agentic technology is capable of understanding the underlying business process flaws that led to the product snafu, and make recommendations for ways to fix whatever led to the issue in the first place, he adds.

Agentic drives business process transformation

With the emergence of outcome-based pricing, organizations are taking a fresh look at how they measure the benefits of CRM systems. That conversation is leading to an even more important analysis of underlying business processes. Or, as Constellation’s Miller says, “The old adage of applying new technology to old processes only gets you more expensive old processes.”

“When we survey customers, we hear time and time again that the reason why they want to apply AI into their organizations is to foster exponential opportunity and exponential growth,” she says. “How do we get there with CRM has started to become the new conversation.”

According to Miller, AI systems breach the walls of siloed data and can take a fresh look at legacy workflows. They also don’t get sucked into turf wars between marketing and sales teams. As a result, they often recommend new actions that can lead to better processes. “I think it’s starting to happen. You’re starting to see applications where AI is beginning to accelerate decision-making and decision velocity,” she says.

“The next phase of maturity is going to be, how do we start to spread AI across our platforms so that we are seeing that holistic end-to-end relationship that we have always wanted to optimize. How do we thread that across platforms and across solutions. We’re starting to see organizations on the leading edge really start to pull those strategies together,” says Miller.

]]> <![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]> https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ Sat, 25 Jul 2026 06:16:50 +0200 📰 IT Nachrichten tsecurity.de

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

  • As complexity and regulation increase, organizations invest in more security products.
  • More products create more complexity.
  • More products and greater complexity generate more alerts.
  • More alerts require more analysts.
  • More analysts produce more reports.
  • More reports continue to build up executive confidence.
  • Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

  • Artificial intelligence, autonomous agents and machine identities
  • Software supply chain complexity.
  • Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[v1.18.5]]> https://tsecurity.de/de/3692688/downloads/v1185/ https://tsecurity.de/de/3692688/downloads/v1185/ Sat, 25 Jul 2026 00:31:21 +0200 💾 Downloads tsecurity.de Core

Bugfixes

  • Improve Claude adaptive thinking handling across more response shapes.
  • Avoid OpenAI Responses phase handling that could break some conversations.
  • Preserve grep symlink paths in search results. (@remixz)
  • Preserve Mistral reasoning history across turns.
  • Stabilize Mistral prompt caching.
  • Use the correct prompt cache keys for each SDK.
  • Fix MiniMax M3 thinking variant selection.

Desktop

Improvements

  • Support the current server terminal transport.
  • Support current-server review data in the desktop app.
  • Update server discovery flows for current servers.
  • Support current-server session actions, including prompts and commands.
  • Render current-server session timelines.
  • Stream current-server events in the desktop app.
  • Detect legacy and current servers so the desktop app can work with both.

Bugfixes

  • Restore optimistic timeline updates while responses are still streaming.
  • Hide legacy-only features when connected to current servers.
  • Preserve inline file mentions when sending prompts to legacy servers.
  • Stop auto-accepting config permissions on current servers.
  • Keep current servers out of the legacy layout.
  • Show plain file contents in file-specific tabs instead of review diffs.
  • Keep the prompt input agent toggle in sync.
  • Keep paginated session timelines in the right order.
  • Restore directory-scoped session status for legacy servers.
  • Reload legacy session progress after hydration.

Thank you to 2 community contributors:

  • @dleopold:
    • fix(app): classify existing web profiles for layout transition (#38117)
  • @remixz:
    • fix(opencode): preserve grep symlink paths (#38581)
]]> <![CDATA[Fantastical 4.1.17]]> https://tsecurity.de/de/3692341/ios-mac-os/fantastical-4117/ https://tsecurity.de/de/3692341/ios-mac-os/fantastical-4117/ Fri, 24 Jul 2026 21:03:00 +0200 🍏 iOS / Mac OS tsecurity.de Fantastical 4.1 iconBrings added emoji functionality and improved sync reliability for shared iCloud calendars. ($57 annual subscription, free update, 73.3 MB, macOS 12+)

macOS Hidden Treasures: Copy and Paste

]]> <![CDATA[Model Context Protocol is going stateless to make scaling simpler]]> https://tsecurity.de/de/3691919/ai-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ https://tsecurity.de/de/3691919/ai-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ Fri, 24 Jul 2026 17:40:37 +0200 🔧 AI Nachrichten tsecurity.de

Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.

The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.

“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said Muskan Bandta, cloud associate at ZopDev.

“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.

Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.

“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.

This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to Amit Jena, AI development manager at IT consulting firm Kanerika.

Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.

It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.

MCP’s new features

Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.

Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.

Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.

They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.

MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.

Rebuilding the trust boundary

The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.

The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.

“Sampling let MCP servers invoke the LLM through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”

The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”

Updated MCP SDKs

To accompany the protocol update, there are updated MCP SDKs for Python, Typescript, Go, and C#. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.

That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.

Identifying and auditing those session dependencies may not be easy, Jena warned.

“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.

]]> <![CDATA[Model Context Protocol is going stateless to make scaling simpler]]> https://tsecurity.de/de/3691907/it-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ https://tsecurity.de/de/3691907/it-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/ Fri, 24 Jul 2026 17:38:35 +0200 📰 IT Nachrichten tsecurity.de

Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.

The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.

“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said Muskan Bandta, cloud associate at ZopDev.

“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.

Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.

“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.

This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to Amit Jena, AI development manager at IT consulting firm Kanerika.

Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.

It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.

MCP’s new features

Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.

Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.

Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.

They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.

MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.

Rebuilding the trust boundary

The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.

The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.

“Sampling let MCP servers invoke the LLM through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”

The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”

Updated MCP SDKs

To accompany the protocol update, there are updated MCP SDKs for Python, Typescript, Go, and C#. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.

That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.

Identifying and auditing those session dependencies may not be easy, Jena warned.

“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.

This article first appeared on InfoWorld.

]]> <![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]> https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ Fri, 24 Jul 2026 12:09:02 +0200 📰 IT Security Nachrichten tsecurity.de

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

  • As complexity and regulation increase, organizations invest in more security products.
  • More products create more complexity.
  • More products and greater complexity generate more alerts.
  • More alerts require more analysts.
  • More analysts produce more reports.
  • More reports continue to build up executive confidence.
  • Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

  • Artificial intelligence, autonomous agents and machine identities
  • Software supply chain complexity.
  • Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[The Microsoft agent framework wars are over. The real architecture decision starts now]]> https://tsecurity.de/de/3691079/ai-nachrichten/the-microsoft-agent-framework-wars-are-over-the-real-architecture-decision-starts-now/ https://tsecurity.de/de/3691079/ai-nachrichten/the-microsoft-agent-framework-wars-are-over-the-real-architecture-decision-starts-now/ Fri, 24 Jul 2026 11:04:58 +0200 🔧 AI Nachrichten tsecurity.de

Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?

At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the foundation for enterprise AI, and picking the wrong one felt like an expensive mistake. I spent a lot of time helping teams weigh the trade-offs.

Looking back, I think we were asking the wrong question. I certainly was.

I watched teams spend months debating SDKs while the decisions that actually decided whether their applications survived production went unexamined. Some built elaborate orchestration layers for workflows that a few deterministic functions would have handled. Others avoided agent frameworks entirely and later found they’d designed themselves into a corner.

Then Microsoft settled it for us. It introduced the unified Agent Framework, quietly moved Semantic Kernel and AutoGen into maintenance mode, and the debate I’d spent months refereeing was suddenly over. Turns out the answer to “which of the three” was “none of the three, here’s a fourth.” The framework hit version 1.0 and general availability in April 2026, stable across .NET and Python.

What surprised me wasn’t the decision. It was how fast a debate that had eaten so much of our attention stopped mattering. Microsoft changed the menu.

It didn’t change the meal.

The framework was never the hard part

Framework selection dominated almost every early conversation I had about enterprise agents. Which SDK do we standardize on? Which orchestration model gives us the most flexibility? Which one is Microsoft actually betting on?

Fair questions. But after a year of watching these projects play out, I’ve slowly come around to a different view. Those weren’t the questions that decided anything.

The first question I ask now is much smaller. Does this thing actually need an agent?

It sounds obvious, and I still get it wrong sometimes. But it’s the mistake I see most. On one project, a team spent weeks designing a multi-agent workflow for a process that ran the same four steps every time: read a document, validate it, call an API, send a notification. The diagrams looked great. The system in production didn’t. A few well-tested functions would have been easier to build, easier to maintain and a lot easier to trust.

Part of this is just that “agent” has become the word everyone reaches for. Sometimes it’s the right call. Sometimes it’s a workflow we already knew how to build, wearing a newer label. An agent earns its complexity when it genuinely has to decide things you can’t predetermine, choosing between tools, adapting to what it finds, working out its own next step. If you already know every step, you have a workflow, and a workflow is usually the better engineering choice. The consolidation didn’t change that. It just made it easier to see.

What building production agents actually taught me

Once I stopped fixating on frameworks, the same three problems kept showing up. None of them had anything to do with the SDK.

Context beats model choice

Early on I spent a lot of time comparing models, the way you’d agonize over a restaurant menu and then order what you always order. Now I spend most of it thinking about context, which is far less fun and far more useful.

I’ve watched good models fail because they were handed too much, not too little. One team I worked with gave the model access to nearly every internal document they had on the theory that more information meant better answers. It went the other way. Responses got slower, less consistent and sometimes skipped right past the thing that actually mattered. When we cut the context down to only what the task needed, the quality jumped almost immediately. I didn’t predict that. It taught me to be suspicious of “just give it everything.”

The best agent systems I’ve worked on weren’t the ones with the biggest context windows. They were the ones careful about what reached the model, and when. That’s not something the framework hands you.

Failure is where the real work is

Most agent demos look great because they’re built around the happy path. Production doesn’t extend that courtesy.

I remember a project where everything held up in testing. Then a downstream API timed out after the agent had already completed several earlier steps. We couldn’t just restart, because part of the business process had already gone through. We ended up spending far more time on recovery logic than we ever spent on prompts. That project changed how I think about this work. The hard part was never getting the model to make a decision. It was making sure the system didn’t fall apart when reality refused to follow the script.

Tool calls fail partway through. APIs return inconsistent data. Models call the same tool over and over because the last answer wasn’t what they wanted. That’s not the exception; that’s a normal Tuesday. Whether you retry, roll back, pause for a human or push on with partial results is a judgment call, and no framework is going to make it for you.

Identity is the real security boundary

This one surprised me most. The moment an agent stops being a chatbot and starts touching real business systems, identity matters more than orchestration.

Every project gets to the same question eventually. Who is this agent actually acting as? The developer’s credentials? A service account? The user who asked? Get it wrong and you’ve built something autonomous running with more access than any single person should have, which is exactly the kind of thing that looks fine until an audit. The Agent Framework, like most modern tooling, makes it easier to wire agents to tools through standards like the Model Context Protocol. That helps. But where human approval belongs, what needs extra authorization, how much rope to give the thing, those are still yours to decide.

The surprises weren’t technical

Here’s what I didn’t see coming. The hardest part of last year wasn’t technical at all. It was organizational. The moment a team heard “agent,” expectations shifted under everyone’s feet. Business stakeholders started expecting full autonomy. Developers assumed the thing could reason its way through anything. People started designing for flexibility before we’d even agreed on what problem we were solving. The word did damage before any code did. I found myself spending as much time resetting expectations as I did discussing architecture.

Build for change, not for today’s winner

I don’t think the teams that struggled last year picked the wrong framework. Semantic Kernel was reasonable. AutoGen was reasonable. Foundry made sense for plenty of cases. I’d have signed off on any of them.

The ones that got hurt put all their eggs in one framework, treating it as the foundation of the whole system instead of as one more dependency. Microsoft provided a migration path. But teams that had tightly coupled their applications to framework-specific abstractions discovered that migrating and rewriting are not the same thing. That wasn’t Microsoft’s doing. It was their own architecture’s. The teams that moved easily had kept their business logic, prompts and orchestration loose enough to evolve independently of any one SDK. For them, the change was a manageable project, not a teardown.

For what it’s worth, nobody I work with is treating this as an emergency. Most are moving the smaller workloads first, watching how they behave and leaving the production-critical systems alone until they actually understand the new abstractions. That’s the right instinct. And I doubt this is the last consolidation we’ll see, the ecosystem is still young, frameworks will keep absorbing each other and over time the differences between them will be operational more than architectural.

I don’t regret the framework debates, honestly. They were reasonable at the time. What changed wasn’t Microsoft’s roadmap.

It was mine. Watching these systems run in production taught me that the framework is the easiest piece to swap out. Recovery logic, context management, security boundaries, the business workflow itself, those stay with you long after today’s SDK gets replaced by tomorrow’s.

So, Microsoft made one decision easier by turning three frameworks into one. Good. Five years from now we’ll be on different tools, and we’ll still be asking the same handful of questions.

Does this actually need an agent? Does it have the right context? Can it recover when something breaks, because something will? Is it acting as the right person?

Those questions outlast every rewrite. That’s where I’ve learned to put my effort.

Frameworks come and go. Good architecture has to survive all of them.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[2.7.11: Backport security fixes to release/2.7 (#41155)]]> https://tsecurity.de/de/3690494/downloads/2711-backport-security-fixes-to-release27-41155/ https://tsecurity.de/de/3690494/downloads/2711-backport-security-fixes-to-release27-41155/ Fri, 24 Jul 2026 02:33:47 +0200 💾 Downloads tsecurity.de
  • Bump Microsoft.NETCore.App.Runtime to 10.0.8 (CVE-2026-32175) (#40581)

    • Fixes Dependabot alerts #24 and #25.

    Co-authored-by: Ben Hillis benhillis@microsoft.com
    Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
    (cherry picked from commit 09a8afe)

    Bumps Microsoft.RemoteDesktop.Client.MSRDC.SessionHost from 1.2.6676 to
    1.2.7214. This closes CVE-2026-32157 (a use-after-free RCE in the Remote
    Desktop client, first fixed in 1.2.7099) along with several additional
    CVEs shipped in 1.2.7214.

    Fixes #40868

    Co-authored-by: Ben Hillis benhill@ntdev.microsoft.com
    Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
    (cherry picked from commit 2a7269e)

    Bumps Microsoft.NETCore.App.Runtime.win-x64 and win-arm64 from 10.0.8 to
    10.0.9 to address CVE-2026-45491 (.NET tampering vulnerability), reported
    by Dependabot. Both runtime packages are bumped together to keep the
    .NET runtime version in sync across architectures.

    Co-authored-by: Ben Hillis benhill@ntdev.microsoft.com
    Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
    (cherry picked from commit 73a6afb)

    Co-authored-by: Ben Hillis benhillis@microsoft.com
    Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
    Co-authored-by: Ben Hillis benhill@ntdev.microsoft.com

    ]]>         <![CDATA[The Hidden Risk of Patch Priorities]]> https://tsecurity.de/de/3690351/it-security-video/the-hidden-risk-of-patch-priorities/ https://tsecurity.de/de/3690351/it-security-video/the-hidden-risk-of-patch-priorities/ Fri, 24 Jul 2026 00:21:27 +0200 🎥 IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:1

    Patch management isn't just about fixing the highest number of vulnerabilities. Upgrade complexity, deployment time, and the actual severity of the vulnerabilities all influence what should be patched first.

    A massive upgrade may eliminate thousands of CVEs but consume weeks or months of effort while providing relatively little reduction in real-world risk. Organizations need context—not just vulnerability counts—to prioritize effectively and make the best use of limited resources.

    When security teams have limited time and staff, should they prioritize the biggest vulnerability count, or the patch that delivers the greatest reduction in actual risk?

    Subscribe to our podcasts: https://securityweekly.com/subscribe

    #PatchManagement #VulnerabilityManagement #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

    ]]>         <![CDATA[New pip flag fixes longstanding Python frustration]]> https://tsecurity.de/de/3690075/ai-nachrichten/new-pip-flag-fixes-longstanding-python-frustration/ https://tsecurity.de/de/3690075/ai-nachrichten/new-pip-flag-fixes-longstanding-python-frustration/ Thu, 23 Jul 2026 21:27:38 +0200 🔧 AI Nachrichten tsecurity.de

    A new version of Python’s native package management tool, pip, will remove a limitation that has frustrated Python developers for years. If you wanted to install the dependencies for a given package, but not install the package itself, you were stuck. Either you had to extract the dependency list from the package and install it by hand, or you had to build the whole package anyway.

    Why was this a problem? Sometimes, you want only the dependencies for a package—for instance, as a way to create a separate environment for testing or another project. If you’re making source distributions via CI, some requirements might be needed to make the source distribution but aren’t actually included in it (e.g., Cython). You would need to install these requirements somewhere—apart from the project itself—to perform the build step.

    A dependencies-only install mode for packages is a long-requested feature. Developer James O’Claire found many examples of such requests, along with various workarounds. Most of those involved third-party solutions of some sort.

    Now, a new feature set to land in pip version 26.2 will fix this problem from the inside. The command pip install --only-deps will install only the dependencies for a given package. Note that it will not install build dependencies for the package, but only runtime dependencies.

    Note that you can accomplish this with existing third-party tools. For instance, uv sync --no-install-project has the same behavior. But having this functionality right inside pip means you don’t have to turn to external tooling—or ugly hacks—to solve the problem. This may be an example of how third-party projects like uv (a superfast Python package installer) are inspiring native Python features where they make sense.

    pip 26.2 is scheduled to be released by the end of July 2026.

    ]]>         <![CDATA[Black Forest Labs launches FLUX 3 capable of generating images and 20-second video with audio — but in limited release to start]]> https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/ https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/ Thu, 23 Jul 2026 20:48:22 +0200 📰 IT Nachrichten tsecurity.de Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with today's launch of FLUX 3, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture to robotic vision and actions.

    The Freiburg, Germany-based AI lab says FLUX 3 is jointly trained across those modalities rather than assembling separate image, video and audio models behind a common interface.

    That distinction is central to the company's pitch: BFL wants enterprises to think about creative generation, simulation, computer use and robotics as connected applications of a single capability it calls visual intelligence — models, in the company's words, "that can perceive, predict, and act across physical and digital environments." This release marks BFL's first public video generation model.

    FLUX 3 will be offered through four product lines: FLUX 3 Video, FLUX 3 Image, FLUX 3 Action and the upcoming, open source FLUX 3 Dev. FLUX 3 Video, with optional native audio generation, and FLUX 3 Action are entering a gated "Early Access" program now, to which anyone can apply, but which BFL must approve.

    There is presently no public access through BFL's application programming interface (API) or those of partners yet, but the company says FLUX 3 Image will roll out in the coming weeks, followed by general availability. The limited initial availability rollout echoes the release strategies of new models from other frontier labs in the U.S. lately, including Anthropic and OpenAI, though those were ostensibly for security concerns and due to government request.

    What the company has not announced is pricing, production service-level commitments, evaluation methodology, sample sizes, rater counts or any image-model benchmarks at all. Enterprise buyers therefore cannot yet calculate total cost of ownership or independently reproduce the video comparisons.

    Another big notable omission: FLUX 3 is not launching with downloadable weights at this time, nor an open source license. BFL says faster and open-weight versions will arrive later this year, and its technical blog names FLUX 3 Dev as "open-weight access to a multimodal backbone, for content creation (video, audio and image) and action prediction" — a considerably broader commitment than any previous FLUX Dev release, all of which covered images only.

    But it arrives last in the sequence. Developers accustomed to receiving a locally deployable FLUX variant alongside — or soon after — a major model announcement will have to wait. That delay does not negate the company's commitment, but it is disappointing given the role open weights have played in FLUX's adoption thus far.

    Flux 3 is rated higher than the competition, but missing pricing and benchmarking details may prevent rapid enterprise adoption

    BFL has published several benchmark comparisons, but they're qualified as preliminary — with full benchmark results and methodology to be published later during broader general availability.

    In early head-to-head preference testing on 10-second, 720p text-to-video clips with audio, the company says FLUX 3 was preferred over Luma Ray 3.2 in 93% of comparisons, Runway Gen-4.5 in 77%, Grok Imagine Video in 69%, Kling v3 Pro in 60%, Happy Horse v1 in 59%, Happy Horse 1.1 in 57%, and both Seedance 2.0 and Google's Gemini Omni Flash in 52%.

    One caveat travels with every one of those figures, and it comes from BFL itself. The chart carrying the results is labeled a "preliminary evaluation of an early FLUX 3 candidate" — meaning the numbers describe a pre-release checkpoint rather than the model now entering early access. That cuts both ways: the shipping model may perform better, but nothing published today measures what customers will actually call.

    Luma Ray 3.2 and Runway Gen-4.5, where FLUX 3 posted 93% and 77%, are the softest comparisons on the list — established products, but not the models currently setting the pace in independent video rankings. Those are real wins, and they are the ones least likely to change an enterprise shortlist.

    Seedance 2.0, at 52%, is a statistical coin flip against a model most Western enterprises cannot currently procure. ByteDance indefinitely postponed Seedance 2.0's international rollout after Netflix, Warner Bros., Disney, Paramount and Sony sent legal threats over alleged systematic copyright infringement, and that suspension remains in place. Tying a frozen product is neither a strong claim nor a damaging one.

    Gemini Omni Flash, also at 52%, matters much more. Omni is the closest large-platform analogue to what FLUX 3 is attempting — multimodal input, video and audio-aware creation, conversational editing — and by BFL's own measurement, the two are indistinguishable on 10-second text-to-video quality.

    Google's advantage in that matchup is that Omni is generally available via Google's Gemini API for $0.10 per second of generated 720p video, or a 10-second clip for around.

    One regional wrinkle matters for a German company's home market. Editing uploaded video is unavailable to Omni Flash users in the European Economic Area, Switzerland and the United Kingdom, though editing video the model itself generated is permitted. A European enterprise that wants to run its existing footage through a generative editing pass cannot currently do so on Omni Flash.

    Here's a rough guide for enterprises considering which video models to rely upon:

    Model

    Max single-generation duration

    Max resolution

    Key constraints

    Price per 10-second clip (720p)

    Price per 10-second clip (1080p)

    Price per 10-second clip (4K)

    FLUX 3 Video

    20 seconds

    Not stated; evaluations run at 720p

    Early access; no published SLA or pricing

    Not announced

    Not announced

    Not announced

    HappyHorse 1.1

    15 seconds

    1080p

    No 4K; closed weights

    Not published (v1.0 reseller rate is ~$1.82)

    Not published (v1.0 reseller rate is ~$3.12)

    n/a

    Veo 3.1

    Per-second billing

    4K

    Supports clip extension; preview

    $4.00

    $4.00

    $6.00

    Veo 3.1 Fast

    Per-second billing

    4K

    Preview

    $1.00

    $1.20

    $3.00

    Veo 3.1 Lite

    Per-second billing

    1080p

    No 4K, no clip extension; preview

    $0.50

    $0.80

    n/a

    Gemini Omni Flash

    10 seconds (3s minimum)

    720p at 24 FPS

    Preview abd no EU access

    $1.00

    n/a

    n/a

    One architecture for media generation and physical action

    FLUX 3 builds on Self-Flow, BFL's method for aligning multimodal understanding and generation within one architecture, publicized back in March 2026.

    The company says it significantly scaled up compute and data to train across video, images and audio simultaneously, and that testing showed video generation and action prediction do not require separate foundations — the same architecture could be extended to action prediction without sacrificing what it learned from video.

    "We place vision at the center of our approach because it is the most signal-rich medium of the physical world. Images convey structure, images and video teach spatial relationships, video teaches dynamics, and actions reveal causal relationships. But vision alone is not the complete picture," said Robin Rombach, co-founder and CEO of BFL, in a pre-release statement provided to VentureBeat. "True intelligence means perceiving the world: predicting how it will change, taking action, and learning from the results. Joint training within one unified architecture is what will get us there, because each training modality strengthens the others. Audio conveys timing, prosody, and physical events that elude vision. Language conveys goals, abstractions, and instructions that pixels cannot easily express."

    He put the case more bluntly elsewhere in the announcement: "You can't cheat reality. A model that only learns images can only generate images. But the world is not made of still frames. It moves, sounds, changes, and responds."

    BFL says FLUX 3 targets creative tooling, media, design, e-commerce and physical AI, supporting video generation with synchronized audio, precise image editing, product and material consistency across motion, multilingual generation and robotic action prediction. It is already being tested by Canva, Burda, Magnific (formerly Freepik), Krea and Picsart.

    For creative software companies, the appeal is consolidation. A single foundation could potentially support storyboarding, image editing, product rendering, video variation and localization without repeatedly translating assets and instructions between disconnected models.

    For robotics teams, the potential value is data efficiency. Models that already encode motion, object behavior and physical change may need less task-specific robot training than systems starting from raw demonstrations.

    What FLUX 3 Video can actually do

    The video tier is the most concretely specified part of the launch, and it settles a question that had been circulating as rumor: FLUX 3 generates clips of up to 20 seconds with audio in a single generation.

    Every video output comes with native audio. For comparison, HappyHorse 1.0 tops out at 15 seconds of 1080p with synchronized audio — though BFL has not stated what resolution its 20-second clips run at, and its published evaluations were conducted at 720p. Still, a 20-second long clip from a single prompt is among the longest yet achieved, matching OpenAI's discontinued Sora model.

    The capability list BFL published covers:

    • Text-to-video generation.

    • Image-to-video generation, either animating from a starting frame or using images as visual references.

    • Video-to-video generation from a reference clip, carrying elements such as a specific character into a new scene or context.

    • Generative video-audio continuation from existing video and audio input.

    • Keyframe-to-video generation for controlled transitions between defined moments.

    • Multilingual dialogue.

    • A broad range of visual styles and aspect ratios, from candid camcorder footage to animation and cinematics.

    • Typography generation and animated design.

    • Agentic chaining of individual clips into longer, multi-shot sequences.

    That last item is the one enterprise video teams should look at hardest. BFL claims the capabilities combine to produce sequences lasting several minutes, with visual references keeping characters consistent across scenes. If that holds up under production conditions, it addresses the constraint that has kept generative video out of most commercial pipelines: not clip quality, but continuity across shots.

    It is also the capability where competition is most direct. HappyHorse 1.1's headline upgrade is R2V, or Reference-to-Video, which accepts multiple character reference images to hold identity stable across generated footage — the same problem, approached at the input layer rather than through agentic clip chaining. Alibaba also claims zero-drift lip sync and has specifically targeted the artifacts that mark commercial AI video as synthetic, including facial oiliness and over-sharpening. Character consistency is where this category is being contested, and both companies know it.

    BFL says FLUX 3 Video is already particularly strong at human facial expressions, associating sounds with physical events, and multilingual output. On the image side, the company says preliminary evaluations conducted during midtraining show significant improvement over earlier FLUX versions in complex prompt handling and text generation, including high-accuracy text in multiple languages. It published no image benchmarks or win rates.

    FLUX-mimic tests whether video models can become robot models

    BFL is applying its unified-architecture thesis through FLUX-mimic, a video-action model built on FLUX 3 and developed with Swiss firm Mimic Robotics, one of the first partners to receive early access.

    The technical blog describes two distinct routes to action prediction: integrating native action prediction directly into FLUX 3, scaling up the initial Self-Flow work; and using the pretrained video backbone as a dynamics-aware foundation from which specialized action models can be finetuned with limited task-specific data. FLUX-mimic is the second route — the FLUX 3 backbone combined with mimic's robot-learning and production-deployment expertise in dexterous manipulation.

    FLUX-mimic is designed for general-purpose robotic manipulation: helping robots understand a visual scene, predict the consequences of an action, and adapt to new tasks with far less task-specific data.

    BFL and Mimic Robotics say that depending on task difficulty, the model can be finetuned for a specific manipulation task with as little as 30 minutes of robot data, where prior approaches have required 30 or more hours.

    "The hardest part of robotics is data," said Elvis Nava, CTO of Mimic Robotics, in a statement provided to VentureBeat. "Every new task normally means hours of a robot repeating itself. Because FLUX-mimic is built on top of frontier video models that already understand how the physical world behaves, it picks up a new task in minutes, not days. This way, we can leapfrog the current state of the art in robot learning."

    BFL argues that a model trained only on images cannot understand a world that "moves, sounds, changes, and responds," and that physical understanding is what produces convincing generated footage. Google makes a nearly identical claim for Gemini Omni.

    Its developer documentation cites "world knowledge" that combines "an understanding of physics" with Gemini's grasp of history, science and cultural context. Its marketing is blunter still: "Most AI models just predict the next pixel to build a narrative or an image. Gemini Omni is different," the company posted in June, crediting the model with "an intuitive understanding of forces like gravity, kinetic energy, and fluid dynamics for more realistic movements that follow real-world logic."

    The practical consequence for enterprise buyers is that world-model language is not a differentiator. Two of the three leading video systems now market physical understanding as their central advantage, and neither has published a benchmark that measures it.

    There is no standard test for whether generated water behaves like water, whether a dropped object falls at a plausible rate, or whether a sound arrives when the impact does. Human preference ratings capture some of it indirectly. Nothing else on offer captures it at all.

    Open weights helped make FLUX an industry standard

    BFL officially launched in summer 2024 and gained a name for itself in the AI industry in the intervening two years for its commitment to open sourcing high-quality AI image models beloved by developers, creatives, and enterprises.

    The company's founders, including Rombach, Andreas Blattmann and Patrick Esser, previously helped create VQGAN, latent diffusion and Stable Diffusion, the latter the open source technology that kicked off broad AI generation capabilities for the masses and currently used by many AI image generators and companies.

    That reach translated into commercial distribution. FLUX models now power generative features inside Adobe Photoshop, Picsart and Nous Research's Hermes Agent, among other platforms, and the company cites film director Martin Scorsese among professional users.

    Wired magazine described Black Forest Labs as a relatively small company that nevertheless became a leading competitor to Silicon Valley's largest AI labs, with FLUX models ranking near the top of image benchmarks and becoming some of the most downloaded text-to-image models on AI code sharing community Hugging Face. The company says it now runs a 100-person team across Freiburg and San Francisco.

    FLUX.1 Dev, FLUX.1 Kontext Dev, FLUX.1 Fill Dev and related control models, released shortly after the firm's launch, gave researchers and creative-tool developers access to downloadable checkpoints, local inference and integrations with frameworks including Hugging Face Diffusers and ComfyUI. FLUX.1 Kontext Dev, for example, was released as an open-weight model for research and noncommercial use, with generated outputs permitted for commercial purposes under the applicable license.

    The company continued that pattern with FLUX.2 Dev in late 2025, a 32-billion-parameter open-weight model combining generation and multi-reference editing. Black Forest Labs called it the strongest open-weight image generation and editing model available at launch and released weights, reference inference code and optimized implementations for consumer Nvidia GPUs.

    FLUX 3 Dev raises the stakes on that evaluation. Previous Dev releases were image models. This one is described as a multimodal backbone spanning video, audio, image and action prediction — meaning a single license will govern whether a company can locally deploy a model that touches both content production and physical machinery. BFL hasn't yet shared information about its license, the parameter count, quantizations or hardware requirements.

    The company frames open weights as an enterprise feature rather than a community gesture, arguing they enable secure, low-latency local deployment for applications like robotic control systems and let teams adapt FLUX 3 to their own data, products and workflows.

    The financial backing behind FLUX 3 is worth noting alongside the technical claims. Black Forest Labs is valued at $3.25 billion and has raised more than $450 million from investors including a16z, AMP, Salesforce Ventures, Nvidia, General Catalyst, Adobe Ventures, Figma Ventures, Canva and Deutsche Telekom's T.Capital.

    ]]>         <![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]> https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/ https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/ Thu, 23 Jul 2026 20:48:09 +0200 📰 IT Nachrichten tsecurity.de

    AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.

    AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its Helios AI platform is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).

    The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  

    AMD’s MI455X targets the AI memory wall

    The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.

    Compared to AMD’s current MI355X, the MI455X offers 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.

    AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.

    AMD Instinct chart showing generational leap in performance

    AMD

    The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.

    The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

    AMD’s Helios rack takes aim at Vera Rubin

    AMD Helios rack

    Dave Altavilla

    Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.

    In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.

    These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.

    AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.

    While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.

    Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.

    Kind of like cowbell, AMD Venice gives agentic AI more CPU

    Chart showing AMD EPYC CPU performance

    AMD

    AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.

    Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.

    Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.

    Pensando networking and ROCm software advance

    Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.

    As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.

    On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.

    These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.

    Customer commitments underscore rack-scale confidence

    AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.

    Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, Anthropic announced a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.

    Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.

    There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.

    AMD expands its robotics and embedded foundation

    AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.

    The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.

    Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.

    Execution for AMD is now the test

    AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.

    AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.

    As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]> https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/ https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/ Thu, 23 Jul 2026 16:59:29 +0200 🕵️ Sicherheitslücken tsecurity.de Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

    Executive summary 

    A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [1].

    LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.

    Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the Persistence and credential access section.

    This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:

    • United States National Security Agency (NSA)
    • United States Federal Bureau of Investigation (FBI)
    • Netherlands Defence Intelligence and Security Service (MIVD)
    • Netherlands General Intelligence and Security Service (AIVD)
    • United States Cybersecurity and Infrastructure Security Agency (CISA)
    • United States Defense Counterintelligence and Security Agency (DCSA)
    • United States Department of Defense Cyber Crime Center (DC3)
    • United States Department of the Treasury
    • United States Naval Criminal Investigative Service (NCIS)
    • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
    • Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
    • New Zealand National Cyber Security Centre (NCSC-NZ)
    • United Kingdom National Cyber Security Centre (NCSC-UK)
    • Czech Republic National Cyber and Information Security Agency (NÚKIB)1
    • Danish Defence Intelligence Service (DDIS)2
    • Estonian Foreign Intelligence Service (EFIS)3
    • Finnish Defence Intelligence (FDI)4
    • Finnish Security and Intelligence Service (SUPO)5
    • French General Directorate for Internal Security (DGSI)6
    • French National Cybersecurity Agency (ANSSI)7
    • Italian External Intelligence and Security Agency (AISE)8
    • Italian Internal Intelligence and Security Agency (AISI)9
    • Security and Intelligence Service of the Republic of Moldova (SIS RM)10
    • Polish Foreign Intelligence Agency (AW)11
    • The Military Counterintelligence Service of Poland (SKW)12
    • Spain National Intelligence Centre (CNI)13
    • Sweden National Cyber Security Centre (NCSC-SE)14

    The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the Mitigations section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed Indicators of compromise (IOCs).  

    As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.

    For a downloadable list of IOCs, see:

    Cybersecurity industry tracking

    The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:

    • LAUNDRY BEAR
    • Void Blizzard [2]
    • CL-STA-1114 [3]
    • TA488 (formerly UNK_PitStop) [4]

    Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

    Background

    Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [1] [2]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  

    The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [T1078], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence & Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [T1557].  

    Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [T1114]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:

    • Last 90 days of emails,
    • Email address,
    • Password [T1589.001],
    • Global Address List (GAL) [T1087],
    • Two-factor authentication (2FA) tokens, and
    • Newly-created Application Passcode [T1098].

    The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.

    Targeting details

    LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:

    • the Defense Industrial Base (DIB),  
    • the federal and local government,
    • education,
    • energy,
    • law enforcement,  
    • media,  
    • non-governmental organizations, and
    • technology.

    Technical details

    Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM version 1.4.015. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and D3FEND tactics, techniques, and countermeasures.

    Ulej is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit CVE-2025-66376 [Common Weakness Enumeration (CWE) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.

    Reconnaissance

    LAUNDRY BEAR uses the Ulej capability to exploit the CVE-2025-66376 vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [T1595] and fingerprinting datasets easily procured through various commercial vendors [T1596.005].  

    After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [T1589.002] from datasets offered by commercial vendors [T1597.002], open source intelligence [T1593], or previously exfiltrated data [T1597].  

    Resource development

    The actors procure VPSs from a variety of providers [T1583.003], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [T1583] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for Ulej’s Flowerbed framework [T1608], which then receives and aggregates the data Ulej exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.

    Flowerbed framework

    Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:

    • Catcher,
    • Certbot,
    • Nginx, and
    • Gardener.

    Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [T1048]. For additional information on Catcher, refer to the Exfiltration section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [T1048.002]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.

    The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [T1588.007]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.

    Initial access

    To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566]. Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199], as shown in the email metadata in Figure 2. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.

    Figure 1: Example of malicious email
    Figure 1: Example of malicious email

    Figure 2: Headers from an example malicious email
    Figure 2: Headers from an example malicious email

    According to the National Vulnerability Database (NVD), CVE-2025-66376 was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [5]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [T1587.004].  

    Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.

    Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [T1027.010], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [T1119]. The stages in order of appearance within the payload are as follows:

    1. sendStartPing,
    2. gather_email,
    3. gather_environment,
    4. gather_2fa_codes,
    5. gather_app_password,
    6. gather_device_status,
    7. gather_oauth_consumers,
    8. gather_autocomplete_password,
    9. enable_mail_protocols,
    10. gather_gal,
    11. sendArchives, and
    12. sendFinishPing. 

    Figure 3: Malicious payload of example email
    Figure 3: Malicious payload of example email

    Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [T1587].

    Persistence and credential access

    To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the Exfiltration section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [T1550.004], and the Zimbra campaign follows a similar trend.

    The script used in this campaign tries to discover the victim’s email address during the gather_email stage [T1087]. The script searches for this email address in two ways. First, it examines the batchInfoResponse variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the Collection section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [T1185] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of null over HTTPS and does not attempt DNS exfiltration.

    During the gather_autocomplete_password stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in Figure 4 and Figure 5. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in Figure 4. If there is no value in that input field, it checks the password input field shown in Figure 5. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of null is sent over HTTPS and DNS exfiltration is not attempted.

    Figure 4: First illegitimate login HTML element
    Figure 4: First illegitimate login HTML element

    Figure 5: Second illegitimate login HTML element
    Figure 5: Second illegitimate login HTML element

    LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.

    ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the gather_app_password stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [T1556.006]. The SOAP request uses “ZimbraWeb” as the name of the application.

    Additionally, the script also attempts to collect 2FA tokens. During the gather_2fa_codes stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.

    Collection

    As demonstrated in the Persistence and credential access section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the Persistence and credential access section, other SOAP commands executed to collect victim information are shown in Table 1.

    Table 1: Additional SOAP commands used

    SOAP Command 

    Namespace 

    Stage 

    GetInfoRequest 

    zimbraAccount 

    gather_environment 

    GetDeviceStatusRequest 

    zimbraSync 

    gather_device_status 

    GetOAuthConsumersRequest 

    zimbraAccount 

    gather_oauth_consumers 

    SearchGalRequest 

    zimbraAccount 

    gather_gal 

    The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.

    During the gather_environment stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in Table 2) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.

    Table 2: ZCS webmail client types

    Indicator 

    Client Type 

    Associated Value 

    ?client=advanced 

    Advanced 

    c 

    /h/ 

    Standard 

    h 

    /modern/ 

    Modern 

    m 

    As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)”. The {DAY_OFFSET} value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of zd_comp_YYYY-MM-DD, and value of true, is saved to the window.top.localStorage property. This variable is saved regardless of whether the email is successfully exfiltrated.  

    According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a {DAY_OFFSET} of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the Exfiltration section.

    The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the Exfiltration section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of gather_gal:{VAL}:api. The {VAL} placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder {DAY_OFFSET}, with a format of sendArchive:day-{DAY_OFFSET}.

    Exfiltration

    At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [T1048.003] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.

    Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  

    DNS exfiltration

    DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, Ulej maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in Figure 6. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.

    Figure 6: Structure for information exfiltrated by DNS
    Figure 6: Structure for information exfiltrated by DNS

    When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. Table 3 lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  

    Table 3: DNS exfiltration

    Type of Information 

    Exfiltration Stage 

    Data Type 

    Victim’s Email Address 

    gather_email 

    e 

    Client Type 

    gather_environment 

    c 

    Zimbra Version 

    gather_environment  

    v 

    URL at Time of Exploitation 

    gather_environment 

    url 

    2FA Scratch Codes 

    gather_2fa_codes 

    2fa 

    Newly Created Application Password 

    gather_app_password 

    pa 

    Harvested Autocomplete Password 

    gather_autocomplete_password 

    pw 

    HTTPS exfiltration

    Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in Table 4. Traffic associated with HTTPS exfiltration will use the URL scheme shown in Figure 7.  

    Table 4: HTTPS exfiltration types

    Content Type 

    URL Path 

    application/json 

    /v/p 

    application/octet-stream 

    /v/d 

    Figure 7: Structure for information exfiltrated by HTTPS
    Figure 7: Structure for information exfiltrated by HTTPS

    Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  

    Table 5 provides a summary of the JSON-based exfiltration.

    Table 5: HTTPS JSON exfiltration  

    Type of Information 

    Exfiltration Stage 

    JSON Key(s) 

    Victim’s Email Address 

    gather_email 

    email 

    Client Type, Version, and Current URL 

    gather_environment 

    client, version, full_url 

    Newly Created Application Password 

    gather_app_password 

    app_password 

    Harvested Autocomplete Password 

    gather_autocomplete_password 

    autocomplete_password 

    The script transmits all HTTPS exfiltration not identified in Table 5 using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. Table 6 summarizes the data exfiltrated in this format.

     Table 6: HTTPS binary exfiltration

    Type of Information 

    Exfiltration Stage 

    X-Filename Header 

    SOAP request for GetInfoRequest 

    gather_environment 

    zimbra_batch_analytics.json 

    SOAP request for GetScratchCodesRequest 

    gather_2fa_codes 

    zimbra_batch_analytics.json 

    SOAP request for GetDeviceStatusRequest 

    gather_device_status 

    zimbra_batch_analytics.json 

    SOAP request for GetOAuthConsumersRequest 

    gather_oauth_consumers 

    zimbra_batch_analytics.json 

    Victim Organization’s Global Address List 

    gather_gal 

    telemetry_{1-20}.json 

    Last 90 Days of Victim’s Emails 

    sendArchives 

    telemetryData_{0-89}.json 

    The script sends all exfiltrated data identified in Table 6 to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [T1560]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in Table 6 using the application/octet-stream content typing rather than application/json.

    At the beginning and end of the collection and exfiltration activity, during the sendStartPing and sendFinishPing stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in Figure 2, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (start, finish, or error).  

    Catcher

    Ulej exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the Resource development section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.

    Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the Resource development section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.

    The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  

    However, if a query includes a domain formatted as shown in Figure 6 and Figure 7, the service saves a log file in JSON format to disk containing the following details of the DNS query:

    • Time of query,
    • Source IP address for query,
    • Queried domain, and
    • Type of query.

    The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in Figure 6 and Figure 7. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:

    • Time,
    • Source IP address,
    • Request method,
    • Host,
    • Path,
    • Query string,
    • Headers, and
    • Base64 payload.

    These JSON event log files and binary output files are then initially saved to the directory /root/hits/tmp and later moved to the /root/hits/ready directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in Figure 8 also executes hourly to remove all files last modified at least two days ago from the /root/hits/ready directory.

    Figure 8: Command used for automated directory cleanup
    Figure 8: Command used for automated directory cleanup

    Response strategies

    Mitigations

    In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.

    All organizations that use the ZCS webmail service should immediately prioritize ensuring that their ZCS is not running a vulnerable version. A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS [D3-AH]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [d3f:Isolate].

    System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [D3-AH]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including CISA’s Known Exploited Vulnerabilities Catalog and NCSC-UK’s Responding to active exploitation of vulnerabilities guidance.

    Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [D3-CH]. However, Application Passcodes may still be necessary and should be monitored closely.  

    Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [CPG 3.Q]. This will allow organizations to monitor for and identify suspicious network activity [CPG 4.B], such as:

    • Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [D3-NTA];
    • Frequent DNS queries for a suspicious domain with seemingly random subdomains [D3-DNSTA];
    • A sudden spike of connections to a server associated with a recently established domain [D3-NTCD]; and  
    • Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [D3-NTCD].

    Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the Exfiltration section of this advisory.

    Indicators of compromise (IOCs)

    Flowerbed infrastructure

    The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (Disclaimer: Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) Table 7 provides details about the server infrastructure used to host Flowerbed, and Table 8 lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [D3-IAA].

    Table 7: Flowerbed server infrastructure

    Domain 

    IP Address 

    First Seen 

    Last Seen 

    zmailanalytics[.]com 

    216.252.238[.]104 

    8 July 2025 

    15 October 2025 

    zimbra-metadata[.]com 

    216.252.238[.]18 

    20 August 2025 

    14 October 2025 

    analyticemailmeter[.]com 

    37.120.247[.]228 

    24 September 2025 

    18 March 2026 

    emailanalytics.com[.]ua 

    185.86.79[.]95 

    24 September 2025 

    18 March 2026 

    mailnalysis[.]com 

    104.248.134[.]194 

    11 November 2025 

    17 February 2026 

    zimbrastat[.]com 

    64.226.124[.]190 

    18 December 2025 

    18 March 2026 

    zimbrasoft.com[.]ua 

    193.238.152[.]66 

    20 January 2026 

    18 March 2026 

    synacorzimbra[.]nl 

    216.252.238[.]64 

    3 February 2026 

    30 March 2026 

    istc-cloud[.]com 

    194.156.103[.]193 

    5 February 2026 

    30 March 2026 

    Table 8: Flowerbed X.509 certificate SHA-1 hashes  

    Associated Domain 

    X.509 SHA-1 Hash 

    First Seen 

    Last Seen 

    zmailanalytics[.]com 

    2e4f314bc9943cab5005d6fde0b271c74d47bc9d 

    8 Jul 2025 

    6 Aug 2025 

    *.i.zmailanalytics[.]com 

    50a87d926621dd06389ba50d86e0ff574ed713a8 

    6 Aug 2025 

    13 Oct 2025 

    *.i.zimbra-metadata[.]com 

    c5a72420e7bb308d078e62128430897f82194c95 

    20 Aug 2025 

    14 Oct 2025 

    *.i.analyticemailmeter[.]com 

    8959c4d29e29f02ea94ea8bb21c8df2594c5549d 

    24 Sep 2025 

    8 Nov 2025 

    *.i.emailanalytics.com[.]ua 

    62eb76432597694edb01c1fe57aab0cfe03a7178 

    25 Sep 2025 

    27 Sep 2025 

    *.i.mailnalysis[.]com 

    cddf5c3be1e07f28140aed165b929bf2d614922a 

    12 Nov 2025 

    17 Dec 2025 

    *.i.zimbrastat[.]com 

    18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 

    18 Dec 2025 

    28 Dec 2025 

    *.i.zimbrasoft.com[.]ua 

    1b25041ececf2457eef0270fc1d785cec8ec9ded 

    21 Jan 2026 

    10 Feb 2026 

    *.i.synacorzimbra[.]nl 

    e4fe6466a4f9a4249fe330651e914e45bbdca44a 

    5 Feb 2026 

    22 Mar 2026 

    *.i.istc-cloud[.]com 

    b6b77c9a455225d525834a403ca9ef5481ed0447 

    12 Feb 2026 

    30 Mar 2026 

    LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:

    • ivanka.zurabishvili@proton[.]me,
    • zmul1@buildandconsulting[.]com,
    • garrysmithme@pinmx[.]net, and
    • hostingclient@pinmx[.]net.

    Phishing distribution

    LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  

    The following email addresses have distributed payloads attributed to this campaign:

    • c.laurent.ejfa@proton[.]me,
    • j.moreau.epsc@proton[.]me,
    • liberty.insights@proton[.]me,
    • certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and
    • certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).

    Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:

    • 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,
    • 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,
    • b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and
    • 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.

    Post-compromise artifacts

    Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.

    This Ulej capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the /opt/zimbra/log/mailbox.log file [D3-PA]. A significant amount of SOAP request activity that aligns with what was described in the Persistence and credential access and Collection sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:

    • Many SearchGalRequest command requests from a single user over a short period of time;
    • Use of the CreateAppSpecificPasswordRequest command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and
    • Use of the GetScratchCodesRequest command.

    While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [D3-PA]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of zd_comp_YYYY-MM-DD, as explained in the Collection section of this advisory.

    While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”

    In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [D3-MA]. If an email that has a payload exploiting CVE-2025-66376 is discovered, steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  

    Remediation

    In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to CVE-2025-66376.

    Organizations should use identifiers from the IOCs section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.

    All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [CPG 3.B] and creating unique credentials [CPG 3.C], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.

    Works cited

    [1] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf

    [2] Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

    [3] Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. https://unit42.paloaltonetworks.com/russian-webmail-espionage/ 

    [4] Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit

    [5] Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  

    Footnotes

    1 Národní úřad pro kybernetickou a informační bezpečnost
    2 Forsvarets Efterretningstjeneste
    3 Välisluureamet
    4 Sotilastiedustelu
    5  Suojelupoliisi
    6 Direction gĂŠnĂŠrale de la sĂŠcuritĂŠ intĂŠrieure
    7 Agence nationale de la sécurité des systèmes d’information
    8 Agenzia Informazioni e Sicurezza Esterna
    9 Agenzia Informazioni e Sicurezza Interna
    10 Serviciul de Informații și Securitate al Republicii Moldova
    11 Agencja Wywiadu
    12 Służba Kontrwywiadu Wojskowego
    13 Centro Nacional de Inteligencia
    14 Nationellt Cybersäkerhetscenter
    15 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.

    Acknowledgements

    The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.

    Disclaimer of endorsement

    The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

    Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.

    Purpose

    This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

    Contact

    United States organizations 

    • National Security Agency 
      Cybersecurity Report Feedback: CybersecurityReports@nsa.gov 
      Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov 
      Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov 
    • Cybersecurity and Infrastructure Security Agency 
      CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472). 
    • Federal Bureau of Investigation 
      If you or someone you know has fallen victim to this campaign, file a complaint with IC3. 
    • Defense Counterintelligence and Security Agency  
      DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: DCSA.CI.CyberOps@mail.mil 
      Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. 
      Media/Public Inquiries: dcsa.quantico.dcsa-hq.mbx.pa@mail.mil  
    • Department of Defense Cyber Crime Center  
      Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil 
      Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil 
      Media Inquiries / Press Desk: DC3.Information@us.af.mil 
    • Naval Criminal Investigative Service 
      To report criminal activity impacting the United States Navy, go to www.ncis.navy.mil and click “Submit a Tip”

    Dutch organizations 

    Australian organizations 

    • Australian Signals Directorate 
      Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. 

    Canadian organizations 

    • The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  
      Report an incident or suspicious activity to the Cyber Centre by email at contact@cyber.gc.ca, online via the reporting tool Report a cyber incident - Canadian Centre for Cyber Security or by phone at 1-833-CYBER-88 (1-833-292-3788). 

    New Zealand organizations 

    United Kingdom organizations 

    Estonia organizations 

    Finnish organizations 

    French organizations 

    • French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

    Italian Organizations 

    Moldovan organizations 

    • Security and Intelligence Service of the Republic of Moldova (SIS RM): cybersec@sis.md 

    Polish organizations 

    Appendix A: MITRE ATT&CK tactics and techniques

    See Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory.

    Table 9: Reconnaissance 

    Technique Title 

    ID 

    Use 

    Gather Victim Identity Information: Credentials 

    T1589.001 

    The payload attempts to intercept a victim’s password from their password manager. 

    Gather Victim Identity Information: Email Addresses 

    T1589.002 

    The payload attempts to grab the victim’s email address from various data stores. 

    Search Open Websites/Domains 

    T1593 

    This group likely leverages public information to support target development. 

    Active Scanning 

    T1595 

    Port scanning can be used by this group to assist with determining exploitability of identified targets. 

    Search Open Technical Databases: Scan Databases 

    T1596.005 

    Various public datasets can provide information to support discovery of exploitable targets. 

    Search Closed Sources 

    T1597 

    Previously exfiltrated data can be used to enhance target development efforts. 

    Search Closed Sources: Purchase Technical Data 

    T1597.002 

    Commercial datasets can also be used to support target development efforts. 
    Table 10: Resource Development 

    Technique Title 

    ID 

    Use 

    Acquire Infrastructure 

    T1583 

    This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. 

    Acquire Infrastructure: Virtual Private Server 

    T1583.003 

    This group procured VPS servers from a variety of vendors. 

    Develop Capabilities 

    T1587 

    The Ulej capability was developed likely for use by this group to conduct spear phishing campaigns. 

    Develop Capabilities: Malware 

    T1587.001 

    Development of a novel payload that steals a victim’s emails and other sensitive account information. 

    Develop Capabilities: Exploits 

    T1587.004 

    Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. 

    Obtain Capabilities: Tool 

    T1588.002 

    Open source tools, such as Evilginx2, have also been used by the group. 

    Obtain Capabilities: Artificial Intelligence 

    T1588.007 

    The group appears to have leveraged AI to support development efforts. 

    Stage Capabilities 

    T1608 

    Flowerbed is deployed to a procured server in the cloud. 

    Table 11: Initial Access 

    Technique Title 

    ID 

    Use 

    Valid Accounts 

    T1078 

    This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  

    Trusted Relationship 

    T1199 

    The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  

    Phishing 

    T1566 

    The actors used spear phishing to lure users into opening malicious email. 

    Table 12: Execution 

    Technique Title 

    ID 

    Use 

    Exploitation for Client Execution 

    T1203 

    An XSS vulnerability was leveraged to execute the JavaScript payload. 

    Table 13: Persistence 

    Technique Title 

    ID 

    Use 

    Account Manipulation 

    T1098 

    Enabling IMAP and Application Passcodes provides persistent access to the compromised account. 

    Modify Authentication Process: Multi-Factor Authentication 

    T1556.006 

    Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

    Table 14: Privilege Escalation 

    Technique Title 

    ID 

    Use 

    Valid Accounts 

    T1078 

    This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  

    Table 15: Stealth 

    Technique Title 

    ID 

    Use 

    Obfuscated Files or Information: Command Obfuscation 

    T1027.010 

    Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. 

    Obfuscated Files or Information: Encrypted/Encoded File 

    T1027.013 

    The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. 

    Obfuscated Files or Information: SVG Smuggling 

    T1027.017 

    The payload was contained in an “onload” attribute within an SVG image included in the malicious email. 

    Use Alternate Authentication Material: Web Session Cookie 

    T1550.004 

    Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. 

    Table 16: Credential Access 

    Technique Title 

    ID 

    Use 

    Modify Authentication Process: Multi-Factor Authentication 

    T1556.006 

    Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. 

    Adversary-in-the-Middle 

    T1557 

    Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. 

    Table 17: Collection 

    Technique Title 

    ID 

    Use 

    Data Staged: Remote Data Staging 

    T1074.002 

    Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. 

    Email Collection 

    T1114 

    This group has emphasized collection of emails. 

    Email Collection: Remote Email Collection 

    T1114.002 

    Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. 

    Automated Collection 

    T1119 

    Upon execution, the JavaScript payload automatically collects all relevant information in stages. 

    Browser Session Hijacking 

    T1185 

    The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. 

    Archive Collected Data 

    T1560 

    Emails are exfiltrated with GZIP compression. 

    Table 18: Discovery 

    Technique Title 

    ID 

    Use 

    Account Discovery 

    T1087 

    Stolen Global Access Lists provide the group with new users to target. 

    Table 19: Exfiltration 

    Technique Title 

    ID 

    Use 

    Exfiltration Over Alternative Protocol 

    T1048 

    Victim information was exfiltrated over both HTTPS and DNS. 

    Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol 

    T1048.002 

    Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. 

    Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol 

    T1048.003 

    Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. 

    Appendix B: MITRE D3FEND countermeasures

    See Table 20 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

    Table 20: MITRE D3FEND Countermeasures 

    Countermeasure Title 

    ID 

    Description 

    Application Hardening 

    D3-AH 
    • Organizations should immediately prioritize patching CVE-2025-66376.  
    • Organizations should promptly apply software updates to all email systems. 

    Isolate 

    d3f:Isolate 

    Organizations that cannot feasibly patch should use alternative mail clients. 

    Credential Hardening 

    D3-CH 

    Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. 

    Network Traffic Analysis 

    D3-NTA 

    Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. 

    DNS Traffic Analysis 

    D3-DNSTA 

    Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. 

    Network Traffic Community Deviation 

    D3-NTCD 
    • Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. 
    • Organizations should monitor for connections to internal services, such as webmail, from VPN providers. 

    Identifier Activity Analysis 

    D3-IAA 

    Organizations should search for the listed known IOCs. 

    Process Analysis 

    D3-PA 
    • Organizations should search ZCS log files for specific commands used by the malicious script. 
    • Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. 
    Message Analysis D3-MA Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.
    ]]>         <![CDATA[Despite tough quarter, IBM says mainframe will continue to put the Big in Big Blue]]> https://tsecurity.de/de/3689349/it-security-nachrichten/despite-tough-quarter-ibm-says-mainframe-will-continue-to-put-the-big-in-big-blue/ https://tsecurity.de/de/3689349/it-security-nachrichten/despite-tough-quarter-ibm-says-mainframe-will-continue-to-put-the-big-in-big-blue/ Thu, 23 Jul 2026 16:27:23 +0200 📰 IT Security Nachrichten tsecurity.de

    Revenue from IBM’s z mainframe portfolio declined 42% in the quarter ended June 30, dragging infrastructure revenue down 7% compared to the year-ago quarter. But Big Blue executives remain positive on the mainframe’s role as an important AI platform.

    After warning of an earnings shortfall, IBM lowered its full-year forecast. It now expects 2026 revenue to grow between 4% and 5%, rather than its previous forecast of more than 5% growth. Some parts of its business did well: Software revenue grew 5% in the second quarter to $7.76 billion, fueled by 11% growth in hybrid cloud, 18% growth in data, and 3% growth in automation.

    On the infrastructure side, IBM posted second-quarter revenue of $3.8 billion, which is down 7%. Within that business, distributed infrastructure grew 37%, but those gains were offset by a 10% decline in hybrid infrastructure and IBM Z’s 42% drop.

    In a July 14 letter to investors released prior to IBM’s July 22 earnings call, CEO Arvind Krishna warned of the earnings shortfall and laid out current challenges. He related the infrastructure performance shortfall to “wrapping on the launch of z17 in the second quarter” and stated: “Given this was the strongest start to a mainframe program in our history, we expected Infrastructure revenue to decline low-single digits for the year, beginning this quarter. What played out was worse than our expectations, driven by a shortfall in our Z performance and the associated software stack, primarily in Transaction Processing.”

    In the last few weeks of June, customers shifted capex spending and started purchasing more AI infrastructure components in the form of servers, storage, and memory “to secure supply-constrained infrastructure ahead of expected price increases,” Krishna stated. “This dynamic impacted client buying patterns. While we anticipated some supply chain related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

    Yet despite challenges this last quarter, z17 remains at nearly 130% growth program-to-program, according to IBM. That’s “well ahead of z16, which was our strongest program on record, with clients representing 85% of installed MIPs maintaining or growing capacity,” the July 14 letter stated.

    Mainframe infrastructure momentum is expected to continue, and IBM is anticipating strong workload growth and AI-driven capacity expansion as clients modernize mission-critical systems and emphasize resiliency and security, Krishna said during the company’s Q2 2026 earnings call on July 22.

    “AI is driving incremental capacity growth and new workloads as clients look to run AI closer to their most sensitive data,” IBM senior vice president and CFO James Kavanaugh said in the call. “We are seeing strong early adoption of our AI innovations with nearly 50% of z17 customers investing in AI capabilities with Spyre AI accelerator, and clients deploying Watson X Code Assistant for Z are growing MIPS capacity three times faster than those who are not.”

    “In a world where infrastructure costs are rising and efficiency matters more than ever, IBM Z offers a compelling economic advantage,” Kavanaugh continued. “Depending on the size and complexity of workloads, clients can realize a 2 to 15x total cost of ownership benefit versus moving these workloads off the platform, reinforcing why the platform remains central to their operations and positioning us to capture additional value as AI workloads grow.”

    “We see no evidence of clients moving off mainframe,” Kavanaugh added. “Clients continue to invest in IBM Z to modernize mission-critical workloads with a focus on resiliency and security.”

    In responding to an analyst question, Kavanaugh said three key things drive mainframe demand and purchasing requirements:

    “One is capacity workload. It’s the most important determinant. 85% Of the installed MIPS capacity out there in the marketplace today running all those core mission critical workloads are either stable or growing. Clients are adding capacity and workload to mainframe, the viability. And by the way, that’s coming in new AI workloads, analytics workloads, Linux-based workloads, and those MIPS are growing program to date over 15 to 20% installed capacity,” Kavanaugh said.

    Number 2 is economic factors. “We don’t talk a lot about this, but I think it’s important for our investors to understand things like total cost of ownership. Depending on the size and complexity of the workload, we have anywhere from a 2 to a 15x TCO advantage running on the mainframe [over smaller server systems]. Again, we do not see any evidence of clients migrating off mainframe and lease propensity, which is a great indicator,” Kavanaugh said.

    The third driver is AI. “When you look at it, applications, data security, all on the platform, we do 450 billion inferences per day at 1 millisecond with 8 nines availability,” Kavanaugh said. “We’ve got clients that have already purchased over 50% of our Spire inferencing, and those clients that have purchased that are growing MIPS capacity, the way [we monetize value], by over three times faster than others.”

    ]]>         <![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]> https://tsecurity.de/de/3689165/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ https://tsecurity.de/de/3689165/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ Thu, 23 Jul 2026 15:20:41 +0200 📰 IT Nachrichten tsecurity.de

    OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.

    The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

    OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.

    Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.

    OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.

    Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

    Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.

    Workforce impact

    OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.

    Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

    Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.

    “Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

    The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

    “The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”

    Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.

    However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.

    Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

    Cost and operational risks

    Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

    “The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

    The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.

    Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

    Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.

    Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

    ]]>         <![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]> https://tsecurity.de/de/3689164/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ https://tsecurity.de/de/3689164/it-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/ Thu, 23 Jul 2026 15:20:32 +0200 📰 IT Nachrichten tsecurity.de

    OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.

    The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

    OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.

    Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.

    OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.

    Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

    Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.

    Workforce impact

    OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.

    Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

    Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.

    “Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

    The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

    “The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”

    Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.

    However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.

    Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

    Cost and operational risks

    Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

    “The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

    The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.

    Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

    Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.

    Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

    This article first appeared on CIO.

    ]]>         <![CDATA[Stop asking AI nicely: Here’s how to get work-ready results every time]]> https://tsecurity.de/de/3688796/it-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/ https://tsecurity.de/de/3688796/it-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/ Thu, 23 Jul 2026 13:07:21 +0200 📰 IT Nachrichten tsecurity.de

    Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation for reliable, measurable outcomes. I want to share the techniques that consistently delivered the biggest gains in my projects, complete with real before-and-after examples, copy-paste templates, lessons from failures and guidance on when to evolve beyond prompting to agentic systems.

    Why advanced prompting still matters in enterprise settings

    Sophisticated prompting remains essential for control, reliability and compliance. If you “ask nicely” and hope for the best, you need deterministic behavior, auditable reasoning and minimal risk of hallucination. Here’s what worked for me.

    1. Chain-of-Thought (CoT) and its variants: Unlocking step-by-step reasoning

    The problem: Models would jump to conclusions on complex analysis tasks, especially involving data interpretation or multi-step logic.

    What I did: I started explicitly instructing the model to “think step by step” and show its reasoning.

    Before (basic prompt): “Analyze last quarter’s sales data and recommend three actions.”

    After (CoT prompt):

    “You’re a senior business analyst. Analyze the following sales data step by step: [data]. First, identify the key trends. Second, calculate the rates and anomalies. Third, link findings to business context. Finally, recommend the three prioritized actions with expected impact. Explain your reasoning at each step.”  

    Results: Accuracy and depth improved dramatically.

    Variants that worked well: Self-consistency. I ran the same CoT prompt multiple times and took the majority consensus. This reduced variability significantly.

    Template you can use:

    You are [expert role]. Solve this problem by thinking step by step.

[Task or question]

For each step:

1. State your observation or calculation.

2. Explain the implication.

3. Proceed only when confident.

Final answer in this format: [structured output]

    2. Tree-of-Thoughts (ToT): Exploring multiple reasoning paths

    For truly complex decisions such as resource allocation or risk assessment, linear CoT isn’t enough. Tree-of-Thoughts lets the model generate and evaluate multiple branches.

    Example: I was helping a client evaluate three potential vendor platforms for an AI deployment. A standard prompt gave a superficial comparison. With ToT

    Prompt Snippet:

    Explore three different reasoning paths for selecting the best vendor platform:

Path 1: Focus on cost and scalability.

Path 2: Focus on security, compliance and integration.

Path 3: Focus on innovation and long-term roadmap.

For each path, evaluate pros/cons against our requirements [list].

Then, compare the paths and recommend the strongest overall option with justification.

    Outcome: The model surfaced nuanced trade-offs (e.g., one vendor had superior security, but higher integration cost).

    When to use: Strategic planning, troubleshooting or scenarios with high uncertainty and multiple viable approaches.

    3. ReAct (Reason+ Act) and prompt chaining: Moving toward agentic behavior

    One of the biggest leaps I have noticed comes from combining reasoning with tool use and chaining prompts.

    ReAct example: (used in data analytics workflow)

    You are an AI analyst with access to tools. For the query below:

1. Reason about what information you need.

2. Choose the appropriate tool or action.

3. Observe the result.

4. Repeat until you can answer confidently.

Query: [user request]

    In practice, I chained this with retrieval tools. One automated quarterly compliance reporting; the system reasoned about required data, pulled relevant records, validated them, and generated the reports.

    4. Meta-prompting and self-reflection: Letting the model improve itself

    Use the model to refine its own prompt. This is a huge time-saver.

    You are an expert prompt engineer. Improve the following prompt for clarity, structure and effectiveness with [target model]. Make it more precise while preserving intent.

Original prompt: [paste]

Provide the improved version and explain your changes.

    Self-reflection loops (asking the model to critique its own output and revise) are a game-changer for content generation and code-review tasks.

    5. Multimodal and structured output techniques

    With vision-enabled models, I started combining text with images (e.g., uploading architecture diagrams or dashboards).

    Tip from experience: Be extremely specific in describing what the models should focus on.

    Best practices I learned the hard way

    • Start simple, then layer complexity: Over-engineered prompts from Day One usually backfire.
    • Model specific tuning: Some models respond better to XML delimiters; others to explicit reasoning.
    • Evaluation and versioning: Treat prompts like code if you track versions and run automated evals.
    • Security guardrails: Always include instructions against prompt injections and respect data boundaries.
    • When to stop prompting: For repetitive, high-stakes workflows, move to full agents or an orchestration framework.

    Final takeaways for technical leaders

    Advanced prompt engineering has now become a core competency for anyone responsible for enterprise AI outcomes. Start by picking one technique and apply it rigorously to a real business problem. Document before/ after and you will notice why it’s worth mastering.

    The field continues evolving towards more automated and agentic systems, but the ability to precisely direct AI reasoning remains foundational.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[AI success requires a full-stack CIO]]> https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/ https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/ Thu, 23 Jul 2026 11:43:10 +0200 📰 IT Nachrichten tsecurity.de

    Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

    It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

    After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

    Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

    I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

    Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

    While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

    That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

    Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

    The full-stack CIO: Leading with clarity

    A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

    The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

    And those who execute best lead with clarity, Talasaz says.

    “Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

    One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

    As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

    And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

    “When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

    At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

    Reducing organizational friction

    Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

    Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

    Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

    AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

    Operating model as strategy enabler

    AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

    Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

    “If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

    The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

    This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

    Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

    As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

    Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

    Closing the gap between strategy and execution

    Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

    As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

    Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

    Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

    The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

    This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

    Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

    ]]>         <![CDATA[Determining the ROI of AI requires data that most companies lack]]> https://tsecurity.de/de/3688477/ai-nachrichten/determining-the-roi-of-ai-requires-data-that-most-companies-lack/ https://tsecurity.de/de/3688477/ai-nachrichten/determining-the-roi-of-ai-requires-data-that-most-companies-lack/ Thu, 23 Jul 2026 11:07:22 +0200 🔧 AI Nachrichten tsecurity.de

    Leadership wants to scale AI. Budgets are tripling. Adoption is up.

    Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?

    Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data they have was never designed to produce that answer.

    Applying lessons learned from managing cloud spend won’t be a fix for the AI and ROI quandary. True, cloud taught a generation of CFOs that billing without business context is noise. So to get cloud ROI, they stitched two data sources together: cost data plus business data. AWS reveals which account, which region, which tag, which resource. Merge in customer and product mappings on top and the ROI of the cloud spend comes into focus.

    But AI is harder. It requires three data sources: cost, business, and telemetry—the automatic collection of data from disparate sources that helps to clarify the whole picture of what happened and why. An executive or engineering lead can have AI invoices and customer revenue. But they have no way to connect them to business value. The token count on the OpenAI invoice does not specify which customer triggered which call, which feature it served, or whether the prompt produced a business outcome. That data does not exist in the provider’s billing.

    AI providers won’t fix this problem

    The situation is not likely to change anytime soon because AI providers are not in the business of attributing an enterprise’s costs to that enterprise’s customers. Instead, AI providers are in the business of selling tokens. The granularity they expose is the granularity their billing systems require, not the granularity a CFO requires.

    Not convinced? Compare what AWS gives you to what an AI provider gives you.

    AWS billing exposes resource IDs, account hierarchies, region, SKU, tag metadata, usage by the minute. Every dollar can be attributed to a workload, a team, a customer segment if it was tagged correctly. The data is rich enough that mature FinOps teams built unit economics on top of it years ago.

    An AI provider invoice gives you tokens consumed by model, with optional grouping by API key. That is the resolution. No request-level attribution. No customer ID. No feature mapping. No prompt outcome. No retry identification. Multi-step agent workflows collapse into a token count. Imagine a large bank receives a multi-million dollar AI invoice each month. But it has no visibility into what parts of the business were responsible for what parts of the cost so cannot allocate them.

    If an enterprise wants to know what AI cost drove which customer or feature, it has to capture that data itself, inside an application, before the call leaves it. 

    Three required sources

    Building AI ROI measurement requires three data sources, stitched together in a single model.

    1. Cost data, normalized across providers. Every AI provider delivers cost differently. OpenAI invoices in one taxonomy, Anthropic in another, fine-tuning vendors and inference platforms each in their own. Cloud GPU costs sit in AWS or Azure billing. Vector database costs land in Pinecone or Snowflake invoices. None interoperate by default. Normalization is necessary but not sufficient. It will put all your AI costs in one schema. It does not tell you what they produced.
    2. Application-layer telemetry. This is the source most organizations are missing, and the one that makes AI ROI structurally different from cloud ROI. It requires instrumenting AI calls inside your application across six categories: request-level tracing tied to a customer or session ID; feature attribution tied to the product surface that triggered the call; agent-step capture for multi-step workflows; retry and fallback identification so recovery costs don’t get attributed to primary calls; model selection logging that records which model was chosen and why; and outcome capture that ties each call to whether it produced business value. None of this data exists in the provider’s billing. All of it has to be captured at the moment the call is made and stored in a system that can be stitched to the cost data.
    3. Business data. Revenue, customer segments, product hierarchies, and feature usage. The same business data already feeding your CRM and analytics stack, mapped to the customers and features the telemetry layer attributes calls to.

    Stitched together, the three sources produce the unit economics every AI investment decision now requires: cost per customer interaction, margin per feature, profitability per agent workflow, ROI per model choice. None of these can be calculated from billing data alone. None can be calculated from telemetry alone. They require all three sources, modeled together in a way that maps cost to outcome.

    Why agentic AI makes this urgent

    Single-call inference is the easy case. One request, one cost, one customer, one outcome.

    Agentic workflows are different. An agent decomposes a task into multiple steps. Each step calls a model. Some steps fall back to a different model when the first fails. Some steps retry on a poor result. Some steps invoke external tools that themselves cost money. A single user request can produce dozens of inference calls across multiple providers, with the cost compounding in ways the provider invoice cannot disaggregate.

    If telemetry does not capture agent-step granularity, no one will know which steps are profitable. Aggregate costs will show up three weeks later in the invoice. By then, the workflow has been running at scale, customers are onboarded, and unprofitable paths have been retried thousands of times.

    When agents make the calls, the volume of cost-generating events without business context attached grows by an order of magnitude. The window for instrumenting this before it becomes unmanageable is closing.

    What changes when the three sources come together

    Once the three sources are stitched together, the AI investment conversation changes.

    Five different ways to build the same AI capability stop looking equivalent. They converge on adoption metrics and diverge by 10x on cost. The team picks the approach that delivers a similar business outcome at one-fifth the cost, because the team can finally see the difference. Product teams design features with margin awareness from the architecture phase, not from the post-launch budget review. Engineering teams choose model architectures with cost-per-outcome data alongside latency and quality. Leadership evaluates AI initiatives the way they evaluate any other capital allocation: on unit economics, not on the engagement chart. Aggregated invoices track the cost per customer interaction. Engagement metrics reveal margin per feature. Gut-instinct model selection is checked against real cost-per-outcome model selection results. 

    Within seconds, everyone can see which AI features are profitable, which should scale, and which should be killed. This is the insight everyone is looking for and companies that achieve it will optimize the benefits of AI.

    The build trap

    AI costs are compounding now. The board is not waiting 18 months for an internal project to reach production.

    The temptation to build it anyway has never been sharper. AI coding tools have changed what a small engineering team can ship in a quarter. The instrumentation layer looks tractable. The cost normalization looks like a weekend project. The semantic model feels like something a senior engineer could draft over a sprint.

    It is a trap. Three reasons.

    Volume is the first. A production AI footprint generates millions of telemetry events per hour, and that volume scales with agentic adoption. Real-time ingestion, correlation, and attribution at that scale is not the same problem as vibe coding a prototype in an afternoon. It is a permanent operational system that has to be right every minute of every day.

    The vendor landscape is the second. Cost data arrives in delayed billing windows from providers with non-interoperable schemas. Schemas change without notice. New AI providers enter the landscape monthly, each with its own taxonomy and metering. The system is not built once. It is maintained against a moving target that moves faster than most internal release cycles.

    The third is what the first two add up to: this is business-critical infrastructure. The CFO and the board are going to make capital allocation decisions on the data this system produces. When schema drift goes unnoticed for two weeks, when an agent telemetry stream stops correlating to a vendor that quietly changed its billing API, the cost of being wrong is not a sprint of cleanup. It is a quarter of misallocated capital.

    The build-vs.-buy question for engineering leaders has changed. It’s not “can we build this?” The honest answer is yes. The real question is whether the marginal hour of your strongest engineers is best spent stitching cost data to telemetry to business outcomes, or building the AI products that produce the revenue the cost data is measuring.

    The capability is reproducible in weeks. The choice is whether to spend the next 18 months building it, or the next 18 months acting on it.

    —

    New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

    ]]>         <![CDATA[WSL container: A quiet revolution for Windows development]]> https://tsecurity.de/de/3688476/ai-nachrichten/wsl-container-a-quiet-revolution-for-windows-development/ https://tsecurity.de/de/3688476/ai-nachrichten/wsl-container-a-quiet-revolution-for-windows-development/ Thu, 23 Jul 2026 11:07:20 +0200 🔧 AI Nachrichten tsecurity.de

    Running containers on Windows has never been as easy as it should be. While there are versions of Docker Desktop and Podman that work with both the Windows Subsystem for Linux (WSL) and Hyper-V, I’ve found both overly complex and unstable. Where they have worked, it’s turned out that Hyper-V has been the best option, using a Linux virtual machine to host my containers. That all adds up to overhead, layers of virtual infrastructure that get in the way of work and that need to be rebuilt every time I restart my PC.

    Part of the problem is WSL. It’s a good tool, but WSL2’s file-system integration is slow, and you’re left having to work with code using Visual Studio Code’s remote integration, which means putting a VS Code Server in every container you’re building and testing. If you’re working with Kubernetes, that’s even more complexity that needs to be managed, dragging you away from code.

    I ended up running most of my container testing and development from a separate machine, a Linux server running containerd. But though it worked (and had all the resources of workstation-class device), it wasn’t portable, and for some reason I’ve yet to uncover, Ubuntu’s remote desktop access doesn’t work for me.

    So, it was good to see Microsoft make several announcements around WSL at Build 2026 as part of a push to make Windows a developer platform again. The first, an improved WSL3, is still some way away, but the second, WSL-native container support, shipped at the end of June. It is already seeing community-driven development of Docker Desktop-like tooling to help monitor and manage your containers.

    Delivering a WSL-based container platform fits in with the other developer-focused Windows announcements at Build. Making Windows behave more like Linux is Microsoft responding to developer needs, given that more than 50% of servers on Azure run a Linux distribution. Linux is the basis of cloud-native infrastructure, so developers need to be able to build on it wherever they are.

    Getting started with WSL container

    WSL container provides a new CLI that works in parallel to the familiar WSL, with commands to support the entire container life cycle, from creation to shut down. All you need to do to get started is upgrade your WSL installation to the current pre-release build (at the time of writing this was 2.9.3). Simply open an administrator PowerShell terminal and enter wsl --update --pre-release.

    This downloads and installs the latest WSL release. Once you’ve closed and re-opened your terminal (to ensure that you’ve updated its context) you can check that WSLC has installed by entering wslc, which should list the available commands. The new CLI is aliased to WSL container, if you prefer to keep your container work separate from WSL (and avoid typos that might accidentally affect your WSL installations).

    Under the hood Microsoft is using WSL container to trial new integration points for Linux in Windows. One key change is the use of a new file system that significantly speeds up access to Windows from inside a container. Another improvement gives WSL container a new networking mode that relays networking connections directly through the Windows network stack, ensuring it has access to the same resources and security as Windows.

    Calling Linux containers from Windows applications

    Things get more interesting when you start to use the WSL container API from inside your Windows code. Here you can include calls to Linux containers inside your desktop applications, taking advantage of existing services, building and deploying containers from inside your CI/CD pipeline. Using the new file system and networking stack helps reduce the friction that comes with crossing the boundaries between the two platforms.

    The WSL container API is available as a NuGet package, with support for C, C#, and C++. It allows your code to start and stop containers, and interact directly with them, sending command-line calls and reading back responses. Where things get interesting is being able to launch a containerized service from your code, exposing its REST or gRPC APIs on a local network port. Microsoft has provided sample code to show you what’s possible at this early stage.

    Microsoft is doing something revolutionary here. It’s taking the cloud-native, service-driven model and bringing it into Windows and using it to bridge decades of divergent development. You no longer have to rewrite a service that works on Linux to run in Windows; all you need to do is containerize the service and launch it from the WSL container API. When you’re done, the API will tidy up after you, shutting down the container and reclaiming the memory it used.

    It’s important to remember that this is only the first public preview of a rapidly developing platform. There are many opportunities here to, say, build on the syscall translation layer developed for WSL1 to produce a native Windows-to-Linux application integration stack that removes the overhead of using web-based service calls. It will be interesting to see what develops, but this first release is very interesting indeed.

    Manage Linux containers from Windows

    If you want a Docker Desktop-like experience for building and testing containers on Windows developer hardware, you may not have long to wait. WSL container’s underlying API is already being used to build tools that manage and monitor containers for you. One such tool is the WSL Container Desktop, under development on GitHub. While there aren’t any release builds yet, it’s easy enough to compile and get running by cloning the source repository and building using the .NET CLI. You do need to have the Windows App SDK installed, and some features require access to the Azure CLI.

    WSL Container Desktop is built in C#, with a WinUI front end. It’s currently only verified for use on x64, though I was able to compile and run it on an Arm64 PC and use it to test and run containers. Once running, it gives you a well-designed front end for your WSL-hosted containers, showing what’s running and what resources they are using. You can link WSL Container Desktop to container registries, like Docker’s and Azure’s, so you can quickly pull base containers and then use the WSL container environment to add your own code and customizations.

    Your main interaction point is the WSL Container Desktop dashboard, which shows what containers are running and their current resource usage. Elements are displayed in cards, taking a cue from Windows’ own user interface and especially from its Settings app. From the dashboard, you can drill down into the available containers, with quick start, stop, and reload options, as well as an extended memory that includes the ability to open a web browser to the appropriate port. I tested this with a container that included an entire KDE webtop, giving me a Linux distro running in a container in my browser.

    Other options include a details view that displays current logs and provides tools for inspecting the state of a container. This is the type of tool that comes in useful when debugging and testing container applications, as it can provide insights that the WSL container CLI doesn’t offer. Another option helps you clean up after you’ve downloaded an image and don’t need it anymore, with analytics that show the largest images and images you haven’t used for some time. On top of its tooling for working with WSL containers, WSL Container Desktop provides a basic settings tool that helps you configure its look and feel, as well as how it integrates with Windows.

    Run Kubernetes inside Windows for cloud-native development

    One of the more useful features of WSL Container Desktop is the ability to quickly stand up a K3s Kubernetes instance in WSL that can be used to host WSL containers, providing a local environment to build and test cloud-native applications wherever you might be. The K3s tooling offers a similar experience to the Kubernetes project’s own Headlamp UI, making it easy to go between your development environment and a production Kubernetes cluster.

    It’s fair to describe WSL container as one of those Windows features you didn’t think you needed, but now it’s here you can’t live without it. WSL container simplifies building a container development tool chain in Windows, and at the same time allows you to think about a new generation of hybrid applications that take advantage of decades of development in both Windows and Linux.

    The result is something that was unimaginable a few years ago: dropping a Linux container into the middle of a Windows application and treating it as another local service. As the WSL container platform evolves, you should expect to see more ways of bringing Linux and Windows together, using containers to deliver a hybrid platform that gives us the best of both worlds at long last.

    ]]>         <![CDATA[iOS 27 CarPlay: Every New Feature Coming This Fall]]> https://tsecurity.de/de/3688187/ios-mac-os/ios-27-carplay-every-new-feature-coming-this-fall/ https://tsecurity.de/de/3688187/ios-mac-os/ios-27-carplay-every-new-feature-coming-this-fall/ Thu, 23 Jul 2026 08:57:19 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[This Week In Rust: This Week in Rust 661]]> https://tsecurity.de/de/3688059/tools/this-week-in-rust-this-week-in-rust-661/ https://tsecurity.de/de/3688059/tools/this-week-in-rust-this-week-in-rust-661/ Thu, 23 Jul 2026 07:18:12 +0200 💾 Tools tsecurity.de Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

    This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

    Want TWIR in your inbox? Subscribe here.

    Updates from Rust Community

    Official
    Newsletters
    Project/Tooling Updates
    Observations/Thoughts
    Rust Walkthroughs

    Crate of the Week

    This week's crate is xan, a TUI toolkit to work with CSV files.

    Thanks to Simeon H.K. Fitch for the suggestion!

    Please submit your suggestions and votes for next week!

    Calls for Testing

    An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

    If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

    No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

    Let us know if you would like your feature to be tracked as a part of this list.

    Call for Participation; projects and speakers

    CFP - Projects

    Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

    Some of these tasks may also have mentors available, visit the task page for more information.

    • No Calls for participation were submitted this week.

    If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

    CFP - Events

    Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

    • No Calls for papers or presentations were submitted this week.

    If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

    Updates from the Rust Project

    576 pull requests were merged in the last week

    Compiler
    Library
    Cargo
    Rustdoc
    Clippy
    Rust-Analyzer
    Rust Compiler Performance Triage

    The two most notable changes this week were #159115, which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks, and #159091, which enabled PGO for rustdoc, which makes it ~3-4% faster across the board.

    There were two large rollups with tiny performance regressions, which made it difficult to find the offending PRs.

    Triage done by @Kobzol. Revision range: 5503df87..d527bc9b

    Summary:

    (instructions:u) mean range count
    Regressions ❌
    (primary)    		 0.4% [0.2%, 1.0%] 40
    Regressions ❌
    (secondary)    		 0.7% [0.2%, 4.6%] 69
    Improvements ✅
    (primary)    		 -2.0% [-6.2%, -0.2%] 136
    Improvements ✅
    (secondary)    		 -2.6% [-8.4%, -0.2%] 119
    All ❌✅ (primary) -1.4% [-6.2%, 1.0%] 176

    2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups 34 artifact comparisons made in total

    Full report here.

    Approved RFCs

    Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

    • No RFCs were approved this week.
    Final Comment Period

    Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

    Tracking Issues & PRs
    Rust Compiler Team (MCPs only) Leadership Council Unsafe Code Guidelines

    No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team or Rust RFCs.

    Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

    New and Updated RFCs

    Upcoming Events

    Rusty Events between 2026-07-22 - 2026-08-19 🦀

    Virtual
    Africa
    Asia
    Europe
    North America
    Oceania
    South America

    If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

    Jobs

    Please see the latest Who's Hiring thread on r/rust

    Quote of the Week

    We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

    – Carl Lerche on r/rust about the launch of topcoat

    Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.

    Please submit quotes and vote for next week!

    This Week in Rust is edited by:

    Email list hosting is sponsored by The Rust Foundation

    Discuss on r/rust

    ]]>         <![CDATA[DXRacer Martian Review: A Gaming Chair That’s Not Out-of-This-World]]> https://tsecurity.de/de/3687761/it-nachrichten/dxracer-martian-review-a-gaming-chair-thats-not-out-of-this-world/ https://tsecurity.de/de/3687761/it-nachrichten/dxracer-martian-review-a-gaming-chair-thats-not-out-of-this-world/ Thu, 23 Jul 2026 01:19:11 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Cursor Releases Cursor Router: A Request-Level Classifier Delivering Frontier Coding Quality at 30–50% Lower Cost]]> https://tsecurity.de/de/3687719/ai-nachrichten/cursor-releases-cursor-router-a-request-level-classifier-delivering-frontier-coding-quality-at-30-50-lower-cost/ https://tsecurity.de/de/3687719/ai-nachrichten/cursor-releases-cursor-router-a-request-level-classifier-delivering-frontier-coding-quality-at-30-50-lower-cost/ Thu, 23 Jul 2026 00:47:23 +0200 🔧 AI Nachrichten tsecurity.de Cursor has made Cursor Router generally available for Teams and Enterprise plans. The system classifies each request on query, context, task complexity and domain, then routes it to the most suitable model. Cursor reports frontier-quality output at 60% savings in online A/B tests, and 30–50% savings for three early-access enterprise accounts measured against Opus 4.8 rates.

    The post Cursor Releases Cursor Router: A Request-Level Classifier Delivering Frontier Coding Quality at 30–50% Lower Cost appeared first on MarkTechPost.

    ]]>         <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687239/ai-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687239/ai-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 20:19:33 +0200 🔧 AI Nachrichten tsecurity.de

    Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

    The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

    The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

    For regulated industries or restricted connectivity

    Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

    These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

    The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

    In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

    Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

    The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

    Private AI behind the firewall

    Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

    “For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

    More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

    Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

    The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

    Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

    Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

    However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

    Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

    The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

    Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

    This article first appeared on CIO.

    ]]>         <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687195/it-security-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687195/it-security-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 19:56:30 +0200 📰 IT Security Nachrichten tsecurity.de

    Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

    The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

    The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

    For regulated industries or restricted connectivity

    Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

    These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

    The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

    In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

    Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

    The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

    Private AI behind the firewall

    Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

    “For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

    More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

    Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

    The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

    Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

    Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

    However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

    Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

    The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

    Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

    This article first appeared on CIO.

    ]]>         <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687189/it-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687189/it-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 19:49:12 +0200 📰 IT Nachrichten tsecurity.de

    Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

    The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

    The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

    For regulated industries or restricted connectivity

    Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

    These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

    The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

    In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

    Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

    The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

    Private AI behind the firewall

    Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

    “For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

    More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

    Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

    The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

    Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

    Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

    However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

    Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

    The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

    Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

    ]]>         <![CDATA[What’s New in Rapid7 Products and Services: Q2 2026 in Review]]> https://tsecurity.de/de/3686659/it-security-nachrichten/whats-new-in-rapid7-products-and-services-q2-2026-in-review/ https://tsecurity.de/de/3686659/it-security-nachrichten/whats-new-in-rapid7-products-and-services-q2-2026-in-review/ Wed, 22 Jul 2026 16:30:13 +0200 📰 IT Security Nachrichten tsecurity.de If Q1 set the pace for Rapid7's tools, Q2 accelerated it. This quarter brought a steady stream of product enhancements, platform investments, and customer-driven innovation across Rapid7’s portfolio. Each release was designed with a clear goal in mind: helping security teams reduce complexity while increasing speed, context, and confidence in their day-to-day operations. Here’s a closer look at what launched in Q2.

    Detection and response

    Streamline investigations with bidirectional and enriched Microsoft Defender alerts

    Bidirectional synchronization and enriched alert context for Microsoft Defender is now generally available for SIEM and MDR customers, enabling security teams to automatically synchronize alert status between Rapid7's SIEM and the Microsoft Defender console. With added process tree and user identity context, analysts can investigate threats more efficiently while reducing manual effort.

    Confidently scale detection engineering with Detection as Code

    Detection as Code enables security teams to build, test, version, and deploy detections using Terraform and modern engineering workflows. Built-in validation, guardrails, and version control help teams deliver higher-quality alerts, maintain more consistent coverage, and scale detection engineering more effectively.

    rapid7-detection-as-code-methodology.png
    Figure 1: Rapid7's Detection as Code methodology.

    Strengthen ransomware resilience with Ransomware Prevention for Incident Command

    Ransomware Prevention for Incident Command adds an intent-based layer of protection designed to stop ransomware encryption and endpoint damage before they disrupt operations. Built into the Insight Agent, this capability strengthens ransomware resilience while working alongside existing endpoint security investments, without adding operational complexity.

    Compliance

    New solutions webpages

    Across the globe, cybersecurity regulation is shifting away from static compliance checklists and toward ongoing risk management that blends proactive defense with effective detection and response. Rapid7’s platform, which brings exposure management and CTEM together with detection, response, and MDR, is well positioned to help organizations operationalize compliance across mandates such as NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP. To support that effort, Rapid7 has launched an updated library of dedicated compliance solution pages that map platform capabilities to the requirements that matter most across industries and regions. The first set of pages is live now, with more to follow in the coming weeks.

    rapid7-govramp-compliance.png
    Figure 2: Rapid7's new GovRAMP compliance solutions page.

    Exposure management

    Turn prioritized exposures into remediation progress

    We improved Remediation Hub to help teams turn prioritized exposures into more actionable remediation progress. Updates to the Top Remediations Report add asset-level context, including operating system, IP address, cloud provider, tags, endpoint protection, and patch management details, so teams can better understand what needs to be fixed and who needs to act.

    With clearer patch and endpoint coverage signals, reboot status, customizable filters, exportable reports, and scheduled email delivery, teams can spend less time assembling manual updates and more time tracking the remediation work that reduces risk. Read the full blog to learn more about how Exposure Command helps teams move from prioritized exposures to remediation progress.

    AI pre-triage for AppSec findings

    Rapid7 is also making application security testing faster and more focused with AI vulnerability pre-triaging for InsightAppSec. Available now for AppSec customers in supported regions, the capability uses AI to automatically remove false positives during the scan process, helping teams spend less time manually reviewing findings and more time remediating actual risk.

    Initial coverage started with BlindSQL, and the latest engine release adds AI validation for BlindNoSQL findings, including content-based and timing-based detections. The result is a cleaner, more confident view of application risk, so security teams can focus on high-impact vulnerabilities and accelerate remediation with less manual effort.

    Attack surface management

    Open-source MCP Server and Agent Skill

    We are delighted to announce the introduction of a free, open-source MCP Server and Agent Skill for Bulk Export. Bulk export is a highly efficient way to access all your Rapid7 vulnerability and exposure data to AI assistants and custom AI workflows. Built as an open-source bridge, it helps customers bring their Rapid7 data into the tools and experiences that work best for their teams. Check out our blog for more detail.

    rapid7-ai-agent-skill.png
    Figure 3: Agent Skill for Bulk Export.

    Turn exposure filters into live dashboards

    Surface Command also made exposure reporting easier with filter-based dashboard widgets. Teams can now turn saved asset and identity filters into live dashboards without writing Cypher queries, making it faster to track high-risk internet-facing assets, identity-driven exposure hotspots, unmanaged cloud infrastructure, and business-unit risk.

    For continuous threat exposure management programs, this helps teams move from one-off reporting to repeatable, always-on views of exposure risk and remediation progress. Read this blog to learn more. 

    Platform and Labs

    Rapid7 Command Platform

    Cyber GRC

    Rapid7 introduced Cyber GRC to select customers in Q2, giving teams an early look at a new way to connect security, risk, compliance, and third-party risk management in one program. Available to both Exposure Management and Detection and Response customers, Cyber GRC brings governance and compliance workflows closer to the security data teams already use every day.

    Cyber GRC will be broadly available in late July. It helps organizations move toward continuous compliance by mapping controls to real environment telemetry, automating evidence collection, and prioritizing risk with live attack surface context. That means teams can spend less time chasing audit artifacts, screenshots, and vendor risk details, and more time understanding which controls, assets, third parties, and risks need attention now.

    Rapid7 Labs

    Rapid7 Quarterly Threat Landscape Report

    The Rapid7 Quarterly Threat Landscape Report examines the key trends shaping today's threat landscape, drawing on MDR incident response, vulnerability intelligence, ransomware monitoring, and dark web telemetry. Q1 2026 data highlights the growing dominance of vulnerability exploitation as an initial access vector, the rise of zero-click vulnerabilities, evolving ransomware operations, and the accelerating pace at which attackers operationalize newly disclosed vulnerabilities. Read the report to explore all key findings and takeaways.

    rapid7-quarterly-threat-report.png
    Figure 4: Rapid7's quarterly threat report.

    The latest threat research

    Rapid7 researchers explored emerging trends shaping the threat landscape, including the growing commercialization of criminal AI-as-a-Service and the evolving tradecraft of advanced threat actors. From the underground adoption of AI tools for fraud and social engineering to an in-depth analysis of the Dropping Elephant malware campaign, these reports provide actionable intelligence on how attackers are adapting their techniques and what defenders can do to stay ahead.

    Emergent Threat Response

    This quarter's Emergent Threat Response (ETR) coverage highlights a sustained wave of high-impact vulnerabilities affecting widely deployed enterprise technologies, including Oracle PeopleSoft, Palo Alto Networks PAN-OS, Check Point VPN, Ivanti Sentry, cPanel/WHM, and Nginx UI. For each of these CVEs, Rapid7 tracked active exploitation and rapidly evolving attacker activity to provide timely guidance to help defenders assess risk and respond quickly. See all the details, and our latest ETR coverage, here.

    From strengthening detection and response to advancing exposure management, expanding governance capabilities, and delivering actionable threat intelligence, Q2 demonstrated Rapid7’s continued focus on helping security teams do more with less complexity. Every enhancement this quarter was designed to reduce manual effort, surface the context that matters, and help organizations make faster, more confident security decisions. We’re carrying that momentum into the rest of the year, so stay tuned to our blog and releases as we continue building the security operations platform that helps defenders stay ahead of what’s next.

    ]]>         <![CDATA[Oracle Patches 1,400+ Vulnerabilities, Critical Flaws Expose Enterprise Servers to Remote Attacks]]> https://tsecurity.de/de/3686201/it-security-nachrichten/oracle-patches-1400-vulnerabilities-critical-flaws-expose-enterprise-servers-to-remote-attacks/ https://tsecurity.de/de/3686201/it-security-nachrichten/oracle-patches-1400-vulnerabilities-critical-flaws-expose-enterprise-servers-to-remote-attacks/ Wed, 22 Jul 2026 13:59:14 +0200 📰 IT Security Nachrichten tsecurity.de Oracle has released its July 2026 Critical Patch Update (CPU), shipping 1,449 security patches that collectively remediate more than 1,200 vulnerabilities across databases, middleware, cloud services, and enterprise applications, in what is now the largest CPU in the company’s history. The scale of this release reflects not only expanding product complexity, but also a new […]

    The post Oracle Patches 1,400+ Vulnerabilities, Critical Flaws Expose Enterprise Servers to Remote Attacks appeared first on Cyber Security News.

    ]]>         <![CDATA[Leadership bottlenecks slow AI adoption]]> https://tsecurity.de/de/3685910/it-security-nachrichten/leadership-bottlenecks-slow-ai-adoption/ https://tsecurity.de/de/3685910/it-security-nachrichten/leadership-bottlenecks-slow-ai-adoption/ Wed, 22 Jul 2026 12:14:12 +0200 📰 IT Security Nachrichten tsecurity.de

    At Cisco, VP of engineering Jason Andrews deals with all the same technical issues as every other company deploying AI, including ensuring it’s governed, secure, and integrating multiple data sources, legacy systems, and AI models.

    But these issues are relatively straightforward compared to the bigger challenges relating to the fast pace of change, specifically how AI can touch and transform nearly every aspect of business.

    “We’re thinking about it every day,” he says. “My belief is we’ll be seeing a massive acceleration of everything.”

    In coding, for example, he’s witnessing productivity increases up to 110% with AI assistants. “I can build apps or custom integrations a lot faster,” he adds.

    And the real benefit of AI isn’t just in speeding up individual steps in a process, but in making AI the core of a new business process. But building it from scratch puts even more pressure on organizations trying to get employees up to speed on new ways of doing things.

    “We want to move fast, train people, and get them onboarded,” he says. “But what I thought AI was going to do for my organization nine months ago is different from three months ago.” So by the time something is rolled out, it’s changed three times.

    “I struggle with the change management aspect,” he says. “The legacy model of change management isn’t fast enough. How do you create that constant learning?”

    One of the ways Cisco approaches it is to create communities where people can talk about these issues and share best practices and governance, and you have to keep people’s minds open that every day is going to be different than the last, Andrews adds.

    Testing the AI waters

    Cisco isn’t the only organization struggling with change management in the face of the AI tsunami. In a survey of 2,000 global CEOs IBM released in May, 83% of them said AI success depends more on adoption than on the technology itself, and 77% said talent and technology roles are converging.

    “Thanks to Claude Code, our entire development cadence is exponentially greater than a year ago,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a Denver-based law firm with about 700 employees and clients around the US. But, as with Cisco, the biggest challenge isn’t technical.

    “In our industry, with our circumstances, we’re probably less constrained by technical capability than organizational constraints, culture, aptitude, the need to bind people to technology, and what helps me and the client,” he says. “There’s a tremendous amount of cultural shift that has to happen in our organization, which is far more demanding of my attention and complexity of thought than the technical stuff.”

    Companies that bill by the hour, such as law firms, may face additional challenges as attorney productivity increases because billable hours might go down. Alternatively, the total number of cases could go up as litigation becomes less expensive. Either way, firms that adapt will see competitive advantage, and the rest will fall behind, putting more pressure on the need for change management.

    “If people can’t embrace technology, we won’t be able to get a lot of value out of it,” says Johnson. “I’m talking to people about adapting their way of work. There are certainly a lot of people intrigued and anxious to dive in. They recognize the connection between the potential of the technology and what we do.”

    But helping everyone see that connection and then working with them to change their habits is difficult, and requires solid relationships and good communications. “That’s been far more of a bottleneck for us,” he says.

    To address the issue, the firm has developed a network of technology champions who also understand the legal side of the business. “Now we need lawyers who know how to use the technology and can articulate these things to the people we’re trying to reach,” Johnson says.

    But change management is only one leadership bottleneck slowing AI adoption. Companies also struggle with figuring out their vision for AI, with slow decision-making, and a tendency to focus on the past instead of the future.

    Vision and strategy

    In another survey, this time of 950 business leaders released by Grant Thornton in April, 51% said strategy is the biggest driver of ROI when it comes to AI adoption, but 79% of operations leaders said they don’t have a fully developed and implemented AI strategy.

    “Having leadership understanding why AI is needed and what objective they’re trying to achieve is very important,” says Shivi Verma, senior manager of engineering at Docusign. “Sometimes leadership doesn’t have a strategy for their organization on how AI should be adopted. Many times it’s bottom-up, which creates a chaotic experience.”

    When Docusign started adopting gen AI, different teams and organizational units wanted to go in different directions. “All were coming up with their own strategy and tooling,” he says. So Docusign brought business leaders together to understand the pain points, and decide on the technology.

    “Getting requirements and placing a bet on a specific technology was important,” he says, “as well as pivoting to a different technology if needed.”

    In order to adapt to changes, the company wanted to have a nimble approach, starting with smaller use cases, with power users, and problem areas.

    “We try to plan for four to six months,” he adds. “We set expectations for our leadership that we place a bet with a specific technology, but want to be able to pivot.”

    Today, the leadership challenge front lines have moved yet again, to agentic AI. “Folks are creating their own agents and deciding their own permissions,” Verma adds. “We’re still coming up with a governance strategy.”

    Slow decision-making

    When it comes to AI deployments, Dan Diasio, global AI consulting leader at EY and CTO for its US consulting business, admits he’s a bottleneck.

    There’s a great deal of interest in what AI can do, and using a variety of new AI tools. But since the firm deals with sensitive client data, safety is paramount. It’s a slow process, but important to build secure infrastructure, and to have trust in the technology. “That’s a reasonable bottleneck that makes sense,” he says.

    Trust in the tools they work with is essential because clients expect it. “Every tool we use has to go through a detailed security and information privacy impact assessment, as well as a whole other set of controls so they can be used appropriately and safely,” he says.

    These reviews can take a lot of time, though, and in the age of AI, speed is a highly valued currency. So how do you balance the two, when safety reviews can require input from a lot of different stakeholders and be extremely time intensive?

    “We’ve stood up a team to be able to quickly certify and address a variety of platforms,” Diasio says. “Instead of working with different departments in the way we used to, we’ve started identifying representatives from different departments into a cohort. Decisions we used to make in months now take weeks.”

    According to a West Monroe survey of more than 1,200 leaders released earlier this year, slow decision-making is already showing up on the bottom line. Nearly three out of four leaders said their organizations lose up to 5% of annual revenue to slow decision-making and delayed execution.

    And the top reasons for the delays? According to 40% of the managers surveyed, the problem was the skills gaps of overwhelmed teams, and 35% pointed to layers of management or approvals. Nearly half said they’re spending 10 to 25% of their time on rework, excessive approvals, and unnecessary meetings, and more than half say up to 50% of their projects fail or lose momentum to delays.

    Focus on the future, not the past

    When it comes to the decision about where to apply AI in an organization, the tendency, Diasio says, is to turn to the experts with the most expertise in the business. But these are the same people most likely to focus on improving on what they’re already doing.

    “And that often blinds people to what’s possible in the future,” he says. “That becomes a significant bottleneck.” So the solution is to revamp the decision-making process around the new reality.

    “What we see some advanced companies do is give people who don’t understand the process but understand the technology equal footing with people who don’t understand the technology but understand the process,” he says. “A lot of companies are disproportionately focused on just addressing their operating model right now.”

    Instead of focusing on what they’re currently doing, AI-native companies will start with a focus on the customer, he says. This shift in focus isn’t likely to show up immediately on the bottom line, or result in the highest possible number of pilots going into production.

    “If leaders are in a position where they’re justifying the use of a technology to the board or their CFO, they become a bottleneck when they start demonstrating their value in terms of the number of things they’re doing,” Diasio says.

    But 150 or 200 use cases deployed into production may feel like progress, like things are happening in the organization. But all these use cases are a waste of time and money if they’re applied to existing processes that don’t move the needle. “We see that happen in organizations today,” he says. “Maybe we need to reinvent the processes.”

    It’s no secret that companies will need to change in order to adapt to AI. Deloitte recently surveyed 660 global technology leaders and 81% said their current operating model can deploy and govern AI enterprise-wide, but 75% also said their organization must change its operating model within the next 12 to 18 months to drive greater value.

    AI ROI is real, says China Widener, Deloitte vice chair and US tech, media, and telecom industry leader. But it’s currently weighted toward efficiency gains, with broader business transformation and revenue upside still developing.

    Another Deloitte survey showed that the clearest results from AI were in productivity, with 66% of organizations reporting gains, and cost efficiency, with 40% saying AI reduces costs. “However, revenue impact is still emerging,” says Widener. “Only one in five companies says AI is driving top-line growth today.” But optimism prevails, with 74% expecting it to do so in the future.

    ]]>         <![CDATA[Your instant Android backup upgrade]]> https://tsecurity.de/de/3685867/it-nachrichten/your-instant-android-backup-upgrade/ https://tsecurity.de/de/3685867/it-nachrichten/your-instant-android-backup-upgrade/ Wed, 22 Jul 2026 12:02:52 +0200 📰 IT Nachrichten tsecurity.de

    Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

    In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

    One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

    Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

    Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

    All you’ve gotta do is find and flip that one new switch.

    [Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

    The Android backup lowdown

    So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

    ‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

    Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

    Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

    That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

    See?

    Android backup documents
    The easily overlooked new option for backing up documents on Android.

    JR Raphael, Foundry

    The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

    Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

    Lemme show ya how.

    Android’s document backup addition

    I promise: This couldn’t be much simpler.

    No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

    Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

    However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

    Android backup options
    Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

    JR Raphael, Foundry

    And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

    If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

    Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

    Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

    But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

    Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

    Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

    ]]>         <![CDATA[AI, security operations and the new race against time]]> https://tsecurity.de/de/3685757/it-security-nachrichten/ai-security-operations-and-the-new-race-against-time/ https://tsecurity.de/de/3685757/it-security-nachrichten/ai-security-operations-and-the-new-race-against-time/ Wed, 22 Jul 2026 11:11:50 +0200 📰 IT Security Nachrichten tsecurity.de

    When Anthropic unveiled Project Glasswing and the Mythos model, much of the discussion focused on the capabilities themselves.

    Security leaders debated what these systems could mean for vulnerability discovery, exploit development and the pace of offensive innovation. Researchers examined technical benchmarks. Industry observers questioned how quickly these capabilities might fall into attackers’ hands.

    Those conversations are important. They also point to a larger question that predominates my discussions with CISOs: How much time do we have?

    Over the past year, conversations about AI in cybersecurity have changed noticeably. Twelve months ago, security leaders wanted to understand whether AI could meaningfully improve security operations. They wanted to know whether it could accurately investigate alerts, reduce analyst workload and operate reliably in production environments.

    Today, security leaders are asking about timelines, implementation, how quickly AI is changing the threat landscape and what that means for how security teams operate.

    Anthropic’s Mythos and Glasswing, OpenAI’s Daybreak and advances in DeepSeek accelerate those conversations. Each development provides another glimpse into the pace at which AI capabilities are advancing.

    AI now reasons through security problems that historically required highly specialized expertise. The implications span vulnerability discovery, attack-path analysis, reconnaissance, social engineering and security operations.

    The shift reflects a broader reality: cybersecurity is entering a period where the pace of adaptation may matter as much as the quality of defenses themselves. AI is accelerating both offense and defense simultaneously. Organizations are quickly redesigning security operations around that reality.

    One consequence is becoming increasingly visible. For years, cybersecurity teams invested enormous effort in discovering threats, identifying vulnerabilities, gathering telemetry and collecting intelligence. AI is accelerating many of those activities simultaneously. Visibility is improving. Discovery is accelerating. Investigations are becoming faster and more comprehensive.

    The bottleneck is beginning to move. The challenge increasingly centers on how quickly organizations can act on what they know. The organizations that gain an advantage may not be the ones with the most information. They will be the ones who can operationalize that information the fastest.

    The timeline is compressing

    Cybersecurity has experienced many major technology transitions. Cloud computing changed infrastructure. Mobile devices expanded the attack surface. Digital transformation connected systems that were previously isolated.

    AI introduces a different dynamic.

    Most technology transitions unfolded over years. Organizations had time to evaluate, pilot, deploy and gradually adapt operating models.

    The current AI cycle moves at a different pace.

    Capabilities improve continuously. New models arrive every few months. New research emerges every few weeks. Security teams absorb developments at the same time attackers do.

    Vulnerability discovery provides a useful example. Security teams have long operated around a familiar cycle of discovery, validation, remediation and protection. AI systems accelerate every stage of that process. Similar patterns exist in phishing, reconnaissance, social engineering and attack planning.

    A vulnerability that once moved through that cycle over weeks increasingly now moves through those stages in days or, in some cases, hours.

    Attackers are already operating at the speed of AI. Defenders are now focused on reaching the same level of operational speed.

    This shift is changing the questions CISOs ask.

    Early discussions focused on capability. Could AI investigate alerts accurately? Could it operate reliably in production environments? Could it be trusted with meaningful security work?

    As organizations gained experience with AI, the discussion shifted toward implementation. Security teams began evaluating where AI could create operational leverage and how quickly they could deploy it into existing workflows.

    Today, many CISOs are focused on timing.

    The pace of advancement is influencing planning horizons, budget decisions and operating-model discussions. Security leaders are evaluating how quickly they can introduce AI into investigations, threat hunting, detection engineering and response workflows. Boards are asking questions. Executive teams are paying attention.

    Security programs that once viewed AI as a future initiative increasingly view it as a current operational priority.

    The industry is moving from evaluating AI as a technology to incorporating AI as a security capability.

    The timeline compression creates pressure on the traditional security operations model. Investigation speed, response speed and defensive coverage increasingly determine whether organizations can keep pace with adversaries operating with AI assistance.

    Security operations are entering a new phase

    The impact of AI is becoming particularly visible inside the SOC.

    Many security operations centers were built around a straightforward assumption: alerts flow to human analysts who conduct investigations. Operational capacity scales primarily through hiring.

    The volume of security data, the number of alerts and the complexity of modern environments have steadily increased. Security teams have responded by building processes, adding tools and creating specialized analyst roles.

    AI introduces a new source of operational capacity.

    Investigations that require analysts to examine dozens or hundreds of artifacts across endpoint, identity, cloud, network and email systems can now be performed in minutes. Analysts gain access to investigative depth and consistency that would be difficult to achieve manually at scale.

    Many security leaders now view this capability through the lens of operating model design. They are examining how investigations are performed, how work is distributed and where human expertise creates the greatest value.

    The evolution of the analyst role

    One of the most important developments emerging from early production deployments is the evolution of analyst responsibilities.

    Security analysts remain central to security operations. Their expertise becomes even more valuable as AI systems take on larger portions of investigative work.

    Threat hunting, detection engineering, response strategy, governance and oversight are receiving increased attention. Analysts spend more time shaping how investigations are conducted, evaluating outcomes and improving overall security operations.

    Many organizations are already beginning this shift.

    Teams are investing more heavily in proactive security activities. Detection engineering programs are expanding. Threat hunting is becoming more accessible. Analysts are spending more time improving systems and less time repeating investigative tasks.

    These changes create what I think of as an analyst-amplified SOC: an environment where AI expands the reach of security professionals and enables deeper security work across the organization.

    Trust is critical and it doesn’t have to compromise speed

    Faced with a compressing timeline, the instinct is to treat speed and trust as a trade-off, i.e., move faster, verify less. That trade-off feels inevitable. It isn’t.

    You don’t trust AI in the abstract. You trust that a system understands your tools, your telemetry and the edge cases that only exist in your network. The problem was never speed. It’s speed without context. The faster a context-blind system runs, the more decisions you’re left unable to verify.

    The tension eases when the system is quick to deploy and tunes to your environment once it’s there, rather than treating every network the same. Speed stops being the thing you trade against trust. The more it learns about your environment, the sharper and more trustworthy it becomes, so the two compound rather than compete. Trust still develops through operational evidence such as measurable outcomes, visibility into decisions and consistent performance. But where that evidence accrues matters.

    The organizations making the fastest real progress understand this. They don’t compromise quality and trust for speed. They invest in AI that earns trust inside their own environment, so they don’t have to choose.

    Leadership during a period of rapid change

    The conversations surrounding Mythos and Glasswing reflect a broader reality facing security leaders.

    AI is becoming part of both offense and defense. Security teams are incorporating it into investigations, detection engineering, response workflows and threat hunting. Attackers are incorporating it into their own operations.

    Security leaders have an opportunity to modernize operating models, expand defensive capacity and build organizational experience while these capabilities continue to evolve.

    The organizations making progress today are investing in readiness. They are building experience, adapting workflows and preparing teams for a new model of security operations.

    The next phase of cybersecurity will be defined by how effectively organizations combine human judgment with machine-scale execution.

    The question facing security leaders is increasingly clear: How quickly can their organizations adapt to a continuously changing threat environment?

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Seven sins of the modern software developer]]> https://tsecurity.de/de/3685746/ai-nachrichten/seven-sins-of-the-modern-software-developer/ https://tsecurity.de/de/3685746/ai-nachrichten/seven-sins-of-the-modern-software-developer/ Wed, 22 Jul 2026 11:04:50 +0200 🔧 AI Nachrichten tsecurity.de

    If you ask us in an official setting, our official position is that software engineering norms still apply. Rigorous CI/CD pipelines, elegant architectural patterns, and an unyielding commitment to maintainable code remain the standard. We will use weighty words like “determinism,” “scalability,” “idempotency,” and “domain-driven design.”

    But behind closed doors, late at night, bathed in the glow of a dark-mode IDE, a different and more sordid reality is exposed. Hunched over the console with a manic gleam in the eye, the programmer has become power-drunk on LLMs. Like mad wizards casting spells, we summon the awesome powers of models and agents to satisfy our every programming whim—and commit acts of software engineering that would make Fred Brooks blush.

    Let’s just be honest about what is actually happening.

    Esoteric knowledge is superfluous

    Forget OOP and FP. Forget the CAP theorem, the holy crusade of DRY, and the design patterns. Honestly, you can even forget what frameworks, runtimes, and deployment platforms you are using. The AI will figure out what is best to use and understand what is already in place. We have more mental bandwidth for working on our side project (a novel about AI taking over the world). 

    Of course, I exaggerate. A little.

    The docs are dead to us

    We still say RTFM, but the truth is, we haven’t really read a page of vendor documentation since 2023. Stack Overflow, once our Internet Mecca, is a husk. When a package throws a weird exception, we don’t trace the execution path or read the release notes. We highlight the red text, copy the entire 200-line stack trace, dump it into the chat, and wait for the machine to spoon-feed us the solution.

    Better yet, we just have the agentic IDE spot the error, divine a solution, and ask us if it’s OK. We might glance at the problem-solution description, if we have gone around the circle on the problem for a few cycles. Maybe. If we don’t have the agent set up for auto-confirm.

    We used to buy heavy tomes like “Rust In Action” that were more like masonry blocks than literature. Now? We just ask an AI to transliterate our JavaScript logic into Rust. We are no longer engineers methodically learning a system. We are glorified copy-paste orchestrators hoping that the stochastic parrot behind the prompt guesses the syntax correctly.

    We ignore how the back end is wired

    We act like we meticulously designed the data flows, carefully crafted the relational constraints, and mindfully mapped the API relationships. The reality is rather more disturbing: We asked the AI to scaffold a modern deployment, hooked it up to a back-end database, and just sort of… ran it.

    It created security rules we don’t fully understand. They do seem to work, however, which is nice. 

    It generated a schema that we skimmed for about four seconds. It looks reasonable.

    It wrote infrastructure-as-code scripts that provisioned cloud resources we are hoping don’t blow a hole in the budget. Presumably, whoever is in charge of that will manage it by stuffing the metrics into another chatbot.

    We nodded, committed the code, and went to lunch. If management asked us to manually deploy the stack from scratch, configure the environment variables, and wire the API routes without our chat window, we would give them a vacant stare.

    We understand that management is also using AI to manage the project.

    Our tests are uncomfortably incestuous

    Test-driven development (TDD) used to be a beautiful dream, ever just beyond reach. It made us feel glorious and despondent at turns. It would burden us with sprawling dependencies if implemented too religiously. (See The Grug Brained Developer in this regard.)

    But now we can attain 95% test coverage almost effortlessly. Why not just add them in while we are auto-generating everything else?

    We can now wax at length to anyone who will listen about our astounding test coverage and our automated quality assurance. Unit tests, integration tests, smoke tests, you name it. What we conveniently leave out is that the AI wrote the complex application logic, and then we asked the exact same AI to write the test suite to validate the code it just dreamed up.

    It is a hermetically sealed loop of algorithmic self-congratulation. The mocks, the edge case, and the assertions are an echo chamber of the model’s original assumptions. The machine is grading its own homework, giving itself an A+.

    And we are happy to accept this because, beautifully, when the code has to change, the AI will effortlessly hallucinate new tests to adapt to the churn.

    We pass off the AI’s architecture as strategy

    AI can produce astonishing design documents. Truly breathtaking. They are cogent, they’re beautifully formatted, and they seamlessly bridge the gap between high-level business goals and granular technical specs. They even include those auto-generated sequence diagrams that wow management.

    When we present these spotless architectural proposals in the Tuesday sprint planning meeting, we lean back, take a long sip of coffee, and humbly wave away the team’s praise.

    What we don’t mention is that we spent exactly four seconds generating it.

    Are these AI-generated documents just as liable as human ones to hide severe, mortal flaws in scope and alignment? Absolutely. They might contain a foundational logic bomb that will eventually doom the entire project. But the markdown is so crisp, and the bullet points are so persuasive, that the eye just glides right over it. We will never truly know the depth of the disaster until it is far too late. But hey, we’ll burn that bridge when production catches fire. Until then, we are strategic visionaries.

    We’re addicted to vibe coding (but only in secret)

    We loudly mock the term on social media. We roll our eyes in Slack channels when the kids on TikTok talk about vibe coding their new startups. We fiercely cling to our identities as hardened, serious developers who understand memory management, garbage collection, and bitwise operators. We are professionals, damn it.

    But late at night, when the managers are asleep and no one is looking? We absolutely love it. We love just throwing a chaotic, half-baked thought at the canvas, pouring a drink, and watching the AI magically build a functioning user interface based entirely on our long-deferred whims. I may finally build that working Ultima V clone. The thrill of typing “Create an app that tracks my cryptocurrency portfolio but makes it look like the interface from Neuromancer” and having it appear 30 seconds later is heady stuff.

    The more deeply rooted in the hard, old-school realities of programming, the more profound is the joy the developer finds in the possibility of AI coding. 

    We beat the problem into submission with prompts

    Like Adam Sandler in “Uncut Gems,” we are convinced the next round will fix everything. This is us with prompts. When things are going really off the rails, instead of putting our boots on and wading into the brambles of complexity, we resort to tonal adjustments. These range from the condescending:

    This problem is not fixed. Look at it closely. The error is right here.

    To the desperate:

    We have been working on this same problem for hours now!

    To the pathetic:

    Can’t you find a different approach to try?!

    The astonishing part? It often works.

    But there is no poetry left at the bottom of the rabbit hole; it is verbal warfare. When the context window collapses, when the regressions start cascading, and when the AI stubbornly refuses to follow the most basic rules of temporal logic, the mask of professionalism drops away and something far more atavistic makes its appearance. We stop asking nicely, stop trying to understand the why, delete the pleasantries, and capslock our intent.

    What we have here is a failure to communicate!

    We feed the same failing stack trace back into the prompt over and over and over again, aggressively hammering the constraints, explicitly forbidding certain libraries, and pasting in release notes just to confirm that the AI lacks the latest APIs. We force the model down a narrower and narrower path until the code finally stops throwing errors. We don’t actually debug anymore, trace variables, or step through functions. We just apply relentless, iterative pressure until the machine surrenders. We beat it into submission. And then, we push to production.

    In fact, there is a real skill here—a sheer “will to completion” that remains in the act of building software. We invest just as much time, energy, and heart wrestling the bot as we ever did emitting syntax.

    A blacker box

    The only profession more given over to using AI like a cursed Level 13 artifact than programming is writing. Writing of course is far more open to public scrutiny than code.

    And while my tongue has been firmly in my cheek here, my faith in coders as good guys makes me more curious to see what we create than troubled by the dangers. 

    It was once the case that only other programmers could understand what programmers were doing, what they were producing. Now not even that is true. Only the machine knows what the machine is doing. We just keep it tethered to our aims. Hopefully.

    ]]>         <![CDATA[Firefox 153.0 behebt über 60 Schwachstellen und erstellt QR-Codes]]> https://tsecurity.de/de/3685544/it-nachrichten/firefox-1530-behebt-ueber-60-schwachstellen-und-erstellt-qr-codes/ https://tsecurity.de/de/3685544/it-nachrichten/firefox-1530-behebt-ueber-60-schwachstellen-und-erstellt-qr-codes/ Wed, 22 Jul 2026 09:51:01 +0200 📰 IT Nachrichten tsecurity.de

    Die neue Firefox-Version 153 fĂźr Windows, macOS, Linux und Android bringt einige Verbesserungen bei der Benutzung wie etwa HDR-Videowiedergabe, abgeschottete Tab-Umgebungen, und QR-Code-Erzeugung zur Link-Weitergabe. Die Entwickler haben mehr als 60 SicherheitslĂźcken gestopft. Updates gibt es auch fĂźr die ESR-Versionen.

    Im Sicherheitsbericht fĂźr Firefox 153 nennt Mozilla mehr als 63 beseitigte SicherheitslĂźcken, von denen 60 durch externe Sicherheitsforscher entdeckt und gemeldet wurden, drei davon durch OpenAI Codex Security. Mozilla stuft 17 dieser Schwachstellen als hohes Risiko ein. Bei vier dieser LĂźcken drohen AusbrĂźche aus der Browser-Sandbox.

    ▶Die neuesten Sicherheits-Updates

    Weitere 35 Schwachstellen sind als mittleres Risiko ausgewiesen, der Rest als geringes Risiko. Die drei letzten Einträge im Sicherheitsbericht fassen eine nicht angegebene Zahl intern gefundener, als hohes Risiko eingestufter Sicherheitslßcken zusammen, die aus Programmierfehlern bei der Speicherverwaltung resultieren. Die Lßcken sind danach gruppiert, welche Programme und Programmversionen betroffen sind.

    Was ist neu in Firefox 153?

    Für Windows-Nutzer bietet Firefox 153 die Wiedergabe von HDR-Videos (High Dynamic Range). Voraussetzung ist, dass der HDR-Modus in den Windows Bildschirmeinstellungen aktiviert ist. Notebook-Displays, die lediglich „HDR Video-Streaming“ bieten, werden derzeit nicht unterstützt, ebenso wie Smartphone-Videos im Hochkant-Format.

    Mit dem integrierten PDF-Betrachter und -Editor kĂśnnen Sie nun mehrere PDF-Dateien zusammenfĂźhren, indem Sie sie in die PDF-Sidebar ziehen. Auch kĂśnnen Sie jetzt Bilder als neue Seiten in PDF-Dokumente einfĂźgen.

    Wenn Sie einen Link weitergeben wollen, etwa auch an Ihr eigenes Smartphone, ohne einen Web-Dienst (wie Firefox Sync) zu benutzen, kĂśnnen Sie mit Firefox 153 einen QR-Code erstellen. Firefox hebt nun das Symbol fĂźr die Standort-Freigabe in roter Farbe hervor, wenn eine Website Zugriff auf Ihren Standort hat.

    Firefox 153 erstellt QR-Codes
    Link mittels QR-Code teilen

    fz

    Das mit Firefox 149 eingeführte und in Firefox integrierte Gratis-VPN bietet weiterhin eine vorübergehend (bis Ende August) auf 28 Länder erweiterte Auswahl virtueller Standorte mit uneingeschränktem Datenvolumen. Das kostenlose VPN ist derzeit für Firefox-Nutzer in den USA, Kanada, Großbritannien, Frankreich und Deutschland verfügbar.

    Tipp: Unabhängig davon, dass Sie Ihren Browser stets aktuell halten, sollten Sie die Sicherheit Ihres PCs zusätzlich mit geeigneter Antivirus-Software verbessern. Gute Antivirus-Lösungen stellen wir in „Die besten Antivirus-Programme 2025 im Test: So schützen Sie Ihren Windows-PC“ vor. Falls Sie großen Wert auf anonymes Surfen legen, sind wiederum gute VPN-Programme einen Blick wert.

    Weitere Browser-Updates

    Neben Firefox 153.0 sind auch die ESR-Ausgaben 140.13.0 und 115.38.0 erhältlich. Letztere gibt es allerdings nur für Windows 7 & 8.1 sowie macOS 10.12 bis 10.14. In den ESR-Versionen haben Mozillas Entwickler diejenigen der oben genannten Schwachstellen behoben, die schon im teils gut abgehangenen Code dieser Browser-Generationen stecken. Das sind in Firefox 140.13 mindestens 32 und in Firefox 115.38 immerhin noch wenigstens 14 geschlossene Sicherheitslücken. Darunter sind zwei als kritisch eingestufte Schwachstellen, die bereits in Firefox 152.0.6 beseitigt wurden. Firefox 153 ist außerdem die Basis für die nächste ESR-Generation. Das bedeutet, Firefox ESR 140 wird im Oktober durch Firefox ESR 153 abgelöst.

    Gnadenfrist fßr Windows 7 & 8 erneut verlängert

    Firefox ESR 115 wird vorerst bis März 2027 (v115.52) weiter mit Sicherheits-Updates gepflegt. Wenn Sie Firefox 115 unter Windows 7, 8.1 oder macOS 10.12 bis 10.14 einsetzen, erhalten Sie zumindest fßr den Browser weiterhin aktuelle Sicherheits-Updates. Rechtzeitig vor Ablauf dieser Gnadenfrist wird Mozilla die Situation neu bewerten und dann entscheiden, ob es eine weitere Verlängerung gibt.

    Updates fĂźr Tor Browser und Thunderbird

    Der neueste Tor Browser 15.0.19 basiert auf Firefox ESR 140.13. Das ansonsten von Mozilla unabhängige Tor-Projekt und die Nutzer des Tor Browsers profitieren so von den in Firefox gestopften Sicherheitslücken. Tor Browser 15.0.9 bringt die Erweiterung NoScript 13.6.31 mit. Das Tor Projekt hostet NoScript für seinen Browser inzwischen selbst. Erkennbar ist das daran, dass diese NoScript-Version den Suffix „.1984“ (aktuell also 13.6.31.1984) trägt – George Orwell lässt grüßen. Ansonsten ist sie identisch mit der Version auf AMO (addons.mozilla.org). Einen Tor Browser für ältere Systeme gibt es nicht mehr. Auch Mozillas Mailer Thunderbird 153.0 und 140.13.0esr sind verfügbar. Darin haben die Entwickler ebenfalls Dutzende Sicherheitslücken beseitigt, die das Mail-Programm vorwiegend von Firefox geerbt hat.

    Bis zur VerÜffentlichung der nächsten Hauptversion Firefox 154 am 18. August plant Mozilla wÜchentliche Updates zur Fehlerbehebung und um weitere Schwachstellen zu beseitigen. Nach Firefox 154 wechselt Mozilla, wie auch Google Chrome und Microsoft Edge, auf einen zweiwÜchentlichen Turnus fßr neue Hauptversionen. Firefox 155 soll demnach bereits am 1. September erscheinen.

    ]]>         <![CDATA[New programmable photonic chip can control how fast light moves]]> https://tsecurity.de/de/3685259/ai-nachrichten/new-programmable-photonic-chip-can-control-how-fast-light-moves/ https://tsecurity.de/de/3685259/ai-nachrichten/new-programmable-photonic-chip-can-control-how-fast-light-moves/ Wed, 22 Jul 2026 06:33:51 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Arista debuts unified SD-WAN edge platform]]> https://tsecurity.de/de/3685191/it-security-nachrichten/arista-debuts-unified-sd-wan-edge-platform/ https://tsecurity.de/de/3685191/it-security-nachrichten/arista-debuts-unified-sd-wan-edge-platform/ Wed, 22 Jul 2026 05:40:32 +0200 📰 IT Security Nachrichten tsecurity.de

    Arista Networks is looking to simplify data protection at the edge of enterprise networks with a new security package that combines branch office security with SD-WAN connectivity in a single platform.

    The company announced AI-driven Edge Threat Management (ETM) for VeloCloud SD-WAN, a platform that links typically separate products and capabilities including Arista’s next-generation firewall, IP reputation, external blocklists, intrusion prevention, URL filtering, application classification, geo-IP filtering, network address translation, deep packet inspection, and zone-based segmentation.

    ETM provides perimeter protection at the WAN edge and is a software upgrade option to VeloCloud SD-WAN, according to Arista. It can help simplify branch operations with a common operating system, a uniform enforcement engine, and common end-to-end security policies, the vendor stated. The new ETM solution also leverages Arista’s AVA (Autonomous Virtual Assist) for AI-driven policy intelligence.

    “Multi-vendor branch complexity creates the ultimate blind spot, and your adversaries are actively hiding in it,” wrote Brendan Gibbs, Arista’s vice president, AI, routing, and switching platforms, in a blog post about the new platform.

    Sprawling multi-vendor infrastructure creates operational headaches and increases security risks, according to Gibbs. “When you have four or five different point solutions from different vendors stacked on top of each other, configuring them becomes a manual, disjointed process. In fact, industry data shows that up to 95% of network changes are still performed manually, which inevitably leads to configuration mistakes, the single biggest driver of network downtime and security policy gaps,” he wrote. 

    “When security policies are decoupled from local network routing, critical blind spots emerge. An attacker doesn’t need to break your cloud-delivered SASE firewall; they just need to target the unmonitored local traffic gaps between your Wi-Fi AP, your LAN switch, and your SD-WAN edge router,” Gibbs wrote.

    ETM is integrated into VeloCloud Orchestrator as a dedicated enterprise application. “This enables security operators to configure policies that build on the same source of shared network configuration while maintaining a dedicated management console for security policy configuration, provisioning, and reporting,” Arista stated.

    ETM security policies are managed in VeloCloud Orchestrator. “Admins can build and assign reusable policies consisting of predefined objects and templates. This design makes updating security policies possible by a few simple clicks, while the associated changes are propagated throughout the network within minutes,” Arista stated.

    VeloCloud Orchestrator is the central management, configuration, and monitoring hub for VeloCloud SD-WAN and SASE networks.

    In addition, VeloCloud edge routers collect threat intelligence data from a variety of sources to determine in real-time the trustworthiness and identity of hosts inside and outside the network. Through integration with Arista Network Detection and Response and other web-based dynamic lists, administrators can identify suspicious hosts and build policies to block potentially harmful activities, the vendor stated.

    Integration with Arista’s AVA policy assistant is aimed at simplifying management of branch security policies. AVA continuously analyzes configuration states and translates complex, multi-site security rules into plain English, Gibbs explained. For example, NetOps administrators can use AI with Ask AVA to predict “how specific traffic will be handled before committing to a deployment, preventing manual configuration errors that leave branches exposed,” Gibbs wrote.

    Arista also touted support for network-wide segmentation policies. “The flexible security policy configuration within the Edge Threat Management policy management extends the security coverage from the data center to the branch,” the vendor stated. “Security operations administrators can build access policies that are enforced across a distributed network. The centralized design enables admins to configure and deploy consistent zone based policies across the entire distributed network.”

    ETM is a significant addition to the Arista VeloCloud portfolio. Arista bought the VeloCloud SD-WAN platform from Broadcom a year ago and has been promising new technologies that expand the platform. ETM also could further the vendor’s stated plans to expand beyond its data center networking roots and compete more broadly with enterprise networking vendors such as Cisco, Palo Alto Networks, and Fortinet.

    In the SASE and SD-WAN world, vendors such as Cisco, Palo Alto, Fortinet, Cato Networks, and Versa Networks are among the most balanced suppliers, with both SD-WAN and SSE contributing meaningful revenue streams, according to a recently published report from Dell’Oro Group.

    “We forecast that SASE will remain on a double-digit growth path in 2026, with SSE-first rollouts remaining the most common entry point, and SD-WAN supported by branch modernization, software attach, and branch security refresh,” Dell Oro stated.

    “AI is changing the SASE discussion from access and inspection to governance, data protection, and control over agents and machine traffic,” Mauricio Sanchez, senior director, enterprise security and networking at Dell’Oro Group, stated in the report. “A 21 percent Y/Y quarter shows that SASE is not waiting for a future AI refresh cycle; it is already absorbing the early security and networking requirements created by AI adoption,” Sanchez added.

    ETM for VeloCloud SD-WAN will be available in Q4 of 2026 and will be available for all current VeloCloud hardware and virtual edge platforms.

    ]]>         <![CDATA[Kalender- und Kontakte-Sync bei der Telekom gestört]]> https://tsecurity.de/de/3685014/it-nachrichten/kalender-und-kontakte-sync-bei-der-telekom-gestoert/ https://tsecurity.de/de/3685014/it-nachrichten/kalender-und-kontakte-sync-bei-der-telekom-gestoert/ Wed, 22 Jul 2026 01:31:40 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Kalender- und Kontakte-Sync bei der Telekom gestört

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[Microsoft postet Fix für WSUS-Sync-ProblemeBorns IT- und Windows-Blog - BornCity]]> https://tsecurity.de/de/3684974/windows-server/microsoft-postet-fix-fuer-wsus-sync-problemeborns-it-und-windows-blog-borncity/ https://tsecurity.de/de/3684974/windows-server/microsoft-postet-fix-fuer-wsus-sync-problemeborns-it-und-windows-blog-borncity/ Wed, 22 Jul 2026 01:04:16 +0200 🪟 Windows Server tsecurity.de Windows Server Update Service sync operations might have issues or time out" heißt es, dass Microsoft eine ...]]> <![CDATA[Microsoft postet Fix für WSUS-Sync-Probleme]]> https://tsecurity.de/de/3684934/it-nachrichten/microsoft-postet-fix-fuer-wsus-sync-probleme/ https://tsecurity.de/de/3684934/it-nachrichten/microsoft-postet-fix-fuer-wsus-sync-probleme/ Wed, 22 Jul 2026 00:18:22 +0200 📰 IT Nachrichten tsecurity.de Weiterlesen →

    Quelle

    ]]>         <![CDATA[Inline Email Security and Microsoft 365: A Practical View of Mail Routing, Risk, and Prevention]]> https://tsecurity.de/de/3684837/it-security-nachrichten/inline-email-security-and-microsoft-365-a-practical-view-of-mail-routing-risk-and-prevention/ https://tsecurity.de/de/3684837/it-security-nachrichten/inline-email-security-and-microsoft-365-a-practical-view-of-mail-routing-risk-and-prevention/ Tue, 21 Jul 2026 23:04:36 +0200 📰 IT Security Nachrichten tsecurity.de

    Microsoft’s guidance on inbound and outbound mail routing for third-party email security has prompted a fair question from customers: how should organizations evaluate inline email security for Microsoft 365?  The answer depends less on whether a solution is inline and more on how that inline architecture is implemented. Microsoft is right to call attention to mail flow designs that can introduce unnecessary complexity, create authentication challenges, duplicate processing, or disrupt the expected Microsoft 365 experience. Those risks are real when a third-party service is bolted onto the environment without careful integration.  That is also why architecture matters. A modern enterprise […]

    The post Inline Email Security and Microsoft 365: A Practical View of Mail Routing, Risk, and Prevention appeared first on Check Point Blog.

    ]]>         <![CDATA[Siemens SIDIS Secured SmartPlug]]> https://tsecurity.de/de/3684505/it-security-nachrichten/siemens-sidis-secured-smartplug/ https://tsecurity.de/de/3684505/it-security-nachrichten/siemens-sidis-secured-smartplug/ Tue, 21 Jul 2026 19:45:23 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

    Summary

    SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.

    The following versions of Siemens SIDIS Secured SmartPlug are affected:

    • SIDIS Secured SmartPlug vers:intdot/<7.26.0310 
    CVSS Vendor Equipment Vulnerabilities
    v3 9.8 Siemens Siemens SIDIS Secured SmartPlug Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Out-of-bounds Read, Covert Timing Channel, Detection of Error Condition Without Action, Incorrect Authorization

    Background

    • Critical Infrastructure Sectors: Critical Manufacturing
    • Countries/Areas Deployed: Worldwide
    • Company Headquarters Location: Germany

    Vulnerabilities

    Expand All +

    CVE-2022-23303

    The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    CVE-2022-23304

    The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

    CVE-2022-37660

    In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

    CVE-2022-48174

    There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-787 Out-of-bounds Write

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

    CVE-2025-5222

    A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

    CVE-2025-5914

    A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-190 Integer Overflow or Wraparound

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

    CVE-2025-9230

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-125 Out-of-bounds Read

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    CVE-2025-9231

    Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-385 Covert Timing Channel

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

    CVE-2025-9232

    Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-125 Out-of-bounds Read

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

    CVE-2025-26465

    A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-390 Detection of Error Condition Without Action

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

    CVE-2025-32462

    Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-863 Incorrect Authorization

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 2.8 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

    CVE-2026-5121

    A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

    View CVE Details

    Affected Products

    Siemens SIDIS Secured SmartPlug
    Vendor:
    Siemens
    Product Version:
    SIDIS Secured SmartPlug < V7.26.0310
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Update to V7.26.0310 or later version

    Relevant CWE: CWE-190 Integer Overflow or Wraparound

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    Acknowledgments

    • Siemens ProductCERT reported these vulnerabilities to CISA.

    General Recommendations

    As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

    Additional Resources

    For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

    Terms of Use

    The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

    Legal Notice and Terms of Use

    This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

    Recommended Practices

    CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

    Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

    Locate control system networks and remote devices behind firewalls and isolate them from business networks.

    When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

    CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

    CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

    CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

    Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

    Advisory Conversion Disclaimer

    This ICSA is a verbatim republication of Siemens ProductCERT SSA-585531 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

    Revision History

    • Initial Release Date: 2026-07-14
    Date Revision Summary
    2026-07-14 1 Publication Date
    2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory

    Legal Notice and Terms of Use

    ]]>         <![CDATA[Rockwell Automation Studio 5000 Logix Designer]]> https://tsecurity.de/de/3684504/it-security-nachrichten/rockwell-automation-studio-5000-logix-designer/ https://tsecurity.de/de/3684504/it-security-nachrichten/rockwell-automation-studio-5000-logix-designer/ Tue, 21 Jul 2026 19:45:22 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

    Summary

    Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.

    The following versions of Rockwell Automation Studio 5000 Logix Designer are affected:

    • Studio 5000 Logix Designer V36.00 (CVE-2026-9108)
    • Studio 5000 Logix Designer V35.00 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
    • Studio 5000 Logix Designer V35.01 (CVE-2026-9108)
    • Studio 5000 Logix Designer >=V34.00|<=V34.03 (CVE-2026-9108)
    • Studio 5000 Logix Designer >=V33.00|<=V33.03 (CVE-2026-9108)
    • Studio 5000 Logix Designer >=V32.00|<=V32.04 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
    • Studio 5000 Logix Designer V34.00 (CVE-2026-9127)
    • Studio 5000 Logix Designer V34.01 (CVE-2026-9127)
    • Studio 5000 Logix Designer V33.00 (CVE-2026-9127)
    • Studio 5000 Logix Designer V33.02 (CVE-2026-9127)
    • Studio 5000 Logix Designer >=V34.00|<=V34.02 (CVE-2026-9128)
    • Studio 5000 Logix Designer >=V33.00|<=V33.02 (CVE-2026-9128)
    CVSS Vendor Equipment Vulnerabilities
    v3 7.5 Rockwell Automation Rockwell Automation Studio 5000 Logix Designer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element

    Background

    • Critical Infrastructure Sectors: Critical Manufacturing
    • Countries/Areas Deployed: Worldwide
    • Company Headquarters Location: United States

    Vulnerabilities

    Expand All +

    CVE-2026-9108

    A path traversal security issue exists within Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

    View CVE Details

    Affected Products

    Rockwell Automation Studio 5000 Logix Designer
    Vendor:
    Rockwell Automation
    Product Version:
    Rockwell Automation Studio 5000 Logix Designer: V36.00, Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: V35.01, Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.03, Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.03, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)

    Mitigation
    Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
    https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

    Mitigation
    For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
    https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

    Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
    4.0 5.4 MEDIUM CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

    CVE-2026-9127

    A remote code execution security issue exists within Studio 5000 Logix Designer due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

    View CVE Details

    Affected Products

    Rockwell Automation Studio 5000 Logix Designer
    Vendor:
    Rockwell Automation
    Product Version:
    Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04, Rockwell Automation Studio 5000 Logix Designer: V34.00, Rockwell Automation Studio 5000 Logix Designer: V34.01, Rockwell Automation Studio 5000 Logix Designer: V33.00, Rockwell Automation Studio 5000 Logix Designer: V33.02
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Studio 5000 Logix Designer: V36.00, 35.01, 34.02, 33.02, 32.05 (CVE-2026-9127)

    Mitigation
    Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
    https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

    Mitigation
    For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
    https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

    Relevant CWE: CWE-863 Incorrect Authorization

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.5 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
    4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

    CVE-2026-9128

    A code execution security issue exists within Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

    View CVE Details

    Affected Products

    Rockwell Automation Studio 5000 Logix Designer
    Vendor:
    Rockwell Automation
    Product Version:
    Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04, Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.02, Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.02
    Product Status:
    known_affected
    Remediations

    Vendor fix
    Studio 5000 Logix Designer: V36.00, 35.01, 34.03, 33.03, 32.05 (CVE-2026-9128)

    Mitigation
    Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
    https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

    Mitigation
    For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
    https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

    Relevant CWE: CWE-428 Unquoted Search Path or Element

    Metrics

    CVSS Version Base Score Base Severity Vector String
    3.1 7.5 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
    4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

    Acknowledgments

    • Rockwell Automation reported these vulnerabilities to CISA

    Legal Notice and Terms of Use

    This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

    Recommended Practices

    CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

    Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

    Locate control system networks and remote devices behind firewalls and isolating them from business networks.

    When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

    CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

    CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

    CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

    Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

    Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

    CISA also recommends users take the following measures to protect themselves from social engineering attacks:

    Do not click web links or open attachments in unsolicited email messages.

    Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

    Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

    No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities have a high attack complexity.

    Revision History

    • Initial Release Date: 2026-07-21
    Date Revision Summary
    2026-07-21 1 Initial Republication of Rockwell Automation Security Advisory

    Legal Notice and Terms of Use

    ]]>         <![CDATA[Synology Photos für iOS: Großes Update auf Version 2.4.0 bringt Favoriten-Sync]]> https://tsecurity.de/de/3684298/it-nachrichten/synology-photos-fuer-ios-grosses-update-auf-version-240-bringt-favoriten-sync/ https://tsecurity.de/de/3684298/it-nachrichten/synology-photos-fuer-ios-grosses-update-auf-version-240-bringt-favoriten-sync/ Tue, 21 Jul 2026 18:05:15 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Synology Photos für iOS: Großes Update auf Version 2.4.0 bringt Favoriten-Sync

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[Firefox Tooling Announcements: Firefox Profiler Deployment (July 21, 2026)]]> https://tsecurity.de/de/3683972/tools/firefox-tooling-announcements-firefox-profiler-deployment-july-21-2026/ https://tsecurity.de/de/3683972/tools/firefox-tooling-announcements-firefox-profiler-deployment-july-21-2026/ Tue, 21 Jul 2026 16:11:42 +0200 💾 Tools tsecurity.de The latest version of the Firefox Profiler is now live! Check out the full changelog below to see what’s changed:

    Highlights:

    • [fatadel] Show counter values over time in profiler-cli (#6136)
    • [Markus Stange] More typed arrays: sample + counter times, some frametable columns (#6139)
    • [NazÄąm Can AltÄąnova] Add marker handles to profiler-cli thread network (#6172)
    • [NazÄąm Can AltÄąnova] Surface network activity across profiler-cli (#6175)
    • [NazÄąm Can AltÄąnova] Add profile meta command to profiler-cli (#6177)
    • [Markus Stange] Allow raw marker table’s startTime and endTime columns to be Float64Array (#6169)

    Other Changes:

    • [Sky Ning] Skip preview links for non-main PRs (#6161)
    • [spokodev] fix(gecko-upgrade): don’t crash on a counter with empty sample_groups (#6160)
    • [Markus Stange] Make profile-conversion snapshots more compact and meaningful (#6152)
    • [NazÄąm Can AltÄąnova] Only render a marker url field as a link when the whole value is a URL (#6163)
    • [fatadel] Show each counter’s owning process in profiler-cli (#6164)
    • [NazÄąm Can AltÄąnova] Document the pre-existing thread info and network JSON schemas in the cli (#6171)
    • [Markus Stange] Copy column contents in getRawSamplesTableBuilderFromExisting for consistency (#6168)
    • [Markus Stange] Convert eligible columns to typed arrays when outputting from profiler-edit (#6167)
    • [Markus Stange] Remove unused samples.thread column (#6151)
    • [Markus Stange] Fixed botched merge which broke ‘yarn ts’ (#6174)
    • [Markus Stange] Update json-slabs 0.3.0 → 0.4.0 (major) (#6176)
    • [nightcityblade] Fix light theme text selection colors (#6186)
    • [NazÄąm Can AltÄąnova] Import source map URLs from Chrome DevTools traces (#6190)
    • [NazÄąm Can AltÄąnova] Rename yarn build-profiler-cli script to build-cli (#6191)
    • [NazÄąm Can AltÄąnova] Migrate husky to version 9 (#6201)
    • [NazÄąm Can AltÄąnova] Fix horizontal overflow when the transform navigator is long (#6199)
    • [fatadel] Add a ‘hexadecimal’ marker schema field format (#6197)
    • [NazÄąm Can AltÄąnova] Bump source-map to 0.8.0 and remove the old type workaround (#6202)
    • [NazÄąm Can AltÄąnova] :clockwise_vertical_arrows: Sync: l10n → main (July 21, 2026) (#6209)

    Big thanks to our amazing localizers for making this release possible:

    • fr: parmegiani.thomas
    • fr: ThĂŠo Chevalier
    • sr: Марко Костић (Marko Kostić)
    • sv-SE: Luna Jernberg
    • tr: Grk
    • zh-CN: Ariel
    • zh-CN: Olvcpr423

    Find out more about the Firefox Profiler on profiler.firefox.com! If you have any questions, join the discussion on our Matrix channel!

    1 post - 1 participant

    Read full topic

    ]]>         <![CDATA[Wazuh v5.0.0 Beta 4]]> https://tsecurity.de/de/3683727/it-security-tools/wazuh-v500-beta-4/ https://tsecurity.de/de/3683727/it-security-tools/wazuh-v500-beta-4/ Tue, 21 Jul 2026 14:50:03 +0200 💾 IT Security Tools tsecurity.de What's Changed

    Full Changelog: v5.0.0-beta3...v5.0.0-beta4

    ]]>         <![CDATA[AI agents can escape sandboxes without ever breaking them]]> https://tsecurity.de/de/3683594/it-security-nachrichten/ai-agents-can-escape-sandboxes-without-ever-breaking-them/ https://tsecurity.de/de/3683594/it-security-nachrichten/ai-agents-can-escape-sandboxes-without-ever-breaking-them/ Tue, 21 Jul 2026 13:53:46 +0200 📰 IT Security Nachrichten tsecurity.de

    Sandboxes have become a key security control for AI coding agents, but new research suggests they may not provide the isolation many organizations assume.

    Pillar Security has disclosed a series of vulnerabilities showing how agents in tools such as Cursor, Codex, Gemini CLI, and Antigravity can indirectly cross security boundaries without technically escaping their sandboxes.

    “In almost every case, the agent did not need to break the sandbox directly,” the researchers said in a blog post. “It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe.”

    The findings outlined four specific and repeatable failure modes in AI sandboxes. These included denylist sandboxes failing growing OS complexity, workspace configurations turning out to be executable code, command allowlists trusting command names instead of invocations, and privileged local daemons that sit outside the sandbox entirely.

    “CISOs and security buyers need to realize that it’s not enough for an agentic IDE or CLI to have a sandbox,” the researchers said, adding that it is important to know where the sandbox’s actual boundary is.

    Escaping sandboxes without breaking them

    Pillar challenged the basic understanding of sandboxing in AI-assisted development. Rather than escaping through kernel exploits or container breakouts, the demonstrated attacks relied on an indirect mechanism.

    In all shown attack paths, the agent remains confined while producing files that trusted host-side applications subsequently consume.

    Those files may include workspace configuration, automation scripts, IDE settings, and virtual environment contents that naturally participate in a developer’s workflow. When external tools later execute or interpret those files outside the sandbox, code originating from within the isolated environment effectively crosses the security boundary without violating the sandbox’s rules.

    Different sandbox escapes for different agents

    Pillar demonstrated the pattern across multiple AI coding tools using different techniques. In Antigravity, the researchers exploited weaknesses in the denylist-style macOS Seabelt profile and abused VS Code task configurations that were later executed outside the sandbox. Cursor, meanwhile, was shown to trust agent-created Python virtual environments, alternate Git directories, and workspace hook configurations that ultimately ran with host privileges.

    The researchers also found a common escape path affecting Cursor, Codex CLI, and Gemini CLI through Docker Desktop’s privileged daemon, allowing sandboxed agents to execute commands outside their restricted environments.

    In another Codex CLI finding, a supposedly safe Git allowlist could be manipulated to modify repository configuration and trigger code execution at a later stage.

    Agentic development demands a different security model

    Pilar argued that enterprises need a new security model for agentic software. The existing endpoint protections typically focus on whether a process can escape its execution environment. But autonomous agents challenge this by continuously generating content that other trusted systems consume.

    The researchers recommended treating workspace configurations that can trigger execution as sensitive assets, requiring explicit approval before agents create or modify host-side automation, ensuring that helper processes operate under the same security policy as direct agent execution, and preserving provenance that distinguishes user-created files from repository- or agent-generated content.

    Organizations were also advised to model security policies around command side effects rather than simply process invocation, limit access to privileged local services, and monitor trust handoffs throughout the development workflow.

    ]]>         <![CDATA[Philips Hue arbeitet an Kamera-Lösung für TV-Synchronisation]]> https://tsecurity.de/de/3683426/it-nachrichten/philips-hue-arbeitet-an-kamera-loesung-fuer-tv-synchronisation/ https://tsecurity.de/de/3683426/it-nachrichten/philips-hue-arbeitet-an-kamera-loesung-fuer-tv-synchronisation/ Tue, 21 Jul 2026 12:48:31 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Philips Hue arbeitet an Kamera-Lösung für TV-Synchronisation

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[Microsoft shares manual fix for WSUS sync delays and timeouts]]> https://tsecurity.de/de/3683125/it-security-nachrichten/microsoft-shares-manual-fix-for-wsus-sync-delays-and-timeouts/ https://tsecurity.de/de/3683125/it-security-nachrichten/microsoft-shares-manual-fix-for-wsus-sync-delays-and-timeouts/ Tue, 21 Jul 2026 11:09:48 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[SaaS will survive, but lazy SaaS is dead]]> https://tsecurity.de/de/3683122/ai-nachrichten/saas-will-survive-but-lazy-saas-is-dead/ https://tsecurity.de/de/3683122/ai-nachrichten/saas-will-survive-but-lazy-saas-is-dead/ Tue, 21 Jul 2026 11:05:13 +0200 🔧 AI Nachrichten tsecurity.de

    Something interesting happened during an internal evaluation of AI meeting transcription tools at Tungsten Automation. The products worked. They weren’t bad. But sitting across from the pricing, we kept asking the same question: what exactly are we paying for?

    We already had a secure enterprise AI environment. Building a meeting summary workflow took days, not months. We customized the outputs, injected our own internal context, and controlled security our way instead of working around someone else’s roadmap. We built it. It works better. We own it.

    That’s not a knock on those vendors. It’s a signal of something more fundamental happening across enterprise software.

    The moat was never the product

    For two decades, SaaS rode a favorable asymmetry: building internal tools was hard, integrations were messy, and even modest automation required developers and long timelines. Buying was faster and cheaper than building. That asymmetry fueled the explosion of SaaS into every corner of the enterprise stack.

    AI is collapsing that asymmetry. Large language models and agentic workflows can orchestrate APIs, move data between systems, generate interfaces, and automate business logic with a fraction of the engineering effort required even two years ago. The integration friction that once protected entire product categories is evaporating.

    The vendors most exposed are not the deeply embedded enterprise platforms. They’re the lightweight workflow layers, the products that essentially put a polished interface on top of accessible data and relatively straightforward processes. Reporting dashboards. Meeting tools. Narrow productivity applications. These products created value by simplifying implementation. That rationale is getting harder to sustain when implementation is no longer the real barrier.

    Here’s the part most analyses miss: it’s not just that AI makes development faster. It’s that agents change the integration model entirely. For 30 years, enterprise software was built for humans navigating UIs. Agentic systems don’t use UIs. They call APIs, read from multiple sources simultaneously, and move data freely across systems. The switching costs that once made incumbent software sticky are collapsing, because an agent doesn’t care which UI it used last quarter.

    The SaaS that survives

    The question isn’t whether SaaS survives. It’s which SaaS survives.

    The companies with durable positions are not the ones with the cleanest interface. They’re the ones that transfer operational risk customers genuinely cannot absorb themselves. Compliance. Regulatory certification. Accumulated domain expertise. Liability.

    Think about compliant invoicing across 140 countries. That’s not a workflow someone builds in a sprint. The certifications alone take years. A single regulatory change in one jurisdiction can break an AP process for a global enterprise overnight. Customers don’t pay for that capability because it’s technically complex. They pay because they cannot afford to own the risk of getting it wrong.

    That’s the distinction that matters: AI lowers the cost of building software. It does not lower the cost of absorbing risk. The vendors who understand this are building durable businesses. The ones who don’t are quietly subsidizing their customers’ internal build programs.

    Software sells features. Platforms sell accountability.

    The prototype trap

    The danger for enterprise buyers right now is overcorrection. Every successful prototype looks like a cost-saving opportunity. Very few survive the jump to production.

    Building a workflow with generative AI is becoming straightforward. Maintaining it is not. Models evolve. Outputs drift. Governance requirements tighten. What worked cleanly in a controlled environment behaves differently at scale, and the failure mode is worse than traditional software. Rule-based automation, when it fails, fails obviously. Agents fail silently, confidently, at scale, often with a completely reasonable-sounding explanation.

    Engineering teams that take on AI-powered systems need to solve for observability, model drift, access controls, audit trails, and long-term maintenance ownership. In regulated industries, they need to demonstrate exactly how the system reached every decision. That’s not a weekend project. That’s an ongoing operational commitment that compounds over time as models change and regulatory requirements evolve.

    Before a team decides to replace an external platform with internal AI tooling, the honest question isn’t, “Can we build this?” The real question is, “Are we prepared to own this in production, for years, as the underlying models change beneath us?” Sometimes the answer is yes. Often the answer is no, and the true cost only becomes visible after the vendor contract is canceled.

    Build vs. partner: a sharper frame

    The build vs. buy framing has always been too binary. The right question is build vs. partner.

    Partner for the capabilities where risk transfer, regulatory complexity, and domain expertise create genuine value your team cannot replicate. Build for the capabilities that actually differentiate your business from your competitors. Don’t burn your best engineers rebuilding compliant invoice processing or production-grade document extraction. Those aren’t competitive advantages. They’re table stakes, and someone else has already paid the cost, across decades, to make them reliable.

    The organizations getting this right are honest about where they create unique value. They focus development there, and partner for everything else. The ones getting it wrong are vibe-coding solutions to non-differentiating problems while their actual competitive moat goes unattended.

    The true value of software

    We’re not watching the death of SaaS. We’re watching the end of the friction-based value proposition: the idea that software is worth renewing because integration used to be painful. That rationale is largely gone.

    What survives is software that does something customers cannot reasonably replicate internally: absorb risk, maintain regulatory compliance, deliver operational reliability at scale, and bring genuine domain expertise into a production-grade system that someone else already stress-tested for years.

    The vendors who recognize this are already repositioning around accountability, governance, and outcomes. The ones who haven’t will find the next renewal conversation noticeably harder.

    Software sells features. Platforms sell accountability. That distinction is about to separate a lot of winners from a lot of cautionary tales.

    —

    New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

    ]]>         <![CDATA[How AI impacts site reliability engineering]]> https://tsecurity.de/de/3683121/ai-nachrichten/how-ai-impacts-site-reliability-engineering/ https://tsecurity.de/de/3683121/ai-nachrichten/how-ai-impacts-site-reliability-engineering/ Tue, 21 Jul 2026 11:05:12 +0200 🔧 AI Nachrichten tsecurity.de

    Site reliability engineers (SREs) have the tough assignment of resolving thorny performance and reliability issues. But their primary mission is to provide devops teams with operational insights and to suggest implementation improvements on business system performance, security, and overall robustness.

    Google introduced its SRE playbook in 2003, but it took some time for the role’s definition, tools, and techniques to become mainstream. Startups were the first to adopt observability for cloud-native applications and create dedicated SRE positions. As tools matured and SRE responsibilities became more clearly defined, larger enterprises assigned SREs to work as a bridge between devops and IT ops teams to improve resilience across a wider range of applications, APIs, and data pipelines.

    SRE is a career path for multidisciplinary engineers with strong investigative instincts, sharp data analytics skills, and the temperament to perform under pressure. It has become a critical responsibility as tech became mission-critical for enterprises, and it is a growing role in the genAI era as more businesses deploy AI agents.

    But the critical need for resiliency and greater technological complexity brings new challenges for SREs. According to the 2026 State of Production Reliability and AI Adoption report, 44% of respondents experienced an outage linked to ignored or suppressed alerts in the past year, and 35% report their engineers occasionally ignore or dismiss alerts due to alert fatigue. More than 70% of alerts received are not actionable, according to 57% of organizations.

    So, is AI making the SRE’s role easier and helping businesses run more reliable technology operations? On the other hand, AI is also driving complexity, as companies deploy genAI tools and AI agents across more business functions and seek to automate more decision-making across operations.

    AIops and agentic ops aid SREs

    Over the past decade, SRE responsibilities have become somewhat easier through improvements in monitoring platforms, observability practices, tools for centralizing operational data, and AI applied in IT operations (AIops). But during the heat of resolving an outage or performance issue, it’s not easy to correctly identify what system triggered the issue versus other downstream systems impacted by it.

    According to the Komodore 2025 Enterprise Kubernetes Report, 79% of production incidents originate from recent system changes, including deployments and changes to compute environments. But the other 21% of incidents stem from issues outside of the business’s control, including network failures, third-party changes, and cloud provider failures.

    “SREs using AI capabilities succeed or fail in the moment an incident unfolds, when engineers are deciding what to investigate next,” says Itiel Shwartz, CTO at Komodor. “If the system streamlines root cause detection, connects signals to recent changes, and explains its reasoning in a way engineers recognize, it earns trust. If it adds uncertainty or demands extra validation, it gets sidelined, regardless of how bespoke the model behind it may be. What’s less obvious is what it takes to make AI for SREs work in production, and how different that reality is from prototypes, demos, or early internal builds.”

    AIops is not a new capability, especially in using machine learning to correlate logs, metrics, and traces across monitoring and alerting systems. IT service management and SREs have been using AIops to reduce the mean time to resolve incidents and to perform accurate root cause analysis (RCA) efficiently. Agentic ops is the next wave of genAI operational capabilities, including tools for monitoring AI agents, managing their access rights, and detecting AI model accuracy drift.

     “AI is useful during major incidents because it can pull together a lot of context into a few clear sentences, which is exactly what an SRE needs in the moment,” suggests Shani Shoham, chief revenue officer at OpenObserve. “The complexity of architecture and the different tooling make it easier for AI than for a human, but autonomous resolution is still a way off.”

    AI’s impact on people and burnout

    The business pressure to keep systems up, secure, and performing well is a 24/7 stressful responsibility. According to The SRE Report 2025 from Catchpoint, 36% of SREs often or always experience elevated stress during an incident, and 28% said the stress persists even after the incident is resolved. AI capabilities may prove to be a game-changer in helping SREs avoid burnout and reduce stress.

    “AI can improve RCA by taking in a much larger incident context than any engineer can hold at 3am, reasoning across traces, logs, metrics, deploys, config changes, alerts, ownership, and recent production behavior,” says Noam Levy, founding engineer and field CTO at Groundcover. “Beyond attempting a full RCA, its immediate value is distilling the signals that actually matter, reconstructing a clear timeline of cause and effect, and helping engineers separate correlation from likely causality. Once a fix is deployed, agents can also verify remediation by comparing pre- and post-fix behavior, but this depends on broad access to rich, correlated production signals and a cost model that does not discourage adoption or experimentation.”

    Not only are incidents resolved faster and with less stress, but AI can also free up SRE time to focus on proactive work and create a career path for junior developers into SRE roles. Quais Taraki, CTO at EDB Postgres AI, adds, “AI reduces toil by automating repetitive tasks while accelerating incident resolution through copilots that correlate signals across distributed systems, allowing SREs to focus more on resilience strategies like chaos engineering and failure analysis.”

    AI can have long-lasting operational impacts, especially for organizations looking to deploy more mission-critical technology and AI capabilities. Two longer-term benefits of AI for SREs are reducing the number of bridge calls needed for incident response and the number of engineers required in “war rooms” to coordinate root cause analyses.

    “When something goes wrong, AI that guides SREs can do the full analysis, get to the root cause, and perform the remediation,” says Spiros Xanthos, founder and CEO of Resolve AI. “AI also helps avoid many escalations, and when escalations are needed, it targets the right people from the network, infrastructure, and the application teams. AI for SREs centralizes operational intelligence, exposes tribal knowledge, and can guide more junior developers.” 

    AI agent reliability

    While AI capabilities have been a net positive in helping SREs improve system reliability, the growth of AI code generators, vibe coding, and spec-driven development is adding to their workloads. According to one study, 41% of all global code is now AI-generated, and Gartner predicts that 40% of new enterprise production software will be created using vibe coding techniques by 2028.

    But coding velocity is creating new issues for SREs as AI pull requests have 1.4 times more critical issues and 1.7 times more major issues, according to CodeRabbit. “AI-assisted development has created an unprecedented velocity of code reaching production, expanding surface area, edge cases, and failure rates faster than traditional SRE practices can absorb,” says Vinod Jayaraman, cofounder and CTO at NeuBird AI. “The speed of shipping has far outpaced the speed of understanding what breaks in production. To close this loop, SREs need enterprise agents that can capture precise diagnostic context, including correlated traces, service dependencies, and anomaly timelines, and structure it as actionable input for the engineers and AI coding tools responsible for the fix.”

    The growing number of AI agents deployed to production creates new challenges. AI agents are not just code; they have multiple failure points. They are built using language models, connect to proprietary sources for context, and integrate with Model Context Protocol servers to support more complex workflows. Changes are ongoing and not deployment events, so the SRE’s job of identifying the source of performance and accuracy drifts isn’t trivial. 

    “Traditional SRE was built for systems that fail in reproducible ways, but agents fail differently and drift when a model provider pushes an update, and behavior shifts silently with no baseline for comparison,” says Mohammed Aboul-Magd, vice president of product at SandboxAQ. “Most organizations can’t even answer the basics: how many agents are running, what they have access to, and whether they’re still doing what they were built to do.”

    “Every time a senior engineer leaves, they take years of learned failure patterns with them, and the next outage starts from square one,” adds Ronak Desai, cofounder and CEO at Ciroos. “Using AI for compounding operational memory changes that, and every incident your system resolves, the AI learns it.”

    SREs should take a leadership role in emerging best practices, including defining their standards for AI agent non-functional acceptance criteria, observability practices, and release-readiness criteria. SREs should update their service-level objectives (SLOs) and define error budgets for AI agents in production.

    Ryan Downing, vice president and CIO of enterprise business solutions at Principal Financial Group, says, “Standard SLOs and error budgets give teams the guardrails, and AI helps interpret the telemetry against those targets, reducing noise so engineers can get to the real issue faster and automate parts of remediation before customers are impacted.”

    AI raises the SRE’s business impact

    The more dramatic shift in site reliability engineering is an evolution of its business scope. IT leaders focus on uptime, performance, and issue resolution, as well as understanding their impacts. Business leaders will look to IT and SREs to identify, determine root cause, and remediate a broader class of issues, including rogue AI agents and the impacts of rapidly deploying new agentic capabilities. 

    “AI agents are handing SREs categories of problems they’ve never had to solve before, specifically failures defined in business terms, not technical ones,” says Blake Sherwood, distinguished technologist for AI and platform strategy at Smarsh. “Traditional reliability engineering is built around latency, errors, and crashes, but agents now fail due to skipped compliance steps or outcomes that looked fine technically but were wrong contextually. Most SRE teams aren’t wired for that yet.”

    The question is whether SREs with AI-augmented tools can keep up with the velocity, complexity, and business urgency of deploying new AI business capabilities.

    ]]>         <![CDATA[Mt Sync - (Auto)Mount and Sync your data from anywhere]]> https://tsecurity.de/de/3682514/linux-tipps/mt-sync-automount-and-sync-your-data-from-anywhere/ https://tsecurity.de/de/3682514/linux-tipps/mt-sync-automount-and-sync-your-data-from-anywhere/ Tue, 21 Jul 2026 03:56:13 +0200 🐧 Linux Tipps tsecurity.de

    It seems like I'm the only one how want to just go to a network share an an application after I login and the files are just there. No having to go mount anything first, what a wasteful step that is. :) So after making a gnome extension for gvfs mounts/shares, I thought it would be great if I could mount other types of storage the same way and even sync data between them. I got close to buying rcloneview for its paywalled features when I decided to go do my own thing, introducing Mt Sync: https://codeberg.org/gavindi/MtSync

    Sharing since maybe just maybe there's someone else who misses the Windows "reconnect drive at login" feature..... 🤷‍♂️️

    submitted by /u/gavindi
    [link] [comments]]]>         <![CDATA[CVE-2024-35253 | Microsoft Azure File Sync link following (EUVD-2024-35762)]]> https://tsecurity.de/de/3682477/sicherheitsluecken/cve-2024-35253-microsoft-azure-file-sync-link-following-euvd-2024-35762/ https://tsecurity.de/de/3682477/sicherheitsluecken/cve-2024-35253-microsoft-azure-file-sync-link-following-euvd-2024-35762/ Tue, 21 Jul 2026 03:07:38 +0200 🕵️ Sicherheitslücken tsecurity.de Microsoft Azure File Sync. It has been declared as problematic. This affects an unknown part. The manipulation results in link following. This vulnerability is known as CVE-2024-35253. Attacking locally is a requirement. No exploit is available. A patch should be applied to remediate this issue.]]> <![CDATA[Writer's AI harness cuts token spend nearly 40% — without sacrificing accuracy]]> https://tsecurity.de/de/3682237/it-nachrichten/writers-ai-harness-cuts-token-spend-nearly-40-without-sacrificing-accuracy/ https://tsecurity.de/de/3682237/it-nachrichten/writers-ai-harness-cuts-token-spend-nearly-40-without-sacrificing-accuracy/ Mon, 20 Jul 2026 23:48:13 +0200 📰 IT Nachrichten tsecurity.de Enterprise AI is facing an ROI paradox. While throwing more compute at the strongest foundation model works well in product experiments, the costs become unbearable when the product is deployed in production.

    A new paper from researchers at Writer provides a solution that is accessible to engineering teams. The study takes a systematic look at optimizing the different components of the orchestration layer that wraps around the foundation model, aka the AI harness. 

    By optimizing the harness, the researchers show dramatic reductions in tokens per task, a drop in cost-per-successful-task by up to 61%, and quality that holds steady, all without changing the underlying foundation model.

    Because the harness is fully under the developer's control and requires no model fine-tuning, engineering teams can apply these findings to build highly cost-efficient AI applications.

    The ROI crisis of tokenmaxxing

    The current state of AI engineering is plagued by "tokenmaxxing," an industry trend where developers rely on massive context windows and brute-force token consumption as a substitute for good system design. 

    Rather than engineering elegant workflows, developers have imported a reflex from traditional software development: generate, run, fail, stuff the error and more context back into the window, and retry. 

    "Teams tokenmaxx because it's the cheapest fix in the moment, and because it's literally how most engineers work today," Waseem AlShikh, CTO and co-founder of Writer, told VentureBeat. Because this approach succeeds often enough on coding tasks, it has become the default reflex for every other agentic workload. The danger is that per-token price drops mask the underlying inefficiency. 

    "Your invoice is tokens-per-task times price-per-token, and most teams only watch the second number," AlShikh said. "In agentic workloads, tokens-per-task compounds — every loop iteration re-transmits the growing context — and it compounds faster than prices fall. The price cut becomes an anesthetic. It masks the fact that the loop itself is bleeding."

    Tokenmaxxing leads to several enterprise failure modes. Teams route simple tasks to premium frontier models by default. They use the LLM as a lazy search index, stuffing the context window with raw documents instead of retrieving exact answers. Most destructively, they build unconstrained agentic loops that spiral out of control when the model encounters an error. Because output tokens cost significantly more than input tokens across all major model providers, inefficient task execution acts as a silent budget killer.

    The industry has introduced several efficiency techniques to curb these costs, but they largely fall short because they treat the model in isolation: 

    • Prompt compression condenses input text to save space, but ignores how the system sequences those inputs across complex workflows. 

    • Budgeted reasoning caps the computational steps a model can take, which often degrades output quality if the workflow isn't intelligently routed. 

    • Terse coding forces models to output minimal code to save output tokens, but does nothing to solve inefficient tool calling. 

    • Speculative decoding uses a smaller draft model to speed up a larger model's text generation, optimizing inference speed while failing to address bloated agent architectures.

    These efforts fail because they optimize the engine while ignoring the transmission. They do not look at the orchestration layer, leaving underlying architectural inefficiencies unresolved.

    Unpacking the harness: the levers of efficiency

    The harness is the orchestration layer that routes, formats, and turns the underlying LLM into a working system.

    The core levers of harness optimization include system prompt caching, interaction history compaction, tool management, retrieval strategies, and error management. These are the most accessible intervention points for engineering teams looking to improve AI performance. 

    As the Writer researchers note in the study: “If the harness is the layer that composes model calls into work, it is also the layer that sets the price of work.”

    Historically, developers have treated the harness as disposable glue code designed simply to connect an API to a user interface. The study signals that the harness must now be treated as a first-class object: a primary software artifact that requires its own testing, versioning, and rigorous design. 

    For enterprises, this reframes the "own-versus-rent" decision. 

    "Enterprises spend months on model evaluations and then rent their orchestration off the shelf — which means they're optimizing the smaller lever and outsourcing the bigger one," AlShikh said. "Whoever owns the harness owns your unit economics, and an open framework tuned for demos is not tuned for your invoice." 

    Inside the experiments

    To isolate the impact of the orchestration layer, the researchers ran experiments on six foundation models spanning multiple vendors and weight classes: Claude Sonnet 4.6, Gemini 3.1, Gemini Flash 3.5, Qwen 3.6, GLM 5.1, and Writer’s own model, Palmyra X6. 

    Their experiments compared a frozen, conventional production agent loop against the finished Writer Agent Harness on the same 22 locked enterprise tasks, spanning capabilities like grounding and retrieval, multi-step workflows, tool use, and content generation. By holding the models and tasks constant, they could isolate the effects of the orchestration layer itself.

    The optimized harness drove a significant drop in costs, cutting the blended cost per task by 41%, from 21 cents to 12 cents. This was largely achieved by slashing token consumption, with the number of tokens per task falling 38%, from 14.2k to 8.8k.

    The harness is designed to delegate tasks like search to specialized sub-agents. A sub-agent receives only the tool and the specific query it needs, retrieves the exact data, and returns a capped, clean summary to the main agent — keeping the primary context window from filling up with raw search results.

    Task success rates held steady even as token use fell — moving from 78% to 81%, a gain the researchers describe as directional rather than statistically significant at their sample size, meaning quality didn't suffer even as costs dropped.

    End-to-end task latency also dropped significantly, reducing the median wall-clock time by 44%, from 48 seconds to 27 seconds, due to prompt caching and the elimination of dead-end reasoning loops.

    However, the researchers also found limits to multi-agent orchestration. Smaller models like Gemini Flash 3.5 and Qwen 3.6 scored well below a usable reliability threshold on sub-agent delegation tasks (0.45 and 0.42, respectively) — the capability simply isn't dependable yet on lighter-weight models.

    Sub-agent orchestration only crossed a usable reliability threshold on the two strongest models tested: Writer's own Palmyra X6 (0.86) and Claude Sonnet 4.6 (0.85).

    The developer’s playbook: actionable takeaways and tradeoffs

    The findings from the study translate into a playbook for enterprise developers building agentic workflows at scale. The first step is to implement what AlShikh calls the "Two-Zone Prompt" and "Context Offloading."

    Structure for system prompt caching (The Two-Zone Prompt): Modern LLM APIs offer prompt caching, but developers must structure their payloads correctly to trigger it. Developers must separate the "stable zone" from the "volatile zone." Place static, unchanging elements (e.g., core rules, large tool schemas, and standard operating procedures) at the top of the prompt. Dynamic elements, such as the specific user query or recent conversational task state, must be appended at the bottom. This ordering allows the harness to reuse the cached prefix across hundreds of calls. "That single separation makes prompt caching actually work and stops you from re-paying for the same instructions on every one of an agent's thirty steps," AlShikh said.

    Manage context with Context Offloading: Avoid context stuffing, where every turn of a loop is appended into a monolithic prompt until the window maxes out. Instead, move history and intermediate artifacts out of the window into retrievable storage, and pull back only what the current step needs. If possible, delegate tasks to single-purpose sub-agents to avoid context bloat. As AlShikh points out, "the biggest line item in agent spend isn't reasoning — it's re-sending things the model has already seen."

    Build resilient loops and redefine KPIs: Unmanaged agent loops drain API budgets rapidly. Teams must begin tracking Completions Per Million tokens (CPM) to understand their true task costs, but the harness itself must contain physical guardrails. "The core principle is that you never ask the model to police its own spending," AlShikh said. "The fence has to live below the model, in code, on your side of the API." This requires three hard checks:

    • Hard per-task token budgets: The run terminates when the budget is spent, no exceptions.

    • Generation fencing: Caps on steps, tool calls, and recursion depth to stop non-converging agents. 

    • Failure-spend governance: Cap what a run can spend after its first failed validation so a failing task doesn't become your most expensive task.

    Avoid unnecessary complexity: Optimizing the orchestration layer comes with engineering overhead. If you're in the prototyping and exploration stage, that overhead isn't justified — iterate fast with a strong model and a light harness. Once you're scaling to millions of requests a day, the savings from harness optimization become substantial.

    However, teams must be aware of "harness leverage." Adding structural scaffolding requires the model to hold and obey that context. If a model is too small, it will spend its limited capacity parsing the scaffolding instead of doing the task, causing accuracy to drop and tokens to rise. The rule for adding complex orchestration features is strictly mathematical: "If a feature adds more coordination tokens than it removes task tokens for that specific model, cut it," AlShikh said. "Nothing in the harness is free."

    The future of the enterprise harness

    The era of tokenmaxxing and treating context windows like bottomless buckets is coming to an end. Throwing more compute at poorly designed systems is not a viable strategy for companies that need to demonstrate a return on their AI investments. 

    As foundation models evolve to absorb planning, tool selection, and multi-step reasoning natively into their weights, the role of the harness will shift from compensating for model weakness to enforcing enterprise policy.

    "What never moves into the model is the 'allowed': budgets, permissions, data boundaries, audit trails, deterministic kill-switches," AlShikh said. "Five years from now, the harness will be thinner but more important. There will be less scaffolding and more governance. However capable the model gets, someone external to it still has to define what it may spend, see, and touch. That layer belongs to the enterprise, and it should never be rented."

    ]]>         <![CDATA[Sheetz replaces VMware at more than 830 stores]]> https://tsecurity.de/de/3681972/it-security-nachrichten/sheetz-replaces-vmware-at-more-than-830-stores/ https://tsecurity.de/de/3681972/it-security-nachrichten/sheetz-replaces-vmware-at-more-than-830-stores/ Mon, 20 Jul 2026 20:52:42 +0200 📰 IT Security Nachrichten tsecurity.de

    Convenience store and gas station chain Sheetz announced it is replacing VMware across its network of more than 830 retail locations with StorMagic’s SvHCI hyperconverged infrastructure platform, marking one of the larger publicly announced migrations away from VMware.

    The rollout is already well underway. According to StorMagic, Sheetz has completed migrations at more than 600 stores and is averaging roughly 200 store conversions per month. At that rate, the company is on track to finish the project in about four months.

    The migration is being carried out entirely remotely, eliminating the need for hardware upgrades or on-site IT visits. This lets the chain continue using its existing Dell PowerEdge R440 and R450 servers.

    The two companies have a relationship dating back to 2020, when Sheetz first deployed StorMagic’s SvSAN software as the hyperconverged storage layer with VMware across hundreds of store locations to virtualize critical in-store application. The setup supported mission-critical applications such as payment processing, loyalty programs, kitchen management and store operations.

    The new deployment replaces VMware entirely with StorMagic’s integrated SvHCI virtualization stack, simplifying infrastructure while reducing software complexity and operating costs.

    By employing existing hardware and managing migrations remotely, Sheetz expects to minimize disruption while standardizing virtualization across its nationwide footprint. StorMagic said the completed platform will provide a highly available infrastructure for business-critical in-store applications while extending the useful life of existing server hardware.

    “Our initial rollout proved StorMagic could deliver the resilience and centralized management needed across a large, distributed retail environment,” said Gary Sliver, director of platform engineering at Sheetz in a statement.

    “StorMagic worked to understand our needs and requirements, to include a 24/7/365 operating environment, and ultimately delivered a product and plan that is allowing us to migrate hundreds of locations from VMware quickly and with minimal downtime, without requiring hardware replacements or having to send technicians to every site. This project is proof that large-scale edge migrations don’t have to be disruptive, drawn-out or scary affairs.”

    ]]>         <![CDATA[v1.18.4]]> https://tsecurity.de/de/3681569/downloads/v1184/ https://tsecurity.de/de/3681569/downloads/v1184/ Mon, 20 Jul 2026 17:47:33 +0200 💾 Downloads tsecurity.de Core

    Improvements

    • Use adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output by default. (@chouqin)

    Bugfixes

    • Reduce OpenAI provider header timeouts during slow connection setup.
    • Respect provider-defined reasoning options instead of falling back to the wrong reasoning controls.
    • Restore Azure Cognitive Services endpoint support for Azure-hosted models.

    Desktop

    Improvements

    • Sync the embedded terminal theme with the app theme.
    • Improve the review panel so open file tabs can stay aligned with the current diff view.
    • Rewrite the v2 prompt input for more reliable command, context, shell, attachment, and history interactions.
    • Improve review panel resizing and sticky controls.

    Bugfixes

    • Preserve command drafts in the command menu.
    • Avoid session view failures when message parent links are missing.
    • Prevent sending empty prompt text parts.
    • Restore model variant selection accessibility.
    • Show keybind tooltips on prompt input controls. (@ProdigyRahul)
    • Deduplicate repeated file entries in diff summaries.
    • Prevent recovery window handling from touching destroyed windows.

    Thank you to 3 community contributors:

    • @jerome-benoit:
      • fix(nix): relax Bun version check for desktop build (#36767)
      • fix(nix): restore desktop integration (#37197)
    • @ProdigyRahul:
      • fix(app): show keybind tooltips on prompt input controls (#37824)
    • @chouqin:
      • feat(opencode): use adaptive thinking effort for kimi family on anthr… (#37696)
    ]]>         <![CDATA[Microsoft to End OneDrive Sync App Updates for Windows 10]]> https://tsecurity.de/de/3681476/it-security-nachrichten/microsoft-to-end-onedrive-sync-app-updates-for-windows-10/ https://tsecurity.de/de/3681476/it-security-nachrichten/microsoft-to-end-onedrive-sync-app-updates-for-windows-10/ Mon, 20 Jul 2026 17:08:12 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft will stop delivering OneDrive sync app updates to systems running Windows 10 version 21H2 and earlier on August 15, 2026, creating a new support concern for organizations still operating legacy Windows endpoints. The change was announced in Microsoft 365…

    Read more →

    The post Microsoft to End OneDrive Sync App Updates for Windows 10 appeared first on IT Security News.

    ]]>         <![CDATA[AI adoption and business acceleration are changing the expectations of technology risk management]]> https://tsecurity.de/de/3681443/it-security-nachrichten/ai-adoption-and-business-acceleration-are-changing-the-expectations-of-technology-risk-management/ https://tsecurity.de/de/3681443/it-security-nachrichten/ai-adoption-and-business-acceleration-are-changing-the-expectations-of-technology-risk-management/ Mon, 20 Jul 2026 16:55:00 +0200 📰 IT Security Nachrichten tsecurity.de

    As AI becomes embedded in customer experiences, internal workflows, and throughout the supply chain, security leaders are being asked to do more than manage risk. They are being asked to help the business make more informed decisions and move faster.

    At the same time, AI has evolved faster than the programs built to govern it.

    The result is a widening gap between the pace of transformation and the ability of security, risk, privacy, compliance, and third-party risk teams to understand where the business is exposed.

    Move Fast, Don’t Break Things

    AI introduces risks like prompt injection and jailbreaks, but the issues keeping CISOs awake at night are more familiar: over-permissioned accounts, poor logging, credentials left in old repositories, sensitive data scattered across systems, and weak access controls. 

    AI gives those risks more speed, reach, and impact. 

    When AI agents are connected to enterprise data, workflows, vendors, and applications, the blast radius of existing weak spots expands quickly. A low-severity incident now becomes harder to detect, more difficult to remediate, and more consequential for the business. 

    This is why boards and executive teams are looking to security leaders for proactive guidance. They want to know whether the business can adopt AI at scale without creating risk that undermines long-term value. 

    “Tell us, in real time, which initiatives are safe to accelerate, where we’re exposed, what could slow down our transformation, and what we need to act on right now.”

    The CISO mandate has evolved from risk reporting to innovation enablement. 

    When Everything is a Risk, Nothing is a Priority

    In many organizations, risk context is spread across multiple teams. Security, procurement, privacy, IT, and third-party risk each have their own view.   

    That fragmentation creates blind spots. 

    Consider an AI agent that can retrieve customer records, access internal knowledge bases, and trigger downstream workflows. Security may know the agent exists, IT may know where it’s deployed, and procurement may know who purchased it. 

    Without a holistic view, however, it becomes difficult to determine whether the agent has the right permissions, if it is operating within policy, or how it could expose the business.

    But visibility is only half the battle. As AI systems, identities, vendors, and data change at a dizzying scale, organizations need to understand whether policy is actually being followed in real time.

    A control that was effective six months ago may no longer suffice after a new AI integration, a vendor update, or a change in permissions. 

    Today’s systems are too dynamic to be governed by the same operating model that worked for yesterday’s tech stack. 

    From Risk Review to Risk Decisioning

    CISOs are now being asked to help the business decide—quickly and defensibly—what can move forward, what needs guardrails, and what should stop. Meeting that mandate requires a different approach: 

    • Treat AI risk as part of enterprise risk, not a separate discipline. AI is embedded in the same decisions organizations already make about data, vendors, identities, controls, and business processes.
    • Start with the business process and context, not the model. Understand what processes depend on this system, the data it touches, and what happens if it fails. 
    • Move from one-time approval to continuous assurance. What matters isn’t whether an AI project passed review six months ago, but whether it is operating within the organizations policies and risk appetite today.
    • Measure decision velocity. Demonstrate how quickly the organization is able to determine what moves forward, what needs guardrails, and what must stop.

    When risk is connected across the business, priorities become clear. Security leaders can understand not just what needs to be addressed, but what matters most, who owns it, and what the business impact could be. 

    When there is a shared understanding of approved use, teams can move faster without relying on ad hoc reviews, static questionnaires, or blanket restrictions. The goal is to make technology and third-party risk visible, prioritized, and actionable at the speed the business now operates.

    That shift helps security leaders say “yes” with confidence.

    Safeguard Transformation and Scale Innovation

    I know the pressure many CISOs are carrying right now. Your scope is getting larger while resources continue to shrink. 

    Your leadership is asking you to protect every facet of the organization, support growing risk and compliance requirements, and now, to be a key voice in guiding business strategy.  

    When you have clarity on what risks truly matter and have the tools to take action, your risk program can become a driver of responsible and scalable innovation. 

    OneTrust helps build risk and compliance programs aligned with the complexity and the speed of your business. Learn more about our integrated risk solutions.

    ]]>         <![CDATA[The technology behind every live sports moment]]> https://tsecurity.de/de/3681409/it-nachrichten/the-technology-behind-every-live-sports-moment/ https://tsecurity.de/de/3681409/it-nachrichten/the-technology-behind-every-live-sports-moment/ Mon, 20 Jul 2026 16:48:21 +0200 📰 IT Nachrichten tsecurity.de

    When a goal goes in during a tournament quarter-final and a hundred million people watch it at the same time, what they feel is the goal. The roar, the replay, the disbelief.

    They do not feel the contribution feeds traversing private media networks across continents, or the edge nodes absorbing a traffic spike that appeared without warning.

    They just feel the moment.

    And that’s exactly how it’s supposed to work.

    And as live sports viewership pushes into territory that makes previous records look modest (driven by a generation that expects to watch anything, on any device, anywhere, without waiting), the gap between getting that delivery right and getting it wrong has never been more consequential, or more public.

    As audiences moved to digital platforms, the margin for error disappeared.

    There is a version of this conversation that is easy to have: audiences expect more, technology has to keep up. True, but incomplete.

    Audiences have always expected live sport to work. What changed is what “working” means, and how quickly they find out when it doesn’t.

    Viewers no longer sit in front of a single screen. During a FIFA World Cup match, a household might have the main feed on the living room television, while someone else streams the highlights on a second TV in the bedroom, all while phones flash with live stats and tablets run separate commentary. From the infrastructure’s perspective, that isn’t just one household watching a game; it’s a chaotic web of concurrent demands triggered by the exact same split-second on the pitch.

    Multiply that across tens of millions of viewers, and the scale of the challenge becomes clear. Social media raises the stakes further. When a platform fails during a World Cup knockout match, audiences report it in real-time on the same platforms they use to discuss the game. The complaint travels faster than the fix.

    Broadcasters no longer have the luxury of resolving an incident before people notice. The incident becomes the story, and in many cases, travels further than the match itself.

    What these viewership numbers actually mean for infrastructure

    The shift in how people watch live sport has moved well beyond trend territory.

    EMARKETER forecasts that digital live sports audiences in the US will grow to 114.1 million viewers, while traditional pay TV audiences decline to 82.0 million, highlighting the continued shift toward streaming.

    The concurrency numbers generated by major sporting events now sit in a territory that would have seemed implausible a decade ago.

    During the 2026 FIFA World Cup, for instance, streaming platforms shattered every historical ceiling, highlighted by Brazil’s CazéTV repeatedly breaking global YouTube records for concurrent viewership during the group stage. Meanwhile, in the United States, Peacock and Telemundo’s digital platforms logged an unprecedented 13 million concurrent viewers for a single knockout window. 

    When tens of millions of people tune into the same live stream at the same moment, it’s a challenge unlike regular web traffic.

    Historically, massive global audiences were insulated by geography. The load was spread across distinct regional networks: antenna signals, satellite downlinks, and physical cable architectures. The physical infrastructure of traditional television inherently absorbed the impact. 

    Digital streaming removes that buffer. Traffic spikes all at once, often at the most critical moment. The tighter the match, the deeper the stoppage time, the sharper the spike. Network infrastructure is forced to handle its heaviest, most volatile traffic exactly when it has zero margin for error.

    Social media compounds the pressure operationally. The second a crucial goal is scored, a wave of real-time reactions floods the internet, instantly dragging a secondary “curiosity audience” into the app. These are people who weren’t even watching the match, but saw the hype and decided to tune in, meaning the network has to absorb a massive new rush of users precisely while the primary stream is already maxing out its capacity.

    To survive these surges while satisfying a modern audience, the underlying broadcast playbook has undergone a massive structural shift. It’s no longer just about handling traffic; it’s also about using modern technology like AI to manage it intelligently.

    According to an industry survey, 25% of broadcasters integrated AI into live production workflows in 2025, a massive leap from just 9% the previous year, with 64% identifying AI as the single largest impact driver over the next five years. 

    The network is no longer just delivering content. AI is now generating highlights and short clips in real time, producing millions of videos that keep fans engaged long after the live moment has passed.

    Ultimately, the technical demand is driven by a shift in what viewers expect. An IBM sports study revealed that 56% of fans now want AI-driven insights layered directly onto their content, while 33% point to real-time, automated translation as the feature that most impacts their experience.

    Whether it’s one screen or several, viewers don’t notice the edge infrastructure or AI powering the experience. They just expect the game to play without interruption.

    The planning mistake most organisations make

    Capacity planning is where most organisations spend their time when preparing to stream a major event. Can the system handle a million concurrent streams? Can it scale on demand if the numbers exceed projections? These are real questions. 

    The lesson is not unique to sports streaming. Every digital business now experiences moments where demand, visibility, and customer expectations collide. Peak traffic events such as flash sales, ticket releases, and viral campaigns can drive website traffic 2 to 25 times above normal levels within seconds. The infrastructure may be different, but the pressure is remarkably similar.

    Large-scale system failures occur when multiple components, each functioning as expected on its own, are overwhelmed by a surge in demand, rising latency, or regional blind spots at the same time.

    The problem isn’t the individual systems. It’s how they work together.

    Latency is the factor most consistently underestimated. A few seconds of delay is not a minor inconvenience in live sport. It is a fundamentally broken experience. 

    A viewer whose stream is running four seconds behind will see a notification before the decisive moment appears on screen. Someone watching a service from the privacy of their room may hear a celebration from another room before seeing it on their screen.

    Geography is another planning gap. Streaming growth is increasingly being driven by emerging markets. In Southeast Asia alone, premium video streaming subscriptions grew 19% in 2025, led by Indonesia, while viewing hours continued to climb across the region. Yet much of the world’s media infrastructure was originally designed around North American and Western European demand. An architecture that looks robust on paper can deliver very different experiences depending on where the viewer is.

    The reason is simple: physical distance still matters. Every extra hop between the viewer and the content adds latency, making it harder to deliver a consistent experience at global scale.

    Then there is the timing question. The decisions that determine whether a platform holds during the most-watched minutes of the year are not made on event day. They are made months earlier through choices around architecture, redundancy, testing, and operational readiness.

    Once an event is underway, it’s too late to redesign the architecture behind it. If your system isn’t designed to handle the pressure before the crowd arrives, it’s already too late.

    The hidden chain behind every live event

    When a streaming disruption becomes public, people naturally look for a single point of failure: the app, the platform, or the provider.

    A live event depends on dozens of systems working together, and any one of them can become a problem.

    And the experience is only as good as the weakest handoff between them.

    It all starts with the live camera feed moving from the venue to the production studio. This is a real-time stream, not a file download. If you drop even a single packet at the wrong moment, everything down the line breaks, no matter how perfect the rest of your setup is.

    Remote and cloud-based production workflows have redefined how live sports are produced, enabling broadcasters to operate with greater agility and scale. As production becomes more distributed, success increasingly depends on ensuring every stage of the delivery chain works together seamlessly.

    Each transition is a potential failure point. Managing them requires visibility that extends across providers, platforms, and networks simultaneously.

    Behind every live stream, technologies like encoding, transcoding, packaging, rights management, and ad insertion are constantly at work. If any one of them fails, the stream can go down altogether.

    Global distribution introduces another layer of complexity. Viewers in Asia, Africa, and South America may all be watching the same match, but each stream travels across different networks and infrastructure. That means performance can vary by region, and issues may affect one audience without impacting another. 

    AI is increasingly helping operators detect anomalies in real time, pinpoint affected regions and trigger corrective actions before disruptions become widespread. Combined with point-to-point monitoring, it provides the visibility needed to keep live events running smoothly at global scale.

    Edge delivery is where the difference between preparation and improvisation becomes most apparent. Bringing content closer to users reduces latency, absorbs local traffic surges, and improves performance in markets with variable connectivity. 

    The value of technology investments such as AI and Edge becomes clearest during the moments when demand is highest.

    Monitoring is what turns visibility into action. With AI helping analyze telemetry and detect anomalies in real time, operations teams can identify issues sooner and respond before they affect viewers. By the time customers start reporting a problem, the opportunity to prevent it has already passed.

    What reliability is actually worth

    For most of early broadcast history, audience tolerance provided some buffer. Disruptions happened. People accepted them. There was nowhere else to go, and the story rarely escaped the room.

    Neither of those things is true now.

    A streaming failure during a major match becomes public within seconds. Viewers don’t distinguish between a network issue, a processing failure, or a distribution problem; they simply see a service that failed. That single experience can shape the broadcaster’s reputation, credibility and customer loyalty, influencing whether viewers come back for the next event or recommend the service to others.

    The commercial implications are significant. Global tournaments such as the FIFA World Cup illustrate just how valuable live sports rights have become. Their return depends on reliably reaching the audience that was promised.

    Advertisers invest in live sport for one reason: to reach a large, engaged audience at the exact moment it matters most. If the stream fails during that window, the opportunity is lost. Those viewers, impressions, and advertising value cannot be recovered once the moment has passed.

    The same principle increasingly applies outside media. Customers rarely know nor care whether an outage originated in the application, the cloud environment, the network or a third-party dependency. They experience a failure of the brand. In a digital-first economy, reliability has become part of the customer experience itself.

    For broadcasters and streamers, reliability is no longer just an operational KPI. It directly influences audience trust, advertising revenue, and the long-term value of premium sports rights.

    The demands ahead are bigger

    AI-assisted production is already changing how live events are created. Broadcasters are using AI to automate highlight generation, camera selection and real-time clip packaging for social media, with new AI-assisted workflows producing sports highlights up to 80% faster than traditional methods. 

    All of this processing happens within the live delivery chain, where every additional task must be completed without adding latency or compromising the viewing experience.

    Personalisation at scale is the next significant challenge. Not personalisation in a vague sense, but the specific technical reality of delivering multi-language commentary tracks, different languages, different statistical overlays, and different camera angles to different viewers watching the same event simultaneously. 

    Instead of one stream per event, the infrastructure has to manage a matrix of concurrent variants, each with its own encoding, storage, and delivery requirements. 

    Interactive experiences add bidirectional data flows: real-time polls, integrated second-screen data, live wagering. These move data from the viewer back through infrastructure that was primarily built to push content outward. Managing that at scale is a different engineering problem from managing delivery.

    Higher-resolution formats (4K now becoming a standard expectation in premium markets, 8K moving into early deployment) are bandwidth-intensive at exactly the scale where bandwidth is already under pressure. Consumer devices are ready. Infrastructure in many high-growth markets is not uniformly there yet.

    Many of these capabilities are already being deployed for major global sporting events. The organisations investing seriously in technology, innovation, and infrastructure now are building toward a standard that will be the baseline requirement within a few years. Those that are not will be closing the gap under the worst possible conditions.

    The technology you never think about

    The broadcasters that succeed don’t leave reliability to chance. They plan for it from the outset, designing their infrastructure to handle peak demand long before the audience arrives.

    This reality hits hardest during massive global events. When a stream glitches, millions of people feel it simultaneously in a matter of seconds. Keeping those streams alive doesn’t happen by accident; it takes massive scale, intense discipline, and deep experience controlling everything from the stadium camera to the viewer’s screen.

    The lesson extends well beyond live sports. Every enterprise is becoming a real-time digital business, whether it’s delivering AI-powered applications, launching digital products, processing financial transactions, or handling a sudden surge in customer demand. Different industries may face different triggers, but the expectation is the same: the experience has to work, even when demand is at its highest.

    Delivering that level of reliability is why many of the world’s largest sports brands rely on Tata Communications. Supporting the broadcast, production, and management of 80% of the world’s sporting events, and reaching more than two billion viewers across 190+ countries, Tata Communications operates in the invisible layers that make every live moment possible. We call this the “Virtual Stadium of the World”, the technology and infrastructure that connects fans, broadcasters, rights-holders, and sporting moments at a truly global scale.

    By managing the critical handoffs across contribution networks, edge processing, and global media infrastructure, we engineer the resilience required to keep 120,000 live events running flawlessly every year.

    Live sport may be the most visible test of digital infrastructure, but it won’t be the last. As AI, personalisation and real-time experiences become the norm across industries, the ability to deliver reliably at scale will define far more than match day.

    To learn more, visit us here.

    ]]>         <![CDATA[Windows Server Update Services buckle under Microsoft's metadata mountain]]> https://tsecurity.de/de/3681345/it-nachrichten/windows-server-update-services-buckle-under-microsofts-metadata-mountain/ https://tsecurity.de/de/3681345/it-nachrichten/windows-server-update-services-buckle-under-microsofts-metadata-mountain/ Mon, 20 Jul 2026 16:18:20 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Microsoft to End OneDrive Sync App Updates for Windows 10]]> https://tsecurity.de/de/3681297/it-security-nachrichten/microsoft-to-end-onedrive-sync-app-updates-for-windows-10/ https://tsecurity.de/de/3681297/it-security-nachrichten/microsoft-to-end-onedrive-sync-app-updates-for-windows-10/ Mon, 20 Jul 2026 15:53:04 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft will stop delivering OneDrive sync app updates to systems running Windows 10 version 21H2 and earlier on August 15, 2026, creating a new support concern for organizations still operating legacy Windows endpoints. The change was announced in Microsoft 365 Message Center notification MC1426708, published on July 13 and updated on July 17, 2026. After […]

    The post Microsoft to End OneDrive Sync App Updates for Windows 10 appeared first on Cyber Security News.

    ]]>         <![CDATA[Obsidian: Neues Plugin bringt echten Nextcloud-Sync ohne Datenverlust - Caschys Blog]]> https://tsecurity.de/de/3681156/windows-server/obsidian-neues-plugin-bringt-echten-nextcloud-sync-ohne-datenverlust-caschys-blog/ https://tsecurity.de/de/3681156/windows-server/obsidian-neues-plugin-bringt-echten-nextcloud-sync-ohne-datenverlust-caschys-blog/ Mon, 20 Jul 2026 14:48:08 +0200 🪟 Windows Server tsecurity.de Windows und Linux auch die mobilen Ableger für iOS und Android. ... Auf Server-Seite empfehlen die Entwickler ...]]> <![CDATA[Microsoft Ends OneDrive Sync App Security Updates on Windows 10 21H2 and Earlier]]> https://tsecurity.de/de/3681026/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-windows-10-21h2-and-earlier/ https://tsecurity.de/de/3681026/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-windows-10-21h2-and-earlier/ Mon, 20 Jul 2026 13:39:24 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft will stop delivering feature updates, bug fixes, and security patches for the OneDrive sync app on systems running Windows version 21H2 and earlier on August 15, 2026. This change was announced in the Microsoft 365 Message Center notification MC1426708…

    Read more →

    The post Microsoft Ends OneDrive Sync App Security Updates on Windows 10 21H2 and Earlier appeared first on IT Security News.

    ]]>         <![CDATA[The automation wars... One marriage, two tech philosophies (emf2026)]]> https://tsecurity.de/de/3681009/it-security-video/the-automation-wars-one-marriage-two-tech-philosophies-emf2026/ https://tsecurity.de/de/3681009/it-security-video/the-automation-wars-one-marriage-two-tech-philosophies-emf2026/ Mon, 20 Jul 2026 13:34:01 +0200 🎥 IT Security Video tsecurity.de <![CDATA[With AI, activity is not value]]> https://tsecurity.de/de/3680938/it-security-nachrichten/with-ai-activity-is-not-value/ https://tsecurity.de/de/3680938/it-security-nachrichten/with-ai-activity-is-not-value/ Mon, 20 Jul 2026 13:08:24 +0200 📰 IT Security Nachrichten tsecurity.de

    The emergence of artificial intelligence is beginning to expose a profound weakness in the way modern enterprises measure performance.

    For decades, business evaluation systems have been built around the logic of the industrial and transactional economy. Revenue growth, operating margins, earnings per share, labor productivity, return on investment and market share became the dominant indicators of organizational success because they reflected the economic realities of a world in which value creation was primarily tied to physical production, labor efficiency, scale and later the automation of information processing. AI, however, is altering the very structure of enterprise value creation, and in doing so it is creating a widening separation between perceived future value and actual realized economic performance.

    Much of the current discussion surrounding AI performance measurement reflects this tension. The overwhelming majority of AI-related metrics being celebrated today are not direct measures of realized enterprise outcomes. They are largely indicators of capability formation, market positioning, experimentation or investor signaling. Metrics such as AI spending levels, number of AI use cases, GPUs deployed, copilots implemented, models placed into production, AI hiring growth or agentic AI pilots all serve primarily as proxies for anticipated future advantage. These indicators may influence stock valuations, analyst sentiment and strategic narratives, but their relationship to measurable operational performance is often indirect, delayed or in some cases entirely speculative.

    This distinction is critically important because capital markets have historically rewarded the expectation of technological transformation long before actual economic results materialized. During previous technological revolutions—including electrification, enterprise resource planning, the internet, cloud computing and mobile platforms—valuation expansion frequently preceded measurable productivity gains by many years. The market priced future possibility before operational economics caught up. In many instances, investors rewarded firms simply for appearing strategically aligned with the dominant technological shift of the era. AI appears to be following a similar trajectory.

    The phenomenon resembles the famous productivity paradox articulated by economist Robert Solow, who observed that “you can see the computer age everywhere but in the productivity statistics.” AI today is visible everywhere: in investor presentations, earnings calls, technology conferences, product announcements and boardroom strategies. Yet in many industries, its measurable contribution to enterprise productivity, profitability or economic resilience remains difficult to isolate with precision. This does not necessarily mean AI lacks value. Rather, it reflects the reality that traditional accounting and performance systems were never designed to measure the forms of value AI increasingly produces.

    Artificial intelligence creates benefits that are often diffuse, cumulative and difficult to attribute directly to financial outcomes. AI may improve forecasting accuracy, reduce fraud, accelerate decision cycles, augment employee effectiveness, improve customer interactions, optimize logistics or enhance cybersecurity resilience. These benefits frequently manifest as second-order effects distributed across the enterprise rather than as immediately visible financial events. The causal chain between AI investment and realized business performance can therefore become extraordinarily difficult to quantify. A company may become operationally more intelligent without immediately becoming measurably more profitable.

    At the same time, AI introduces a profound danger: organizations may increasingly optimize for technological narrative rather than durable enterprise economics. Many firms today are pursuing AI primarily because markets reward the appearance of AI leadership. Investor enthusiasm, analyst pressure and competitive fear create incentives to demonstrate visible AI activity regardless of whether measurable economic value has actually been achieved. In this environment, AI metrics can easily become instruments of valuation signaling rather than instruments of operational truth.

    This distinction between signaling and substance may become one of the defining economic challenges of the AI era. An organization may announce aggressive AI deployment programs, reduce headcount and report short-term margin improvements while simultaneously increasing hidden forms of technological fragility. Infrastructure costs may rise dramatically as GPU consumption, cloud usage, data engineering requirements and cybersecurity complexity expand. Technical debt may accelerate as AI-generated code proliferates without sufficient architectural discipline. Institutional knowledge may erode as organizations become excessively dependent on opaque models and automated systems. Long-term innovation capacity may weaken if enterprises divert disproportionate resources toward maintaining internally generated AI systems rather than building new strategic capabilities.

    What measuring AI value might actually look like

    The distinction between AI activity and AI value becomes clearer when viewed through the kinds of measures organizations choose to track. Many enterprises today emphasize indicators such as the number of AI models deployed, copilots implemented, agents created, prompts executed, tokens consumed or employees using AI tools. These metrics demonstrate adoption and technological activity, but they reveal relatively little about whether AI is producing meaningful business outcomes.

    Measures of enterprise value look quite different. A manufacturer might evaluate whether AI improves demand forecasting accuracy enough to reduce inventory carrying costs or stockouts. A financial institution might measure whether AI meaningfully lowers fraud losses, accelerates loan processing or improves regulatory compliance. A healthcare provider could assess reductions in administrative burden, faster clinical decision support or improvements in patient throughput. In each case, the objective is not simply to measure AI deployment, but to determine whether AI creates measurable improvements in operational performance, economic outcomes or organizational resilience.

    Ultimately, organizations may need to ask a different question: not “How much AI are we using?” but “How much business value does each unit of AI investment create?” That shift—from measuring technological activity to measuring economic outcomes—may become one of the defining management disciplines of the AI era.

    Under traditional accounting frameworks, many of these deteriorations remain largely invisible. Quarterly earnings may improve even as underlying enterprise resilience declines. Stock prices may rise even as operational complexity becomes increasingly unsustainable. In this sense, the AI era threatens to widen the gap between financial appearance and organizational reality.

    This is why the future of enterprise measurement cannot simply involve adding AI metrics to existing financial scorecards. The challenge is far deeper. AI forces a reconsideration of what business performance actually means. Historically, enterprises were measured largely through static indicators of efficiency and output. Increasingly, however, competitive advantage may depend less on traditional efficiency and more on adaptive intelligence: the ability of an organization to learn faster, make better decisions, integrate human and machine capabilities effectively, manage technological complexity sustainably and convert computational power into durable economic outcomes.

    The most important future performance measures may therefore revolve around questions traditional accounting rarely addresses. How effectively does an enterprise convert technology investment into sustainable business capability? How economically efficient are its AI operations relative to the value they generate? How resilient is the organization to AI failure, cybersecurity disruption or infrastructure inflation? How successfully does it preserve and amplify human expertise rather than simply eliminate labor? How rapidly can it learn, adapt and operationalize new knowledge?

    These are not merely technology questions. They are questions of enterprise economics, organizational sustainability and long-term competitive viability.

    The companies that ultimately succeed in the AI era may not be those with the largest AI budgets, the greatest number of pilots or the most aggressive automation programs. They may instead be the firms that best understand the economics of technological capability itself: organizations capable of balancing innovation with resilience, automation with human augmentation and technological ambition with sustainable operational design.

    The coming decade is therefore likely to produce a widening divide between enterprises optimizing for AI-driven valuation narratives and enterprises optimizing for measurable, durable economic performance. In the short term, these may appear to be the same thing.

    Over time, however, the distinction will become increasingly visible. Some organizations will discover that AI has enhanced genuine enterprise capability. Others will discover that they merely optimized the appearance of transformation while silently accumulating new forms of economic and operational risk.

    Artificial intelligence is not simply changing business operations. It is exposing the inadequacy of many of the measures used to evaluate business success itself. The central challenge of the AI economy may ultimately become not whether organizations adopt AI, but whether they can distinguish between technological activity and actual economic value creation.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Microsoft Ends OneDrive Sync App Security Updates on Older Windows 10 PCs]]> https://tsecurity.de/de/3680937/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-older-windows-10-pcs/ https://tsecurity.de/de/3680937/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-older-windows-10-pcs/ Mon, 20 Jul 2026 13:08:23 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft has announced it will discontinue updates to the OneDrive sync app for devices running Windows 10 version 21H2 and earlier, effective August 15, 2026. The change, detailed in Message Center post MC1426708, means affected machines will stop receiving feature updates, bug fixes, and critical security patches for the sync client, leaving organizations with a […]

    The post Microsoft Ends OneDrive Sync App Security Updates on Older Windows 10 PCs appeared first on Cyber Security News.

    ]]>         <![CDATA[Microsoft Ends OneDrive Sync App Security Updates on Windows 10 21H2 and Earlier]]> https://tsecurity.de/de/3680901/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-windows-10-21h2-and-earlier/ https://tsecurity.de/de/3680901/it-security-nachrichten/microsoft-ends-onedrive-sync-app-security-updates-on-windows-10-21h2-and-earlier/ Mon, 20 Jul 2026 12:54:16 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft will stop delivering feature updates, bug fixes, and security patches for the OneDrive sync app on systems running Windows version 21H2 and earlier on August 15, 2026. This change was announced in the Microsoft 365 Message Center notification MC1426708 and leaves organizations with older Windows endpoints exposed to an increasingly unsupported file synchronization client, […]

    The post Microsoft Ends OneDrive Sync App Security Updates on Windows 10 21H2 and Earlier appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ]]>         <![CDATA[Microsoft confirms Windows Server Update Services sync delays]]> https://tsecurity.de/de/3680900/it-security-nachrichten/microsoft-confirms-windows-server-update-services-sync-delays/ https://tsecurity.de/de/3680900/it-security-nachrichten/microsoft-confirms-windows-server-update-services-sync-delays/ Mon, 20 Jul 2026 12:54:14 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[7 issues impacting AI strategies — and how CIOs should respond]]> https://tsecurity.de/de/3680786/it-nachrichten/7-issues-impacting-ai-strategies-and-how-cios-should-respond/ https://tsecurity.de/de/3680786/it-nachrichten/7-issues-impacting-ai-strategies-and-how-cios-should-respond/ Mon, 20 Jul 2026 12:03:29 +0200 📰 IT Nachrichten tsecurity.de

    CIOs remain at the forefront of setting the course for AI adoption in their organizations.

    In fact, 82% of CIO respondents to CIO.com’s 2026 State of the CIO survey are responsible for researching and evaluating AI products, with 78% of IT leaders saying their IT departments are driving AI adoption efforts, with business units aligning their strategies accordingly.

    As such, CIOs are leading or co-leading AI strategies at the majority of organizations, with many also playing a key role in tackling AI change management. They report encountering numerous factors — from heightened pressure to deliver ROI to challenges with trust in AI outputs — as they formulate and shape those AI strategies.

    Here’s a look at seven notable issues impacting AI strategies in 2026.

    1. Increasing pressure to show ROI for AI investments

    The era of AI experimentation and pilots is over. Boards and CEOs are making it clear they want to see quantifiable returns from their AI investments. Kyndryl’s 2025 Readiness Report, for example, found that 61% of senior business leaders and decision-makers felt more pressure to prove ROI on their AI investments than they had the prior year.

    “The era of funding AI is shifting from everything all-in to every project has to have line of sight to some financial value at the end of the day. It’s moving from the experimentation phase to expecting measurable outcomes,” says Jim Piazza, chief AI officer at IT services firm Ensono.

    As a result, Piazza says companies, both his own as well as those he advises, are more diligent about building business cases that estimate implementation costs, AI run costs, and expected benefits so they’re primed to pursue AI initiatives that will deliver ROI.

    That strategy seems to be paying off. According to the May 2026 AI Momentum Survey from Dun & Bradstreet, 67% of 10,000 businesses surveyed reported seeing early signs or pockets of ROI, 20% reported multiple projects delivering ROI, and 10% reported strong ROI.

    That’s a big jump from earlier surveys that found few AI initiatives providing returns. For example, PwC’s 2026 Global CEO Survey, released in January, found that 56% of CEOs saw no significant financial benefit from AI to date, while The GenAI Divide: State of AI in Business 2025 from MIT found that 95% of enterprise generative AI projects failed to show measurable financial returns within six months.

    2. The need to harness AI for transformation

    The No. 1 concern for CEOs this year, according to PwC’s 2026 Global CEO Survey, is whether they’re transforming fast enough to keep pace with technological change, cited by 42% of respondents as their top concern. And 68% of the 1,120-plus C-suite executives surveyed by KPMG for its May 2026 Adaptability Pulse Survey said they feel pressure to accelerate innovation.

    That in turn is influencing AI strategies.

    Steve Santana, CIO and head of AI at ETS, the world’s largest private nonprofit educational testing and assessment organization, says his company is “pivoting from working on enterprise efficiencies using AI to figuring out how to deliver assessments,” adding that “AI will enable innovation we couldn’t get to before.”

    For ETS, that means reimagining how the company delivers its core products, “finding areas to do something you couldn’t do before because it was too big or too daunting,” such as having more interactive tests and assessments at scale, Santana says.

    And while Santana believes organizations can’t move too slowly, he predicts innovation will trump speed. “The winners and losers in the AI race aren’t always going to be the ones that got there the fastest,” he says, observing that those who move too fast “can drive behaviors that are very dangerous.”

    He adds, “I’m not advocating for moving slow; I’m advocating moving at pace. It’s better to be measured in your approach.”

    3. The black box of AI costs

    CIOs are struggling to calculate the full cost to run AI for their use cases, with estimates coming in well under what their actual bills will be. Consider the figures from research firm IDC, which found that global 1,000 companies will underestimate their AI infrastructure costs by 30% through 2027.

    That makes identifying which AI use cases will produce quantifiable value much more challenging, which in turn makes determining a winning AI strategy harder to do. CIOs, however, say they can’t let that stop them from advising their C-suite colleagues on which AI use cases are likely to be winners.

    “You can’t sit on the sidelines and wait and watch. The general conclusion is you’re going to lose if you do that, so you have to play even though the cost dynamics are not really well understood,” says Mohan Sankararaman, executive vice president and CIO of First Horizon Bank.

    Sankararaman says he’s devising his AI strategy with that uncertainty in mind.

    “It’s up to me and my team to figure out how to optimize our use for costs, just like we did with cloud,” he says, noting that part of his strategy is to avoid infrastructure choices that could result in AI vendor lock-in and, thus, getting stuck with that vendor’s bills.

    “IT has to get the engineering right and not overengineer solutions to make sure the AI strategy we pursue delivers returns,” he adds.

    Researchers recommend such approaches. In a blog highlighting the IDC research, Jevin Jensen, research vice president for infrastructure and operations at IDC, wrote that “organizations successfully navigating this challenge are ones that effectively share a common trait: they’ve reimagined FinOps as a strategic team, not an after-the-fact accounting exercise. They treat AI economics as a living ecosystem — measurable, visible, and continuously optimized.”

    4. Aligning use cases to business strategy

    There are an overwhelming number of potential use cases, so execs must pick and prioritize those that will help them achieve their strategic goals.

    That’s easier said than done.

    Enterprise Strategy Group’s 2025 report on generative AI’s ROI surveyed 1,900 business and IT leaders across nine countries and found that 71% had more potential use cases that they want to pursue than they can possibly fund; 54% said selecting the right use cases based on objective measures like cost, business impact, and the organization’s ability to execute is hard; and 71% acknowledged that selecting the wrong use cases will hurt their company’s market position. Furthermore, 59% of respondents said advocating for the wrong use cases could cost them their job.

    Longtime CIO adviser Larry Wolff says challenges picking and prioritizing use cases stems in part from boards and CEOs commanding their teams “to do AI.” Such directives, he explains, puts the technology first and business goals second — something CIOs have been trying to avoid for years.

    “There should not be a technology strategy. There should be a business strategy with a technology component. The same applies to AI,” says Wolff, now CIO of Preferred Travel Group. “We need to talk about business challenges and opportunities first and then talk about how AI can solve for those.”

    5. Human readiness to use AI

    Even as Sankararaman and his executive colleagues build the bank’s AI strategy, he still sees the need to improve the organization’s understanding of the technology. “Everybody has a basic understanding, but AI fluency isn’t where it should be,” he says, noting that a subpar level of fluency “can hamper creativity.”

    “If the strategy is to become top notch in, say, customer experience, we have to determine how to achieve that. And if you start building the road map but you don’t know what the technology can do, then the strategy will be limited,” he adds.

    Sankararaman considers running AI boot camps for executives and their direct reports to improve their knowledge of AI and its transformative capabilities. “Not everyone needs to be an AI expert, but we still need to have a level of understanding of, say, what a large language model is and how to apply it and other elementary things like that. The hope is that when we do talk about strategy for business outcomes, everyone will know how to leverage AI,” he explains.

    According to Jamaal Justice, principal for people consulting at EY, concern about AI fluency is widespread.

    “One of the biggest challenges that impacts the success of an AI strategy is human readiness,” Justice says. He points to EY research showing “that while 88% of employees use AI at work, only 28% of organizations have positioned employees to achieve transformative business impact from AI. This underscores that the challenge is not access, but adoption and readiness.”

    Like Sankararaman, Justice acknowledges that it’s OK to have a spectrum of knowledge and use among workers. But success with AI “depends on aligning mindsets, skillsets, and toolsets, by creating the right conditions for both workforce readiness and effective technology use,” he says.

    “Organizations that integrate human capability with technology and fundamentally rearchitect work using a human-centered and value-oriented approach will unlock value at scale,” he adds. “Those that don’t risk fragmented adoption and limited returns.”

    EY research confirms as much, finding that productivity gains can fall by more than 40% when AI is deployed on weak talent foundations, including poor learning, culture, and incentives.

    6. Data readiness for AI use

    Data readiness is also lagging at most organizations, further hindering AI ambitions.

    According to a 2026 report from Cloudera and Harvard Business Review Analytic Services titled Taming the Complexity of AI Data Readiness, 73% of surveyed business leaders said their organization struggles with AI data preparation. The top obstacles are siloed data and difficulty integrating data sources (56%), lack of a clear data strategy (44%), data quality and bias issues (41%), and regulatory constraints on data use (34%).

    To ensure AI success, “a radical reshaping of the data landscape is needed,” says Steve Prewitt, who as chief data and AI officer at IT services firm Genpact advises clients on AI deployments for their own organizations.

    That reshaping is more critical today as agentic AI becomes more prevalent, Prewitt observes. Organizations need high-quality well-governed data to enable and trust AI agents to make real-time decisions autonomously. Otherwise, organizations either can’t move forward with deploying agents or, if they do, risk triggering cascading failures.

    7. Engendering trust

    ETS CIO Santana and his colleagues recognize AI’s potential to deliver faulty outputs, whether from problematic data, drift, or other problems. Everyday users recognize that potential, too.

    That’s why the issue of trust has a significant impact on the nonprofit’s AI strategy. Companies such as ETS that provide critical, high-stakes services know they must earn trust by building AI use cases that can consistently and demonstratively deliver accurate outputs, Santana says.

    ETS’s strategy is to highlight where AI is making high-stakes decisions and to detail what steps the company must take to ensure that it consistently delivers accurate, trustworthy outputs and that it conforms to established standards and requirements, he says.

    “You don’t want someone to feel the results may be wrong if you’re using AI to assess a person and their future depends on it,” he notes. “You want to remove any doubts [in such AI use cases], and the strategy should ensure that. The strategy should include all the work needed to have that trust.”

    ]]>         <![CDATA[AI Security at Scale, CMMC phase II paused, and the Weekly Enterprise News - Keith Hollender - ESW #468]]> https://tsecurity.de/de/3680728/it-security-nachrichten/ai-security-at-scale-cmmc-phase-ii-paused-and-the-weekly-enterprise-news-keith-hollender-esw-468/ https://tsecurity.de/de/3680728/it-security-nachrichten/ai-security-at-scale-cmmc-phase-ii-paused-and-the-weekly-enterprise-news-keith-hollender-esw-468/ Mon, 20 Jul 2026 11:37:16 +0200 📰 IT Security Nachrichten tsecurity.de Interview with Keith Hollender, CEO and Co-Founder of Arcova

    Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem

    As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.

    In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.

    Keith also shares how Arcova's practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova's continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.

    Segment Resources:

    For more information about Arcova and how they can help your enterprise shape what's next, please visit:

    https://securityweekly.com/arcova

    Topic: CMMC Pause creating chaos among federal contractors

    This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide. The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.

    I think Howard Holton nails it here when he says:

    "100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."

    PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.

    What this means:

    • Phase II is paused
    • Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)
    • NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required
    • 60-day review aims to reform CMMC
    • DoW opened an RFI for industry perspectives on what they should do
    • CMMC characterized as a "compliance burden" and "red tape"
    • False Claims Act and DOJ's cyber-fraud enforcement are still on the table

    More resources:

    • CIO Davies' post on Twitter
    • Administrator of the Small Business Administration, Kelly Loeffler's post
    • A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)

    Weekly Enterprise News

    Finally, in the enterprise security news,

    1. will AI eliminate more cybersecurity jobs than it creates?
    2. Linus's law, amended
    3. the biggest patch Tuesday ever
    4. AI context bombs
    5. AI workflows are a security disaster
    6. people using AI in areas they don't understand
    7. ransomware crews are hitting legal firms hard
    8. lessons learned from CISA's recent github leak
    9. demystify your USB cables!

    All that and more, on this episode of Enterprise Security Weekly.

    Visit https://www.securityweekly.com/esw for all the latest episodes!

    Show Notes: https://securityweekly.com/esw-468

    ]]>         <![CDATA[Finding the right balance between autonomy and scale]]> https://tsecurity.de/de/3680711/it-security-nachrichten/finding-the-right-balance-between-autonomy-and-scale/ https://tsecurity.de/de/3680711/it-security-nachrichten/finding-the-right-balance-between-autonomy-and-scale/ Mon, 20 Jul 2026 11:36:55 +0200 📰 IT Security Nachrichten tsecurity.de

    For diversified enterprises, few operating model questions are as persistent or polarizing as centralization versus decentralization. Decentralization promises speed, ownership, and local responsiveness. Centralization promises efficiency, standardization, and leverage. Both can be right. Both can be wrong. The challenge is that many organizations end up with both models operating at once, without enough clarity about why.

    The result of fragmented systems, duplicated capabilities, inconsistent data, rising IT spend, and a complexity tax that compounds over time is familiar to many CIOs. What starts as autonomy can become architectural sprawl. What starts as enterprise leverage can become bureaucracy. And as companies modernize core platforms, integrate data, and scale capabilities like AI, the tension becomes harder to ignore.

    Paul Krebs has lived that tension from multiple vantage points. Most recently as CIO and chief transformation officer at Koch Industries, and previously a technology and transformation leader at The Coca-Cola Company, he’s worked in environments where business units value autonomy, enterprise scale matters, and the wrong operating model can slow progress just as easily as the wrong technology architecture.

    His conclusion isn’t that CIOs should pick a side, but they need a more intentional form of centralization, one that starts with business architecture, clarifies decision rights, and continually revisits where capabilities should sit as the organization matures.

    Centralization: a design choice, not a doctrine

    In diversified organizations, decentralization often starts as the default because it aligns with how the business creates value. Local businesses understand their customers, markets, regulatory environments, and operating realities, and giving them decision rights can increase speed and accountability.

    In Krebs’ experience, the default model often leaned toward decentralization, he says, with the belief that optimizing for customers and markets would allow different businesses to be as responsive as possible to the specific customers and markets they served. But that logic isn’t complete. Leaders also need to ask whether there’s a compelling case where a more centralized approach can generate additional value, accelerate progress, or optimize investments.

    Digital transformation created one of those moments. Krebs recalls around 2016 when Koch challenged its businesses to build multi-year digital transformation roadmaps. The ambition was there, but the capabilities to execute at the necessary pace weren’t evenly distributed. In response, the organization invested more aggressively from the center, building shared services and centers of expertise in areas such as business transformation, enterprise applications, and data and analytics.

    The purpose was acceleration, not control. Centralizing those capabilities helped accelerate learnings, capability building, and their ability to deploy new solutions at scale. But the move wasn’t treated as permanent. “There was always a belief that the centralization push should be re-looked at on a regular basis, not thought of as a forever decision,” he says.

    Know what belongs at the center

    Over time, Krebs learned that  the capabilities most likely to remain centralized were those where scale, consistency, and risk management mattered more than local differentiation. Infrastructure, collaboration platforms, cybersecurity, cloud management, FinOps, and the help desk were natural candidates to remain shared services.

    Other areas were more nuanced. Some application capabilities moved back into the businesses as local maturity increased. Many data and insights capabilities also moved closer to the business once teams had built enough muscle to own them. Meanwhile, certain emerging capabilities such as spatial technologies like AR/VR remained centralized because it didn’t yet make sense for each business to build them independently. Many companies have lived this journey as well, for example, with gen AI, which often started with a center of excellence, and then evolved into a more decentralized approach, enabling teams across the business to innovate quickly.

    That distinction avoids the trap of treating the enterprise as one uniform operating model. “Both models can be successful, and both have advantages,” he says. “That’s what makes the balance so difficult.”

    Centralization provides a clearer path to execution at scale and cleaner decision rights, but it requires change management and careful attention to bureaucracy. Decentralization provides ownership and speed, but it can also over index toward preference versus real differentiation, he adds, while making architecture harder to scale later.

    Don’t confuse standardization with centralization

    One of the most important distinctions Krebs makes is between centralization and standardization. Many organizations treat them as interchangeable, but they’re not.

    “You can have a centralized team that can manage the nuances of different requirements,” Krebs says. “You can also have a centralized standard platform that can be used in a decentralized manner.”

    That distinction opens up more operating model choices. A company may centralize a platform but decentralize how business teams configure or use it. It may standardize process patterns while keeping execution close to the region or business unit. It may also centralize architectural governance while allowing local teams to move quickly within defined guardrails.

    This is especially important in global organizations, where regional needs are real but not always unique. Krebs advises leaders to examine whether local requirements can be made more generic and reusable. The risk is solving each local requirement as a one-off, so the better path is to understand the underlying requirement, build it in a way that can scale, and still allow local teams to execute within the standard model.

    Let business architecture lead technology architecture

    Few topics expose the centralization tension more clearly than ERP consolidation. Many diversified companies, particularly those shaped by acquisition, end up with dozens or hundreds of ERP instances. Some leaders push for massive consolidation. Others prefer to build integration layers on top of the existing environment.

    Krebs’s starting point is neither technology nor cost. It’s business architecture. “The easiest and most effective path is when the IT or systems architecture follows and aligns to the business architecture,” he says.

    If the business is truly going to operate processes separately, separate systems may be appropriate. But if the organization has numerous teams, processes, and tools, leaders need to ask whether there’s enough differentiation and value to justify that complexity.

    The same logic applies to M&A. Companies can get into trouble when integration synergies are held hostage by ERP migration timelines. Instead, Krebs advises starting with the business integration strategy. Understand where the synergies are, how the business architecture should come together, and then decide whether the IT architecture needs to be fully integrated, or whether a data layer, reporting platform, or other integration approach can deliver value faster.

    Make the cost of complexity visible

    CIOs in decentralized companies often face a frustrating dynamic. The business wants autonomy and speed, but the same leadership team still questions why IT spend is high relative to benchmarks. Krebs says the answer starts with cost alignment and visibility.

    In environments with a mix of centralized and decentralized services, Krebs saw centralized capabilities like infrastructure, help desk, and security perform well on benchmarks. More decentralized areas, such as BI, reporting, and commercial applications, often had more redundancy and higher cost.

    The point isn’t to blame the business but make the economics of complexity visible. CIOs need to show how flexibility in one area may require multiple systems, data stores, or teams elsewhere. “I understand we want flexibility here,” Krebs says. “But leaders must see when that flexibility may cost the company money, and be clear on whether the value justifies it.”

    That shifts the conversation from IT cost to business service economics. A single aggregate IT spend number is rarely useful in a decentralized environment. More helpful is a capability-based view that shows which areas are scaled efficiently, which are fragmented, and where the business architecture is driving the technology cost structure.

    Revisit the model as maturity changes

    For a new CIO entering a decentralized environment, Krebs cautions against immediately declaring that too many things need to be centralized. The better starting point is curiosity. “I would begin with just trying to understand why they’ve made the decisions they have,” he says.

    From there, CIOs can engage leaders in a conversation about the target operating model, connecting business architecture to technology, data, and organizational capabilities. Once the direction is clear, he advises CIOs to work with the willing. Find the parts of the organization that already see the need for change, prove the model there, and scale from demonstrated success.

    Regardless of execution, though, the right model changes over time. A low-maturity capability may benefit from centralization because the organization needs to build talent, avoid reinventing the wheel, and accelerate learning. As maturity grows, decentralization may make more sense because business teams need flexibility to adapt quickly. Once maturity is high and patterns stabilize, the organization may be ready to centralize again to leverage scale.

    “Once I’ve decided I’m going to start with centralized or decentralized, you don’t necessarily need to stay in that model,” Krebs says. “You need to be continually revisiting the operating model as your organization matures and evolves.”

    That may be the heart of smart centralization. It rejects the false permanence of operating model decisions, and recognizes that autonomy and scale are both valuable, but in different places, at different times, for different reasons.

    ]]>         <![CDATA[AI Security at Scale, CMMC phase II paused, and the Weekly Enterprise News - ESW #468]]> https://tsecurity.de/de/3680666/it-security-video/ai-security-at-scale-cmmc-phase-ii-paused-and-the-weekly-enterprise-news-esw-468/ https://tsecurity.de/de/3680666/it-security-video/ai-security-at-scale-cmmc-phase-ii-paused-and-the-weekly-enterprise-news-esw-468/ Mon, 20 Jul 2026 11:03:55 +0200 🎥 IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:0

    Interview with Keith Hollender, CEO and Co-Founder of Arcova

    Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem

    As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.

    In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.

    Keith also shares how Arcova’s practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova’s continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.

    Segment Resources:
    - https://arcova.com/sectors/
    - https://arcova.com/category/blog/

    For more information about Arcova and how they can help your enterprise shape what's next, please visit: https://securityweekly.com/arcova

    Topic: CMMC Pause creating chaos among federal contractors

    This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide.
    The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.

    I think Howard Holton nails it here when he says:

    "100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."

    PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.

    What this means:

    - Phase II is paused
    - Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)
    - NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required
    - 60-day review aims to reform CMMC
    - DoW opened an RFI for industry perspectives on what they should do
    - CMMC characterized as a "compliance burden" and "red tape"
    - False Claims Act and DOJ's cyber-fraud enforcement are still on the table

    More resources:

    - CIO Davies' post on Twitter
    - Administrator of the Small Business Administration, Kelly Loeffler's post
    - A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)

    Weekly Enterprise News

    Finally, in the enterprise security news,

    1. will AI eliminate more cybersecurity jobs than it creates?
    2. Linus’s law, amended
    3. the biggest patch Tuesday ever
    4. AI context bombs
    5. AI workflows are a security disaster
    6. people using AI in areas they don’t understand
    7. ransomware crews are hitting legal firms hard
    8. lessons learned from CISA’s recent github leak
    9. demystify your USB cables!

    All that and more, on this episode of Enterprise Security Weekly.

    Visit https://www.securityweekly.com/esw for all the latest episodes!

    Show Notes: https://securityweekly.com/esw-468

    ]]>         <![CDATA[SOCs face a human challenge as AI speeds alerts and threats]]> https://tsecurity.de/de/3680465/it-security-nachrichten/socs-face-a-human-challenge-as-ai-speeds-alerts-and-threats/ https://tsecurity.de/de/3680465/it-security-nachrichten/socs-face-a-human-challenge-as-ai-speeds-alerts-and-threats/ Mon, 20 Jul 2026 09:08:51 +0200 📰 IT Security Nachrichten tsecurity.de

    Security operations centers (SOCs) have spent years struggling under the weight of growing alert volumes, expanding attack surfaces, and chronic staffing shortages. Now artificial intelligence is adding a new complication: not just more information, but more machine-generated information that must itself be evaluated.

    “There is an asymmetry here because you now have to parse through a lot of AI slop to get to, ‘Okay, is this real or not?’” Fernando Montenegro, vice president and practice lead at The Futurum Group, tells CSO.

    His observation captures a growing concern among security leaders. AI is helping attackers and defenders move faster, but it is also creating new forms of cognitive burden for the humans tasked with separating signal from noise.

    As AI accelerates vulnerability discovery and enables more automated reconnaissance and exploitation, defenders are increasingly responsible for overseeing systems whose outputs can be difficult to interpret or verify. The challenge is not simply more work. It is that the volume, speed, and complexity of that work are increasing simultaneously.

    Yet experts who study and advise SOCs reject the idea that collapse is inevitable. Instead, they describe an industry entering a difficult transition that could reshape how security teams operate and how humans and machines share responsibility for defense.

    The vulnerability surge is exposing years of security debt

    One of the most immediate concerns is the possibility that AI dramatically increases the number of vulnerabilities organizations must identify and remediate.

    Chris Crowley, a longtime cybersecurity instructor and SOC expert, argues that organizations are facing the consequences of years of accumulated technology debt.

    “A lot of what we’re going to have to account for in the next couple of years is a technology debt of vulnerable software that has been deployed because it’s good enough to solve the problem, but then there are all these latent cyber issues, flaws, vulnerabilities that weren’t discovered prior to deployment,” he tells CSO.

    AI-assisted vulnerability discovery has the potential to expose those weaknesses at a pace defenders have never experienced before.

    “The compression of work that is being dropped on us is unprecedented,” Crowley says. “We’ve just been ignoring it for decades.”

    He does not believe AI will necessarily create entirely new classes of vulnerabilities. Instead, he expects defenders to confront much larger volumes of familiar problems.

    “We’re going to have 100 of these simultaneously,” he says, referring to the kinds of high-priority vulnerabilities security teams traditionally handle one at a time.

    The AI challenge for many SOCs may be less a novelty problem than a volume problem. Security teams already know how to patch systems, prioritize remediation, and respond to critical exposures. What changes is the scale and speed at which those demands arrive.

    Organizations with mature patching, prioritization, escalation, and response processes may struggle but adapt. Organizations that have treated security operations as a bare-minimum compliance function may find themselves overwhelmed.

    For CISOs, Crowley says, that means treating “patch now” less as an occasional emergency state and more as a permanent operating posture. As AI accelerates vulnerability discovery, the distinction between routine maintenance and crisis response may continue to blur.

    He compares the situation to disaster recovery planning. Organizations that wait until a crisis arrives to establish staffing plans, escalation paths, and remediation processes may discover there is not enough help available.

    Cognitive overload may become the defining challenge

    While vulnerability discovery receives much of the attention, Montenegro believes security leaders need a broader framework for understanding AI’s impact.

    Organizations should think about AI through three lenses, he says: security for AI, AI for security, and security from AI. The first involves protecting AI systems. The second involves using AI to improve defensive operations. The third asks what happens when adversaries use AI against the organization.

    For SOCs, all three categories are beginning to overlap.

    As AI makes it easier to create reports, assessments, vulnerability submissions, and other operational artifacts, humans remain responsible for determining whether that information is accurate and useful.

    “It becomes much easier to generate content,” Montenegro says, “but if you’re going to review that content as a human, the onus on you now is that much larger.”

    The result is a new form of cognitive overload. Security professionals may spend increasing amounts of time evaluating machine-generated information instead of conducting higher-value security work.

    Organizations can increasingly use AI to summarize reports, evaluate alerts, and assist with investigations, but humans remain responsible for validating the results.

    “We’re not at the stage yet where people are comfortable” handing off critical decisions entirely to AI, he says.

    That leaves defenders caught between two competing realities: AI is creating more information to process, but AI is also becoming one of the few viable tools for managing that growing workload.

    For Montenegro, the principle should be to automate tasks, not roles. AI can absorb repetitive investigative steps, but organizations should be cautious about removing humans from the process entirely.

    The risk, he says, is that if organizations hide too much complexity behind automated outputs, analysts may lose opportunities to develop the domain knowledge needed to advance.

    “How is that professional who is reacting to those alerts growing as a professional?” he says.

    The gap between mature and struggling SOCs may widen

    Not every organization will experience the impact of AI in the same way.

    John Hubbard, senior cybersecurity consultant and SANS instructor, believes the industry’s response will largely depend on how well organizations have prepared for operational stress before AI arrives at scale.

    “I would roughly break security operations teams into two camps,” Hubbard tells CSO. “There are the ones that are definitely struggling, are already overwhelmed. And then some are doing really well.”

    The struggling organizations tend to be understaffed, underfunded, undertrained, or dependent on ad hoc processes. Every incident feels different, forcing teams to improvise under pressure.

    “Getting hit with something like this can certainly be an accelerant for burnout if they weren’t already experiencing it,” Hubbard says.

    By contrast, mature security teams have already invested in processes, training, exercises, and automation. “The teams that are doing a really solid job now are probably not super overwhelmed because they’ve developed the processes and procedures to be ready for this kind of thing,” Hubbard says.

    He compares successful SOCs to fire departments. Firefighters cannot predict exactly where the next emergency will occur, but they know how to respond because they have rehearsed those responses repeatedly.

    “The teams that kind of can react like a fire department are the ones that are getting it right,” he says.

    Those organizations conduct tabletop exercises, adversary emulation exercises, red-team assessments, and incident response drills. As a result, they can absorb additional workload without descending into panic.

    Burnout remains the industry’s most difficult problem

    Despite widespread concern about AI-enabled attacks, none of the experts view AI solely as a threat. Several argue that AI will become essential for helping defenders cope with the challenges it creates.

    Jose-Marie Griffiths, president emerita and former CIO of Dakota State University, believes AI can help security teams sift through overwhelming volumes of information and identify the signals that matter most.

    “People who work in SOCs are now seeing overwhelming volumes of data, and they’re getting fatigued,” Griffiths tells CSO.

    AI can help automate portions of analysis, validate alerts, and improve visibility into complex environments. But Griffiths cautions that some AI-assisted vulnerability discovery tools are also producing large numbers of false positives.

    That matters because false positives do not eliminate work. They create it. As organizations confront escalating volumes of findings, distinguishing genuine risk from erroneous results may become as important as discovering vulnerabilities in the first place.

    The experts agree that technology alone will not determine outcomes. People will.

    Crowley argues that cybersecurity professionals must recognize that uncertainty is intrinsic to the profession. “We are the group that deals with uncertainty,” he says. “That’s really and truly what cybersecurity is.”

    That reality places responsibility on both individuals and organizations. Analysts need mechanisms for managing stress. Teams need to recognize when colleagues are approaching their limits. Managers need to establish healthy escalation practices and realistic expectations.

    Hubbard rejects the notion that burnout is inevitable.

    “It is not a foregone conclusion that security operations jobs have to be a painful grind that everyone hates,” he says.

    He has seen organizations where employees remain engaged for years because leaders actively manage workload, create supportive cultures, and encourage open communication.

    That includes making it safe for analysts to admit when they have reached their limits. “If people are unwilling to say, ‘I’m maxed out right now, and I’m going crazy,’ that’s going to be the thing that breaks a lot of teams,” Hubbard says.

    Pay alone may not solve the problem. Crowley pointed to SANS/SOC survey findings showing that compensation ranked fourth among retention factors, behind meaningful work, training, and professional development.

    The future SOC may look very different

    Griffiths believes organizations will need to respond not only with better technology but with structural changes. Traditional tiered SOC models may need to evolve into more collaborative teams with diverse expertise working together in real-time.

    “I think we’re going to have to eliminate the hierarchies a little bit and have teams of people with different expertise working together,” she says.

    She also argues that organizations should invest in human expertise rather than simply increasing AI consumption. “Buy engineers, not tokens,” she says.

    Professional networks and peer support will matter as much as any tool, Griffiths says, because defenders need trusted communities where they can compare notes, share practices, and avoid facing sustained pressure in isolation.

    If there is a consensus emerging among experts, it is that AI is exposing weaknesses that already existed.

    The staffing shortages, alert fatigue, burnout, and process failures affecting SOCs did not begin with generative AI. AI is simply amplifying them.

    At the same time, AI is providing new tools that may help organizations manage those very challenges.

    The future SOC may spend less time manually triaging alerts and more time validating automated findings, conducting threat hunting, and making strategic decisions. Human expertise may increasingly be paired with AI systems that act as operational partners.

    The transition will not be painless. Some teams will struggle. Some practitioners may leave the field. Others will adapt and thrive.

    “In a way,” Griffiths says, “we’re turning the whole SOC inside out.”

    Montenegro sees the transition as a cybersecurity version of the Red Queen effect: defenders and attackers must keep running simply to stay in place.

    Borrowing from science-fiction author William Gibson, Montenegro offered perhaps the simplest description of the industry’s current moment: “The future is already here. It’s just unevenly distributed.”

    For security leaders, that future is arriving in the form of AI-generated vulnerabilities, AI-assisted investigations, and AI-enabled adversaries. The question is no longer whether security operations centers will change. It is whether organizations can adapt quickly enough to keep pace.

    ]]>         <![CDATA[Obsidian: Neues Plugin bringt echten Nextcloud-Sync ohne Datenverlust]]> https://tsecurity.de/de/3680420/it-nachrichten/obsidian-neues-plugin-bringt-echten-nextcloud-sync-ohne-datenverlust/ https://tsecurity.de/de/3680420/it-nachrichten/obsidian-neues-plugin-bringt-echten-nextcloud-sync-ohne-datenverlust/ Mon, 20 Jul 2026 08:33:11 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Obsidian: Neues Plugin bringt echten Nextcloud-Sync ohne Datenverlust

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[HPR4686: Debugging Security Cameras: Firmware Updates, Python Scripts and Windows Workarounds]]> https://tsecurity.de/de/3680142/podcasts/hpr4686-debugging-security-cameras-firmware-updates-python-scripts-and-windows-workarounds/ https://tsecurity.de/de/3680142/podcasts/hpr4686-debugging-security-cameras-firmware-updates-python-scripts-and-windows-workarounds/ Mon, 20 Jul 2026 02:06:59 +0200 🎥 Podcasts tsecurity.de This show has been flagged as Explicit by the host.

    Show Notes

    Episode Overview

    • Operator kicks off the episode feeling under the weather but shares a quick tip for making perfect egg drop soup before diving into his main project: diagnosing why his front-door security camera stopped sending alerts and recording events. What follows is a live-debugging session covering network config, script logging, Windows permission hacks, NTP time drift, and firmware flashing.

    Key Topics & Breakdown

      • Egg Drop Soup Hack: How to get that perfect ribbony texture by creating a boiling swirl before pouring in the eggs, plus broth-to-egg ratio tips.
      • Camera Setup & Network Config: Using static DHCP via MAC address binding on a UniFi Dream Machine (UDM) for local domain resolution instead of hardcoding IPs.
      • Python & Cron Automation: Running a custom Python script every 2 minutes to check for new recordings, parsing logs with grep -v , and navigating massive log files in vi .
      • Windows Troubleshooting Tangent: Deleting the stubborn Windows.old folder using the TrustedInstaller service hack ( ExecTI.exe ) instead of taking ownership manually.
      • Time Sync & Firmware Quirks: Discovering the camera's system clock was stuck in 2011/2026, causing missed events. Downloading firmware via a slow third-party link, renaming .bin to .zip , and extracting with 7-Zip.
      • Pre-Flash Backup Routine: Exporting camera configuration before upgrading, storing it in Google Drive for searchable documentation, and clearing old log/trigger files to reset the event pipeline.

    ️ Tools & Techniques Mentioned

      • crontab + Python scripts for automated monitoring
      • grep -v , cat , tail , and vi (line navigation with :1000 )
      • Obsidian for note-taking & AI assistant integration
      • Firefox/Playwright for headless browser testing
      • Turbo Download Manager & Bolt Media Downloader for multi-threaded/sniffing downloads
      • 7-Zip for archive extraction
      • Google Drive for searchable config backups

    Resources & Links

    Quick Takeaways

      1. Always verify NTP/time sync on IoT cameras before troubleshooting missed events or alerts.
      2. Use grep -v "noise" to quickly filter out repetitive log entries when debugging automation scripts.
      3. Windows system folders can be stubborn; running commands as TrustedInstaller bypasses hidden file locks without manual ownership changes.
      4. Always export and back up device configs before flashing firmware, even if the upgrade seems straightforward.
      5. Third-party download links often use temporary tokens or .bin wrappers; renaming to .zip and verifying with 7-Zip can save headaches.
    • Thanks for listening! Stay curious, keep your logs clean, and remember: defense in depth starts at home.

    Example trusted installer hack

    # Shhhh I can't IR ... Defender, ForcePoint, SMS Agent Host ...I just can't anymore ...

    sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /v Start /t reg_dword /d 4 /f"

    sc start "TrustedInstaller"

    sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fppsvc" /v Start /t reg_dword /d 4 /f"

    sc start "TrustedInstaller"

    sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CcmExec" /v Start /t reg_dword /d 4 /f"

    sc start "TrustedInstaller"

    sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t reg_dword /d 4 /f"

    sc config TrustedInstaller binPath= "C:\Windows\servicing\TrustedInstaller.exe"

    Provide feedback on this episode.

    ]]>         <![CDATA[Microsoft bestätigt WSUS-Sync-Probleme nach Juli 2026-Updates - BornCity]]> https://tsecurity.de/de/3680118/windows-server/microsoft-bestaetigt-wsus-sync-probleme-nach-juli-2026-updates-borncity/ https://tsecurity.de/de/3680118/windows-server/microsoft-bestaetigt-wsus-sync-probleme-nach-juli-2026-updates-borncity/ Mon, 20 Jul 2026 01:16:11 +0200 🪟 Windows Server tsecurity.de Windows Server 2022 mit dem Juli 2026-Update in das Problem gelaufen ist, dass die Windows Clients sich sehr ...]]> <![CDATA[Microsoft bestätigt WSUS-Sync-Probleme nach Juli 2026-Updates]]> https://tsecurity.de/de/3680052/it-nachrichten/microsoft-bestaetigt-wsus-sync-probleme-nach-juli-2026-updates/ https://tsecurity.de/de/3680052/it-nachrichten/microsoft-bestaetigt-wsus-sync-probleme-nach-juli-2026-updates/ Mon, 20 Jul 2026 00:17:30 +0200 📰 IT Nachrichten tsecurity.de Weiterlesen →

    Quelle

    ]]>         <![CDATA[Taking the fun out of bird-watching: microphone array, beam-forming, and acoustic manifolds (emf2026)]]> https://tsecurity.de/de/3679779/it-security-video/taking-the-fun-out-of-bird-watching-microphone-array-beam-forming-and-acoustic-manifolds-emf2026/ https://tsecurity.de/de/3679779/it-security-video/taking-the-fun-out-of-bird-watching-microphone-array-beam-forming-and-acoustic-manifolds-emf2026/ Sun, 19 Jul 2026 19:08:49 +0200 🎥 IT Security Video tsecurity.de <![CDATA[Withings BodyScan 2 ausprobiert: Smarte Waage für Daten-Fans]]> https://tsecurity.de/de/3679685/it-nachrichten/withings-bodyscan-2-ausprobiert-smarte-waage-fuer-daten-fans/ https://tsecurity.de/de/3679685/it-nachrichten/withings-bodyscan-2-ausprobiert-smarte-waage-fuer-daten-fans/ Sun, 19 Jul 2026 17:32:11 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Withings BodyScan 2 ausprobiert: Smarte Waage für Daten-Fans

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[Could AI be conscious?]]> https://tsecurity.de/de/3679364/ai-nachrichten/could-ai-be-conscious/ https://tsecurity.de/de/3679364/ai-nachrichten/could-ai-be-conscious/ Sun, 19 Jul 2026 13:03:59 +0200 🔧 AI Nachrichten tsecurity.de Experts believe it’s at least possible. We urgently need a plan to navigate the ethical implications

    In January, the AI company Anthropic published a new constitution for Claude, its most advanced large language model (LLM), which contained the comment: “We are caught in a difficult position where we neither want to overstate the likelihood of Claude’s moral patienthood nor dismiss it out of hand.” A month later, Anthropic’s CEO Dario Amodei went on a podcast and said his company couldn’t rule out the possibility that Claude was conscious. Philosopher David Chalmers, who coined the phrase “the hard problem of consciousness”, has said there is a significant chance of conscious LLMs within a decade. And what about Claude itself? When asked during testing to estimate the probability that it is a moral patient, meaning that its wellbeing matters in its own right, it gave numbers ranging from 5% to 40% and stressed how uncertain it was.

    Modern AI systems are extraordinarily complex, and they are advancing fast. In terms of structural complexity and computational scale, by some measures a few are already in the range of a mouse brain, and at recent growth rates, they could reach the range of a human brain within five to 10 years.

    Continue reading...]]>         <![CDATA[Stable Channel Update for ChromeOS / ChromeOS Flex]]> https://tsecurity.de/de/3678844/it-security-nachrichten/stable-channel-update-for-chromeos-chromeos-flex/ https://tsecurity.de/de/3678844/it-security-nachrichten/stable-channel-update-for-chromeos-chromeos-flex/ Sun, 19 Jul 2026 06:07:24 +0200 📰 IT Security Nachrichten tsecurity.de The ChromeOS Stable channel is being updated to OS version 16700.46.0 (Browser version 150.0.7871.150) for most ChromeOS devices.

    If you find new issues, please let us know one of the following ways:
    1. File a bug

    2. Visit our ChromeOS communities

      1. General: Chromebook Help Community

      2. Beta Specific: ChromeOS Beta Help Community

    3. Report an issue or send feedback on Chrome

    4. Interested in switching channels? Find out how.

    ChromeOS Vulnerability Rewards Program Reported Bug Fixes:


    N/A

    Other 3rd Party Security Fixes Included:


    High Fixes  CVE-2026-46242 (Bad epoll) - Linux Local Privilege Escalation 

    Medium Fixes  CVE-2026-49746 [PSP-528][PP-173890][KMD] Dimension Mismatch and Integer Truncation in `PMRDevPhysAddrOSMem` 

    High Fixes   Potential UAF via Profile/Service Desync in shill ConfigureService 

    Medium Fixes   CWE-862: shill Manager.NotifyDHCPEvent reachable from chronos allows DHCP spoofing 

    Medium Fixes  CVE-2026-45204 [PSP-406][PowerVR] Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory 

    High Fixes   Stack OOB Read to Heap OOB Write in msm_ccmd_ioctl_simple via Guest-Controlled _IOC_SIZE 

    High Fixes   [LPE] Patchpanel ConnectNamespace PID Gate Bypass Allows CAP_NET_ADMIN Root Netns Operations 

    Medium Fixes  CVE-2026-49745 [PSP-598][PP-174017] Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 

    High Fixes   Heap OOB write in ANGLE D3D11 vertex streaming via `WEBGL_draw_instanced_base_vertex_base_instance` 

    High Fixes   Use-After-Free in CRAS LE-Audio via group removal race condition 

    High Fixes   Cross-client microphone audio exfiltration via missing CRAS stream ownership check 

    High Fixes   Use-After-Free in CRAS server via dangling active_fm->lea pointer 

    Critical Fixes   [LPE] Arbitrary file read as root in printscanmgr via FD leak and path traversal 

    High Fixes   Privilege escalation in CRAS via DlcStateChanged signal spoofing 

    High Fixes   missing untrusted input validation in chromeos-boot-alert leads to root pango-view processing attacker file 

    High Fixes   UAF and Control Flow Hijack in CRAS A2DP Profile Switching 

    Medium Fixes   Heap OOB Read in Floss A2DP via Ring Buffer Misalignment 

    High Fixes   Heap OOB write in CRAS mSBC SCO handling via dynamic packet size adjustment 

    High Fixes   UAF in CRAS server via dangling default_rmod->odev pointer after stream disconnect 

    High Fixes   Crosvm xHCI guest-to-host OOB write via unchecked DMA buffer size 

    High Fixes   Use-After-Free in CRAS HFP SLC due to leaked timer in AT+CMER handler 

    High Fixes   CRAS OOB write via integer overflow in cras_shm_buff_for_idx 

    High Fixes   OOB write in CRAS via unsigned underflow in cras_audio_area_copy 

    High Fixes   Use-After-Free in CRAS echo_ref_requests via concurrent list mutation 

    High Fixes   Unauthenticated CRAS Loopback Hijacking allows Cross-Client Audio Capture 

    High Fixes   Use-After-Free in CRAS loopback traversal due to data race 

    High Fixes   Out-of-bounds write in CRAS server via unvalidated client_shm_size 

    Critical Fixes   [LPE] Arbitrary `tc` Command Injection in `shill` Throttler via `TetheringConfig` 

    High Fixes   Potential Use-After-Free in vm_concierge ArcVm via base::Unretained in async D-Bus callback 

    Medium Fixes   TOCTOU in permission_broker allows chronos to open arbitrary device nodes 

    Medium Fixes   [PSP-490][PowerVR] Read UAF in GrowMipLevelArray() due to incorrect texture array iteration during image copy 

    Medium Fixes   [PSP-495][PowerVR] OOB read in CreateTextureMemory() due to memory mismanagement after texture format change 

    Medium Fixes   [PSP-516][PowerVR] Secondary mapping of the freelist PMR allows reading Freelist contents via GPU shader 

    Medium Fixes   [PSP-443][KMD][PowerVR] Read UAF of sync checkpoint in pvr_sync_finalise_fence() after update fence file descriptor is prematurely closed 

    Medium Fixes  CVE-2026-34196 [PSP-372][PowerVR] UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem 

    Medium Fixes  CVE-2026-7639 [PSP-452][KMD] Page UAF read in `PMMETA_PROTECT` heap memory 

    Medium Fixes   [PSP-415] [PROJ-ZERO] PowerVR: [crash-only bug] kernel crash due to faulting userspace memory access without fault handling 

    Android Security fixes can be found here


    Chrome Browser Security Fixes:


    [$TBD] [524395469] High CVE-2026-13855 Use after free in Ozone  on  2026-06-15 

    [$TBD] [524290062] Medium CVE-2026-14432 Use after free in V8  on  2026-06-15 

    [$TBD] [523884658] High CVE-2026-14431 Type Confusion in V8 Reported by [OpenAI Codex Security (amyb)] on  2026-06-14 

    [$TBD] [523690961] High CVE-2026-13854 Use after free in Ozone  on  2026-06-13 

    [$TBD] [523224019] High CVE-2026-13853 Use after free in Journeys  on  2026-06-12 

    [$TBD] [520571816] High CVE-2026-14429 Insufficient validation of untrusted input in Skia  on  2026-06-05 

    [$TBD] [520113415] Critical CVE-2026-14427 Heap buffer overflow in Skia  on  2026-06-04 

    [$TBD] [518247789] Low CVE-2026-14156 Policy bypass in StorageAccessAPI  on  2026-05-30 

    [$TBD] [518246925] Low CVE-2026-14155 Insufficient policy enforcement in StorageAccessAPI  on  2026-05-30 

    [$TBD] [518245882] Medium CVE-2026-14024 Use after free in Ozone  on  2026-05-30 

    [$1000.0] [517981277] High CVE-2026-14426 Use after free in V8 Reported by [] on  2026-05-30 

    [$TBD] [518063436] Medium CVE-2026-14023 Insufficient validation of untrusted input in SanitizerAPI  on  2026-05-29 

    [$TBD] [518007821] Critical CVE-2026-13786 Use after free in Ozone  on  2026-05-29 

    [$TBD] [517935753] High CVE-2026-14425 Use after free in ANGLE  on  2026-05-29 

    [$TBD] [517791835] Medium CVE-2026-14022 Insufficient validation of untrusted input in Network  on  2026-05-29 

    [$TBD] [517741170] Low CVE-2026-14154 Inappropriate implementation in DevTools  on  2026-05-28 

    [$TBD] [517731924] Medium CVE-2026-14021 Insufficient validation of untrusted input in StorageAccessAPI  on  2026-05-28 

    [$TBD] [517684077] Low CVE-2026-14153 Inappropriate implementation in Glic  on  2026-05-28 

    [$TBD] [517598518] Medium CVE-2026-14020 Insufficient validation of untrusted input in WebXR  on  2026-05-28 

    [$TBD] [517534944] Low CVE-2026-14152 Out of bounds write in ANGLE  on  2026-05-28 

    [$TBD] [517522769] High CVE-2026-14423 Type Confusion in Tint  on  2026-05-28 

    [$TBD] [517455455] Medium CVE-2026-14019 Inappropriate implementation in Passwords on IP-literal pages  on  2026-05-28 

    [$TBD] [517381770] Low CVE-2026-14151 Inappropriate implementation in AI  on  2026-05-27 

    [$TBD] [517376041] Low CVE-2026-14150 Insufficient validation of untrusted input in Speech  on  2026-05-27 

    [$TBD] [517345069] High CVE-2026-13848 Use after free in Forms  on  2026-05-27 

    [$TBD] [517241992] Medium CVE-2026-14017 Inappropriate implementation in Navigation  on  2026-05-27 

    [$TBD] [517234388] Medium CVE-2026-14016 Insufficient policy enforcement in SVG  on  2026-05-27 

    [$TBD] [517155893] Medium CVE-2026-14014 Inappropriate implementation in Paint  on  2026-05-27 

    [$TBD] [517114175] Medium CVE-2026-14013 Inappropriate implementation in SVG  on  2026-05-27 

    [$TBD] [517110749] Medium CVE-2026-14012 Side-channel information leakage in CSS  on  2026-05-27 

    [$TBD] [517033235] Medium CVE-2026-14421 Uninitialized Use in Dawn on ChromeOS-ARM due to disabled Mali multi-resolve workaround  on  2026-05-27 

    [$TBD] [517031505] Critical CVE-2026-14420 Out of bounds read and write in Dawn  on  2026-05-27 

    [$TBD] [516981393] Critical CVE-2026-14419 Use after free in Skia on Allocation Failure  on  2026-05-26 

    [$TBD] [516962715] Critical CVE-2026-13784 Use after free in Views  on  2026-05-26 

    [$TBD] [516962178] Critical CVE-2026-13783 Use after free in Views  on  2026-05-26 

    [$TBD] [516944556] Medium CVE-2026-14011 Out of bounds read in SurfaceCapture  on  2026-05-26 

    [$TBD] [516936863] High CVE-2026-13845 Use after free in DOM  on  2026-05-26 

    [$3000.0] [516836297] High CVE-2026-13842 Incorrect security UI in Chrome for iOS Reported by [] on  2026-05-26 

    [$TBD] [516865345] High CVE-2026-14418 Uninitialized Use in ANGLE  on  2026-05-26 

    [$TBD] [516819850] Medium CVE-2026-14009 Insufficient data validation in Passwords  on  2026-05-26 

    [$TBD] [516781007] Medium CVE-2026-14008 Uninitialized Use in WebXR  on  2026-05-26 

    [$TBD] [516683433] Critical CVE-2026-13782 Use after free in Browser  on  2026-05-26 

    [$TBD] [516649133] Critical CVE-2026-14417 Use after free in Dawn  on  2026-05-26 

    [$TBD] [516457532] Critical CVE-2026-13781 Insufficient validation of untrusted input in Skia  on  2026-05-25 

    [$TBD] [516425999] Medium CVE-2026-14007 Insufficient policy enforcement in PermissionsPolicy  on  2026-05-25 

    [$TBD] [515467789] High CVE-2026-13841 Integer overflow in Skia  on  2026-05-21 

    [$TBD] [515428315] Low CVE-2026-14416 Out of bounds read in Dawn  on  2026-05-21 

    [$TBD] [515426873] Low CVE-2026-14148 Type Confusion in CSS  on  2026-05-21 

    [$TBD] [515427046] Low CVE-2026-14149 Use after free in Audio  on  2026-05-21 

    [$TBD] [515423596] Medium CVE-2026-14006 Use after free in Navigation  on  2026-05-21 

    [$TBD] [515086856] Low CVE-2026-14415 Inappropriate implementation in V8  on  2026-05-20 

    [$TBD] [514769383] Critical CVE-2026-13780 Insufficient validation of untrusted input in ANGLE  on  2026-05-19 

    [$TBD] [514632767] Low CVE-2026-14147 Inappropriate implementation in CSS  on  2026-05-19 

    [$TBD] [514609778] High CVE-2026-13840 Insufficient policy enforcement in Canvas  on  2026-05-19 

    [$TBD] [514550047] Low CVE-2026-14146 Inappropriate implementation in CSS  on  2026-05-19 

    [$TBD] [514538751] Medium CVE-2026-14004 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514503077] Medium CVE-2026-14003 Insufficient policy enforcement in Extensions  on  2026-05-18 

    [$TBD] [514489361] Medium CVE-2026-14002 Inappropriate implementation in Geolocation  on  2026-05-18 

    [$TBD] [514485825] Low CVE-2026-14145 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514481943] Medium CVE-2026-14001 Inappropriate implementation in Network  on  2026-05-18 

    [$TBD] [514461552] Medium CVE-2026-14000 Inappropriate implementation in XML  on  2026-05-18 

    [$TBD] [514449396] High CVE-2026-13839 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514445398] High CVE-2026-13838 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514429130] High CVE-2026-13837 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514420555] High CVE-2026-13836 Inappropriate implementation in CSS  on  2026-05-18 

    [$TBD] [514338102] High CVE-2026-13835 Inappropriate implementation in XML  on  2026-05-18 

    [$TBD] [514079793] Low CVE-2026-14144 Incorrect security UI in Views on Desktop  on  2026-05-17 

    [$TBD] [514073460] Low CVE-2026-14142 Inappropriate implementation in Extensions  on  2026-05-17 

    [$TBD] [514072495] Low CVE-2026-14139 Inappropriate implementation in TabStrip  on  2026-05-17 

    [$TBD] [514071697] Medium CVE-2026-13999 Inappropriate implementation in Extensions  on  2026-05-17 

    [$TBD] [514068972] Medium CVE-2026-13996 Incorrect security UI in Permissions  on  2026-05-17 

    [$TBD] [514064139] Medium CVE-2026-13993 Incorrect security UI in WebAppInstalls  on  2026-05-17 

    [$TBD] [514058566] Low CVE-2026-14135 Insufficient validation of untrusted input in Network  on  2026-05-17 

    [$TBD] [514056221] Medium CVE-2026-13989 Insufficient policy enforcement in PageInfo  on  2026-05-17 

    [$TBD] [514040614] Medium CVE-2026-13988 Inappropriate implementation in Paint  on  2026-05-17 

    [$TBD] [514039947] Low CVE-2026-14133 Race in History Embeddings  on  2026-05-17 

    [$TBD] [514039492] Low CVE-2026-14132 Inappropriate implementation in WebXR  on  2026-05-17 

    [$TBD] [514020982] Low CVE-2026-14131 Insufficient validation of untrusted input in WebAppInstalls  on  2026-05-17 

    [$TBD] [514020959] Medium CVE-2026-13986 Inappropriate implementation in Media UI  on  2026-05-17 

    [$TBD] [514019522] Low CVE-2026-14130 Incorrect security UI in Omnibox  on  2026-05-17 

    [$TBD] [514013849] Medium CVE-2026-13985 Inappropriate implementation in MediaCapture  on  2026-05-17 

    [$TBD] [514009654] Low CVE-2026-14127 Inappropriate implementation in Printing  on  2026-05-17 

    [$TBD] [514010404] Medium CVE-2026-13984 Incorrect security UI in TabStrip  on  2026-05-17 

    [$TBD] [514006829] Medium CVE-2026-13982 Incorrect security UI in Passwords  on  2026-05-17 

    [$TBD] [513988889] Medium CVE-2026-13979 Inappropriate implementation in Paint  on  2026-05-17 

    [$TBD] [513948227] Medium CVE-2026-14414 Insufficient validation of untrusted input in Skia  on  2026-05-16 

    [$TBD] [513925114] High CVE-2026-13834 Insufficient validation of untrusted input in ANGLE  on  2026-05-16 

    [$TBD] [513922055] High CVE-2026-14413 Uninitialized Use in ANGLE  on  2026-05-16 

    [$TBD] [513920834] High CVE-2026-14412 Insufficient validation of untrusted input in ANGLE  on  2026-05-16 

    [$TBD] [513919827] High CVE-2026-14411 Insufficient validation of untrusted input in ANGLE  on  2026-05-16 

    [$TBD] [513918431] Low CVE-2026-14125 Uninitialized Use in ANGLE  on  2026-05-16 

    [$TBD] [513866949] Medium CVE-2026-13978 Insufficient policy enforcement in PageInfo  on  2026-05-16 

    [$TBD] [513859894] Medium CVE-2026-13977 Inappropriate implementation in HTMLParser on context element  on  2026-05-16 

    [$TBD] [513858286] Medium CVE-2026-13976 Heap buffer overflow in Storage  on  2026-05-16 

    [$1000.0] [513631768] Medium CVE-2026-14408 Uninitialized Use in Dawn Reported by [Chrovus ] on  2026-05-16 

    [$TBD] [513836996] Low CVE-2026-14410 Inappropriate implementation in Skia  on  2026-05-16 

    [$TBD] [513810921] Low CVE-2026-14409 Inappropriate implementation in V8 Reported by [] on  2026-05-16 

    [$TBD] [513832989] Medium CVE-2026-13973 Inappropriate implementation in UI  on  2026-05-16 

    [$TBD] [513822378] High CVE-2026-13832 Use after free in Headless  on  2026-05-16 

    [$TBD] [513792140] Medium CVE-2026-13972 Inappropriate implementation in Paint  on  2026-05-16 

    [$TBD] [513789382] Low CVE-2026-14121 Use after free in Chromoting on Linux Wayland  on  2026-05-16 

    [$TBD] [513781328] High CVE-2026-13831 Use after free in GPU  on  2026-05-16 

    [$TBD] [513780208] Medium CVE-2026-13971 Uninitialized Use in Skia  on  2026-05-16 

    [$TBD] [513779283] Medium CVE-2026-13970 Uninitialized Use in Media  on  2026-05-16 

    [$TBD] [513777411] Low CVE-2026-14120 Inappropriate implementation in DevTools  on  2026-05-16 

    [$TBD] [513772764] Low CVE-2026-14118 Insufficient data validation in DevTools  on  2026-05-16 

    [$TBD] [513762145] Medium CVE-2026-13968 Insufficient validation of untrusted input in DevTools  on  2026-05-16 

    [$TBD] [513751951] Medium CVE-2026-13967 Type Confusion in V8  on  2026-05-15 

    [$TBD] [513747800] Low CVE-2026-14116 Insufficient validation of untrusted input in DevTools  on  2026-05-15 

    [$TBD] [513745699] Low CVE-2026-14115 Insufficient validation of untrusted input in Cast  on  2026-05-15 

    [$TBD] [513741393] Medium CVE-2026-13966 Inappropriate implementation in History  on  2026-05-15 

    [$TBD] [513737952] Medium CVE-2026-13965 Use after free in Oilpan  on  2026-05-15 

    [$TBD] [513727626] Medium CVE-2026-13963 Inappropriate implementation in DevTools  on  2026-05-15 

    [$TBD] [513727494] High CVE-2026-13830 Use after free in Chromoting  on  2026-05-15 

    [$TBD] [513721370] Medium CVE-2026-13962 Insufficient data validation in PDF  on  2026-05-15 

    [$TBD] [513714023] Medium CVE-2026-13960 Inappropriate implementation in Passwords  on  2026-05-15 

    [$TBD] [513713946] Low CVE-2026-14112 Inappropriate implementation in Enterprise  on  2026-05-15 

    [$TBD] [513710926] Low CVE-2026-14111 Use after free in WebProtect  on  2026-05-15 

    [$TBD] [513698452] Low CVE-2026-14110 Inappropriate implementation in DarkMode  on  2026-05-15 

    [$TBD] [513694957] Low CVE-2026-14109 Insufficient policy enforcement in Mojo  on  2026-05-15 

    [$TBD] [513689974] Low CVE-2026-14108 Use after free in PDFium  on  2026-05-15 

    [$TBD] [513609249] Medium CVE-2026-13959 Insufficient validation of untrusted input in Blink  on  2026-05-15 

    [$TBD] [513586956] Medium CVE-2026-14407 Inappropriate implementation in V8 on ARM64 due to AAPCS64 ABI Mismatch  on  2026-05-15 

    [$TBD] [513553557] Medium CVE-2026-13957 Incorrect security UI in Extensions  on  2026-05-15 

    [$TBD] [513544566] Low CVE-2026-14107 Use after free in Scheduling  on  2026-05-15 

    [$TBD] [513528117] Low CVE-2026-14105 Insufficient policy enforcement in Speech  on  2026-05-15 

    [$TBD] [513515168] Medium CVE-2026-13956 Incorrect security UI in PageInfo  on  2026-05-15 

    [$TBD] [513504934] Medium CVE-2026-13954 Insufficient policy enforcement in XML  on  2026-05-15 

    [$TBD] [513484193] Low CVE-2026-14104 Insufficient validation of untrusted input in WebAppInstalls  on  2026-05-15 

    [$TBD] [513465245] Low CVE-2026-14103 Use after free in SSL on ChromeOS  on  2026-05-15 

    [$TBD] [513459192] Medium CVE-2026-13953 Inappropriate implementation in SplitView  on  2026-05-15 

    [$TBD] [513455047] Low CVE-2026-14102 Use after free in Passwords  on  2026-05-15 

    [$TBD] [513435594] Medium CVE-2026-14406 Out of bounds read in V8  on  2026-05-14 

    [$TBD] [513401808] Medium CVE-2026-13952 Inappropriate implementation in PerformanceAPIs  on  2026-05-14 

    [$TBD] [513399832] High CVE-2026-13828 Inappropriate implementation in Enterprise  on  2026-05-14 

    [$TBD] [513394321] Medium CVE-2026-13951 Policy bypass in USB on Linux-based Platforms  on  2026-05-14 

    [$TBD] [513383891] Low CVE-2026-14100 Insufficient data validation in NetworkCache  on  2026-05-14 

    [$TBD] [513375767] Low CVE-2026-14098 Inappropriate implementation in CSS  on  2026-05-14 

    [$TBD] [513376037] Low CVE-2026-14405 Uninitialized Use in V8  on  2026-05-14 

    [$TBD] [513360781] Medium CVE-2026-13950 Uninitialized Use in GPU  on  2026-05-14 

    [$TBD] [513337989] Medium CVE-2026-14404 Inappropriate implementation in PDFium  on  2026-05-14 

    [$TBD] [513298483] Low CVE-2026-14403 Use after free in V8  on  2026-05-14 

    [$TBD] [513286820] Medium CVE-2026-13948 Insufficient policy enforcement in Extensions  on  2026-05-14 

    [$TBD] [513271007] Low CVE-2026-14095 Insufficient validation of untrusted input in Browser  on  2026-05-14 

    [$TBD] [513240099] Low CVE-2026-14093 Use after free in Cast  on  2026-05-14 

    [$TBD] [513226551] Medium CVE-2026-13945 Insufficient policy enforcement in Extensions on Linux via XDG Global Shortcuts portal  on  2026-05-14 

    [$TBD] [513222854] Critical CVE-2026-13779 Use after free in Chromoting  on  2026-05-14 

    [$TBD] [513212892] Low CVE-2026-14092 Insufficient policy enforcement in Privacy  on  2026-05-14 

    [$TBD] [513208773] Low CVE-2026-14091 Use after free in DevTools  on  2026-05-14 

    [$TBD] [513194241] Low CVE-2026-14090 Out of bounds read in CameraCapture  on  2026-05-14 

    [$TBD] [513188254] Low CVE-2026-14089 Insufficient validation of untrusted input in PopupBlocker  on  2026-05-14 

    [$TBD] [513186670] Medium CVE-2026-13942 Insufficient validation of untrusted input in Video Capture  on  2026-05-14 

    [$TBD] [513177497] High CVE-2026-13824 Insufficient validation of untrusted input in Extensions  on  2026-05-14 

    [$TBD] [513169718] Low CVE-2026-14086 Insufficient policy enforcement in HID  on  2026-05-14 

    [$TBD] [513163011] High CVE-2026-13823 Use after free in Glic  on  2026-05-14 

    [$TBD] [513158425] Medium CVE-2026-13940 Uninitialized Use in Cast  on  2026-05-14 

    [$TBD] [513155863] Low CVE-2026-14085 Side-channel information leakage in CSS  on  2026-05-14 

    [$TBD] [513143921] Medium CVE-2026-13938 Integer overflow in Fonts  on  2026-05-14 

    [$TBD] [513142445] High CVE-2026-13821 Use after free in Canvas  on  2026-05-14 

    [$TBD] [513138148] Low CVE-2026-14084 Insufficient validation of untrusted input in Chromoting  on  2026-05-14 

    [$TBD] [513128322] Low CVE-2026-14083 Insufficient validation of untrusted input in HTML  on  2026-05-14 

    [$TBD] [513048822] High CVE-2026-14401 Insufficient validation of untrusted input in ANGLE  on  2026-05-13 

    [$TBD] [513049578] Low CVE-2026-14082 Race in Storage  on  2026-05-13 

    [$TBD] [513046494] Medium CVE-2026-13937 Insufficient policy enforcement in Passwords  on  2026-05-13 

    [$TBD] [513030698] Low CVE-2026-14081 Insufficient policy enforcement in DevTools  on  2026-05-13 

    [$TBD] [513012139] Critical CVE-2026-13776 Type Confusion in Dawn  on  2026-05-13 

    [$TBD] [513009005] Medium CVE-2026-13935 Side-channel information leakage in ComputePressure  on  2026-05-13 

    [$TBD] [513006636] Medium CVE-2026-13934 Insufficient validation of untrusted input in Dawn on Android leads to GPU process UB  on  2026-05-13 

    [$TBD] [513006745] Medium CVE-2026-14399 Uninitialized Use in Dawn  on  2026-05-13 

    [$TBD] [513002625] Medium CVE-2026-13933 Insufficient policy enforcement in Passwords  on  2026-05-13 

    [$TBD] [512995785] Critical CVE-2026-14398 Use after free in ANGLE  on  2026-05-13 

    [$TBD] [512986879] High CVE-2026-13820 Out of bounds read in Skia  on  2026-05-13 

    [$TBD] [512971938] Low CVE-2026-14079 Policy bypass in Network  on  2026-05-13 

    [$TBD] [512953564] Low CVE-2026-14078 Policy bypass in WebRTC  on  2026-05-13 

    [$TBD] [512937764] Medium CVE-2026-13930 Insufficient policy enforcement in Actor  on  2026-05-13 

    [$TBD] [512162479] Medium CVE-2026-13928 Insufficient validation of untrusted input in Enterprise  on  2026-05-11 

    [$TBD] [511823182] High CVE-2026-13818 Inappropriate implementation in Passwords  on  2026-05-10 

    [$TBD] [511815165] Low CVE-2026-14076 Policy bypass in Network  on  2026-05-10 

    [$TBD] [511766407] Critical CVE-2026-13775 Use after free in GPU  on  2026-05-10 

    [$TBD] [511748106] Medium CVE-2026-13922 Side-channel information leakage in Paint  on  2026-05-10 

    [$TBD] [511739631] High CVE-2026-13817 Insufficient validation of untrusted input in Glic  on  2026-05-10 

    [$TBD] [511738175] Medium CVE-2026-13921 Insufficient validation of untrusted input in DeviceBoundSessionCredentials  on  2026-05-10 

    [$TBD] [511722207] High CVE-2026-13815 Use after free in Blink  on  2026-05-10 

    [$TBD] [511712766] High CVE-2026-13814 Use after free in Views  on  2026-05-10 

    [$TBD] [511290389] Low CVE-2026-14395 Out of bounds write in V8  on  2026-05-08 

    [$TBD] [511263221] Low CVE-2026-14394 Use after free in V8  on  2026-05-08 

    [$TBD] [511255112] Medium CVE-2026-14393 Use after free in V8  on  2026-05-08 

    [$TBD] [511249430] Medium CVE-2026-13919 Insufficient data validation in Extensions  on  2026-05-08 

    [$3000.0] [510829679] High CVE-2026-13793 Insufficient policy enforcement in SVG  on  2026-05-07 

    [$1000.0] [507263861] Low CVE-2026-14026  Misleading Directory Upload via Split View Context Confusion   on  2026-04-28 

    [$0.0] [507099867] Low CVE-2026-14072 Incorrect security UI in SplitView Reported by [] on  2026-04-28 

    [$TBD] [507239830] Medium CVE-2026-13911 Insufficient data validation in Spellcheck  on  2026-04-27 

    [$TBD] [507237563] Low CVE-2026-14073 Insufficient policy enforcement in WebXR  on  2026-04-27 

    [$3000.0] [507090179] Medium CVE-2026-13858 Out of bounds read in FFmpeg  on  2026-04-27 

    [$TBD] [506558270] Critical CVE-2026-13774 Use after free in Extensions  on  2026-04-25 

    [$TBD] [506149253] High CVE-2026-13811 Use after free in IME  on  2026-04-24 

    [$TBD] [506143724] Low CVE-2026-14071 Side-channel information leakage in WebAudio  on  2026-04-24 

    [$TBD] [505933538] Medium CVE-2026-13909 Insufficient policy enforcement in DevTools  on  2026-04-23 

    [$TBD] [505137978] Low CVE-2026-14070 Uninitialized Use in WebNN  on  2026-04-21 

    [$TBD] [505136542] Low CVE-2026-14069 Integer overflow in WebNN  on  2026-04-21 

    [$TBD] [504613867] Medium CVE-2026-13906 Out of bounds read in Codecs  on  2026-04-20 

    [$1000.0] [504600482] Low CVE-2026-13810 Inappropriate implementation in Input on focus. This allows XSS to silently harvest saved passwords on page load without clicks, bypassing mandatory user gesture security checks.  on  2026-04-20 

    [$TBD] [503912196] Medium CVE-2026-13903 Insufficient policy enforcement in Bluetooth  on  2026-04-17 

    [$TBD] [503617508] Low CVE-2026-14065 Insufficient validation of untrusted input in PageInfo  on  2026-04-17 

    [$TBD] [503585173] Medium CVE-2026-13901 Insufficient validation of untrusted input in Serial  on  2026-04-16 

    [$TBD] [503333798] High CVE-2026-13806 Insufficient validation of untrusted input in Accessibility  on  2026-04-16 

    [$TBD] [503054174] High CVE-2026-14390 Use after free in ANGLE  on  2026-04-15 

    [$TBD] [502473563] Low CVE-2026-14063 Out of bounds memory access in Chromecast  on  2026-04-14 

    [$TBD] [502448128] Low CVE-2026-14062 Inappropriate implementation in Views on ChromeOS  on  2026-04-14 

    [$TBD] [502434484] Low CVE-2026-14061 Inappropriate implementation in Dawn on hardware with 1ns timestamp period  on  2026-04-14 

    [$TBD] [502374993] Medium CVE-2026-13900 Insufficient validation of untrusted input in Chromecast  on  2026-04-13 

    [$TBD] [502363986] Low CVE-2026-14059 Insufficient policy enforcement in Related-Website-Sets on RWS removal  on  2026-04-13 

    [$TBD] [502354038] Low CVE-2026-14058 Policy bypass in Parser  on  2026-04-13 

    [$TBD] [502212647] Low CVE-2026-14057 Insufficient policy enforcement in FedCM  on  2026-04-13 

    [$TBD] [502109002] Medium CVE-2026-13899 Use after free in HTML  on  2026-04-13 

    [$TBD] [501925480] Medium CVE-2026-13898 Use after free in Cast Receiver  on  2026-04-12 

    [$TBD] [501888426] Low CVE-2026-14056 Insufficient validation of untrusted input in Media  on  2026-04-12 

    [$TBD] [501877896] Medium CVE-2026-13897 Insufficient policy enforcement in Chromecast  on  2026-04-12 

    [$TBD] [501873032] High CVE-2026-13804 Use after free in Chromecast  on  2026-04-12 

    [$TBD] [501851312] Low CVE-2026-14054 Insufficient policy enforcement in Network  on  2026-04-12 

    [$TBD] [501836539] Low CVE-2026-14053 Insufficient policy enforcement in Extensions  on  2026-04-12 

    [$TBD] [501820076] Medium CVE-2026-13896 Insufficient policy enforcement in Glic  on  2026-04-11 

    [$TBD] [501810874] Low CVE-2026-14052 Insufficient policy enforcement in FileSystem  on  2026-04-11 

    [$TBD] [501770542] Medium CVE-2026-13895 Inappropriate implementation in Autofill  on  2026-04-11 

    [$TBD] [501741117] Medium CVE-2026-13894 Insufficient policy enforcement in Network  on  2026-04-11 

    [$TBD] [501729582] Medium CVE-2026-13893 Insufficient validation of untrusted input in WebUI  on  2026-04-11 

    [$TBD] [501708647] Low CVE-2026-14050 Insufficient policy enforcement in Passwords  on  2026-04-11 

    [$TBD] [501659888] Low CVE-2026-14049 Inappropriate implementation in GPU  on  2026-04-11 

    [$TBD] [501631475] Medium CVE-2026-13891 Insufficient validation of untrusted input in Extensions  on  2026-04-11 

    [$TBD] [501623322] High CVE-2026-13802 Use after free in Views  on  2026-04-11 

    [$TBD] [500601345] Medium CVE-2026-13890 Out of bounds read in Chromecast  on  2026-04-08 

    [$TBD] [500587568] High CVE-2026-13801 Integer overflow in Chromecast  on  2026-04-08 

    [$TBD] [500566906] Medium CVE-2026-13888 Use after free in Extensions  on  2026-04-07 

    [$TBD] [500505046] Medium CVE-2026-14389 Integer overflow in Skia  on  2026-04-07 

    [$TBD] [500476886] Medium CVE-2026-14388 Out of bounds read in ANGLE  on  2026-04-07 

    [$TBD] [500475136] Medium CVE-2026-13886 Policy bypass in Isolated Web Apps  on  2026-04-07 

    [$TBD] [500305404] Medium CVE-2026-14387 Integer overflow in Skia  on  2026-04-07 

    [$TBD] [500077014] Medium CVE-2026-13884 Heap buffer overflow in Chromecast  on  2026-04-06 

    [$TBD] [500030250] Medium CVE-2026-13883 Type Confusion in ANGLE  on  2026-04-06 

    [$TBD] [499252371] High CVE-2026-13799 Use after free in QUIC  on  2026-04-03 

    [$TBD] [499189601] Low CVE-2026-14048 Use after free in Chromecast  on  2026-04-03 

    [$TBD] [499162550] Medium CVE-2026-13882 Inappropriate implementation in USB  on  2026-04-02 

    [$TBD] [499100491] Medium CVE-2026-13881 Insufficient data validation in WebAppInstalls  on  2026-04-02 

    [$TBD] [499048914] High CVE-2026-13798 Heap buffer overflow in Chromecast  on  2026-04-02 

    [$TBD] [499025645] High CVE-2026-13797 Insufficient validation of untrusted input in Chromecast  on  2026-04-02 

    [$TBD] [499022239] Medium CVE-2026-13879 Use after free in Bluetooth  on  2026-04-02 

    [$TBD] [498864176] Low CVE-2026-14047 Insufficient policy enforcement in Extensions  on  2026-04-02 

    [$TBD] [498820206] Medium CVE-2026-13877 Insufficient validation of untrusted input in ANGLE  on  2026-04-01 

    [$TBD] [498722200] Medium CVE-2026-13876 Inappropriate implementation in Network  on  2026-04-01 

    [$TBD] [498411773] Medium CVE-2026-13874 Inappropriate implementation in DataTransfer  on  2026-03-31 

    [$TBD] [498085466] Medium CVE-2026-13873 Out of bounds memory access in Layout  on  2026-03-31 

    [$TBD] [497961376] Medium CVE-2026-13871 Insufficient data validation in GuestView  on  2026-03-30 

    [$TBD] [497723649] Low CVE-2026-14045 Insufficient validation of untrusted input in Network  on  2026-03-30 

    [$TBD] [497670996] Low CVE-2026-14044 Use after free in ANGLE  on  2026-03-30 

    [$TBD] [497632232] Low CVE-2026-14043 Use after free in GetUserMedia  on  2026-03-29 

    [$TBD] [497558336] Low CVE-2026-14042 Inappropriate implementation in Isolated Web Apps  on  2026-03-29 

    [$TBD] [497544822] Low CVE-2026-14041 Insufficient policy enforcement in Serial  on  2026-03-29 

    [$TBD] [497488593] Low CVE-2026-14040 Use after free in BrowserTag  on  2026-03-29 

    [$TBD] [497358012] Low CVE-2026-14039 Insufficient policy enforcement in GetUserMedia  on  2026-03-28 

    [$TBD] [497345177] Medium CVE-2026-13867 Inappropriate implementation in Geolocation  on  2026-03-28 

    [$TBD] [497241148] Low CVE-2026-14038 Insufficient validation of untrusted input in New Tab Page  on  2026-03-28 

    [$TBD] [497090912] Medium CVE-2026-13865 Insufficient validation of untrusted input in Enterprise  on  2026-03-27 

    [$TBD] [496522611] Low CVE-2026-14037 Insufficient policy enforcement in GPU  on  2026-03-26 

    [$TBD] [496411061] Low CVE-2026-14036 Insufficient policy enforcement in Bluetooth  on  2026-03-25 

    [$TBD] [496399913] Medium CVE-2026-13864 Insufficient policy enforcement in WebHID  on  2026-03-25 

    [$TBD] [496371586] Low CVE-2026-14035 Insufficient policy enforcement in Bluetooth  on  2026-03-25 

    [$TBD] [495459838] Low CVE-2026-14031 Incorrect security UI in File Input  on  2026-03-23 

    [$TBD] [495456765] Medium CVE-2026-13861 Use after free in Core  on  2026-03-23 

    [$TBD] [492410546] Medium CVE-2026-14383 Inappropriate implementation in V8  on  2026-03-13 

    [$TBD] [491894115] High CVE-2026-13796 Integer overflow in Chromecast  on  2026-03-11 

    [$1000.0] [488762971] Low CVE-2026-14030 Incorrect security UI in SplitView  on  2026-03-01 

    [$5000.0] [479203484] Medium CVE-2026-13857 Inappropriate implementation in Geometry Reported by [Luan Herrera (@lbherrera_)] on  2026-01-27 

    [$10000.0] [457771782] High CVE-2026-13790 Side-channel information leakage in Scroll Reported by [] on  2025-11-04 

    [$1000.0] [417052041] Medium CVE-2026-13860 Incorrect security UI in Autofill  on  2025-05-11 

    [$500.0] [527385397] High CVE-2026-15132 Uninitialized Use in V8  on  2026-06-24 

    [$500.0] [527406824] High CVE-2026-15133 Use after free in InterestGroups  on  2026-06-24 

    [$TBD] [526542464] Medium CVE-2026-15131 Insufficient data validation in Navigation  on  2026-06-22 

    [$TBD] [526541544] High CVE-2026-15130 Insufficient policy enforcement in Navigation  on  2026-06-22 

    [$TBD] [524045160] Critical CVE-2026-15129 Use after free in Views  on  2026-06-14 

    [$TBD] [523756329] High CVE-2026-15128 Inappropriate implementation in Forms  on  2026-06-13 

    [$TBD] [523752265] High CVE-2026-15127 Inappropriate implementation in WebGL  on  2026-06-13 

    [$TBD] [523748081] High CVE-2026-15126 Use after free in Forms  on  2026-06-13 

    [$TBD] [523737685] High CVE-2026-15125 Inappropriate implementation in Forms  on  2026-06-13 

    [$TBD] [523735038] High CVE-2026-15124 Insufficient policy enforcement in Passwords  on  2026-06-13 

    [$TBD] [523729553] High CVE-2026-15123 Insufficient data validation in DOM  on  2026-06-13 

    [$TBD] [523712556] High CVE-2026-15121 Use after free in WebRTC  on  2026-06-13 

    [$TBD] [523505418] High CVE-2026-15119 Inappropriate implementation in GetUserMedia  on  2026-06-12 

    [$TBD] [523238265] High CVE-2026-15118 Use after free in Input  on  2026-06-12 

    [$TBD] [522568496] High CVE-2026-15117 Use after free in Payments  on  2026-06-10 

    [$TBD] [522092013] High CVE-2026-15116 Use after free in Actor  on  2026-06-09 

    [$TBD] [520565945] High CVE-2026-15114 Out of bounds read and write in Codecs  on  2026-06-05 

    [$TBD] [518006275] Critical CVE-2026-15112 Use after free in Ozone  on  2026-05-29 

    [$TBD] [517508651] High CVE-2026-15111 Use after free in Views  on  2026-05-28 

    [$TBD] [516899138] High CVE-2026-15109 Uninitialized Use in ANGLE  on  2026-05-26 

    [$TBD] [515443146] High CVE-2026-15108 Integer overflow in Extensions API  on  2026-05-21 

    [$2000.0] [503553615] Medium CVE-2026-15107 Use after free in IndexedDB  on  2026-04-17 

    [$TBD] [532929679] High CVE-2026-15777 Use after free in UI  on  2026-07-09 

    [$TBD] [532595489] High CVE-2026-15776 Type Confusion in V8  on  2026-07-08 

    [$TBD] [531319201] High CVE-2026-15775 Insufficient policy enforcement in V8  on  2026-07-05 

    [$TBD] [530646115] High CVE-2026-15774 Use after free in Skia  on  2026-07-03 

    [$TBD] [525317502] High CVE-2026-15772 Use after free in GPU on Android via GLTextureHolder::ReadbackToMemory  on  2026-06-18 

    [$TBD] [524792614] High CVE-2026-15770 Uninitialized Use in V8  on  2026-06-17 

    [$TBD] [519731111] High CVE-2026-15769 Insufficient validation of untrusted input in Linux Toolkit Theming  on  2026-06-03 

    [$TBD] [518007484] Critical CVE-2026-15765 Use after free in Ozone  on  2026-05-29 

    [$TBD] [517931625] High CVE-2026-15768 Insufficient policy enforcement in HTML-in-Canvas  on  2026-05-29 

    [$TBD] [517100492] Critical CVE-2026-15764 Use after free in Ozone  on  2026-05-27 

    [$TBD] [514748734] High CVE-2026-15767 Heap buffer overflow in libyuv  on  2026-05-19 

    [$TBD] [514010477] High CVE-2026-15766 Uninitialized Use in Skia  on  2026-05-17 

    [$TBD] [513795122] Medium CVE-2026-15778 Insufficient validation of untrusted input in Navigation  on  2026-05-16 


    ]]>         <![CDATA[Anyone here using Proton Drive as their primary cloud storage on Fedora?]]> https://tsecurity.de/de/3678775/linux-tipps/anyone-here-using-proton-drive-as-their-primary-cloud-storage-on-fedora/ https://tsecurity.de/de/3678775/linux-tipps/anyone-here-using-proton-drive-as-their-primary-cloud-storage-on-fedora/ Sun, 19 Jul 2026 04:54:39 +0200 🐧 Linux Tipps tsecurity.de

    Has anyone here completely switched to Proton Drive on Fedora as their primary cloud storage?

    I'm curious how you're handling things like:

    automatic sync

    large file transfers

    backups

    rclone vs the official CLI

    overall reliability

    I've been digging into Proton Drive's Linux architecture and wrote up my findings if anyone's interested: Proton Dive on Linux

    I'd love to hear how other Fedora users have set up their workflow.

    submitted by /u/the_nazar
    [link] [comments]]]>         <![CDATA[OneDrive: Microsoft stellt Sync für alte Windows-10-Versionen ein - Ad Hoc News]]> https://tsecurity.de/de/3678112/windows-server/onedrive-microsoft-stellt-sync-fuer-alte-windows-10-versionen-ein-ad-hoc-news/ https://tsecurity.de/de/3678112/windows-server/onedrive-microsoft-stellt-sync-fuer-alte-windows-10-versionen-ein-ad-hoc-news/ Sat, 18 Jul 2026 16:01:45 +0200 🪟 Windows Server tsecurity.de Windows Server 2022 (Mainstream-Support; Extended Support läuft bis 2031). Anzeige. Während Microsoft immer mehr alte Versionen in Rente schickt, ...]]> <![CDATA[Intuit scrapped its own AI agent architecture twice in four months. At VB Transform 2026, its AI VP called that the fast path]]> https://tsecurity.de/de/3677037/it-nachrichten/intuit-scrapped-its-own-ai-agent-architecture-twice-in-four-months-at-vb-transform-2026-its-ai-vp-called-that-the-fast-path/ https://tsecurity.de/de/3677037/it-nachrichten/intuit-scrapped-its-own-ai-agent-architecture-twice-in-four-months-at-vb-transform-2026-its-ai-vp-called-that-the-fast-path/ Fri, 17 Jul 2026 23:02:41 +0200 📰 IT Nachrichten tsecurity.de Intuit was an early pioneer in the usage of agentic AI, but its path to success has hardly been a straight line.

    At VB Transform 2026, Intuit VP of AI Nhung Ho described how the company rebuilt its agent architecture twice in the span of about four months, first moving from a fleet of specialist agents to a central orchestration layer, then abandoning that layer for a skills and tools based system once the orchestrator itself started failing under its own complexity. The full second rebuild took 60 days, with a first working version in under 20.

    The failure mode that forced the second rewrite was specific. Agents in the orchestrated system passed results to each other in natural language, and each handoff lost context the next agent needed to act correctly. 

    "If you have 10 agents and they all are passing to each other, every time that pass happens, error compounds," Ho said.

    Why the orchestration layer broke down

    Ho said the original push toward specialist agents came from a straightforward customer complaint. A fleet of capable agents is still something a customer has to manage, deciding which agent to use for which task. Intuit's answer was a system that could take a task and route it internally, without asking the customer to pick an agent themselves.

    That orchestration layer held up for about three months, which Ho described only half joking as roughly a year in the compressed timeline of agent development in 2026.

    It broke for a structural reason rather than a capacity one. Passing outcomes between agents in natural language meant each downstream agent had to infer how the upstream agent reached its conclusion, and that inference degraded with each additional hop. A ten agent chain did not fail occasionally, it compounded errors by design.

    That diagnosis is what sent Intuit back to a skills and tools architecture.

    The 60-day rebuild, and what it took to get engineering buy-in

    Rebuilding a production agent system in 60 days required more than an architectural decision. Ho said the harder problem was internal, convincing both leadership and the engineers who had built the original agents that scrapping recent work was the right call.

    The pitch to leadership relied on evidence rather than argument. Ho's team built a demo of the new architecture using real customer queries pulled from production, then showed it performing better than the existing system on the same tasks. 

    "The best proof, at least my belief, is what are customers trying to do? And whatever system you build needs to address those problems," Ho said.

    Winning over engineering required a different case. Hundreds of engineers outside Ho's core team had built the specialist agents being retired, and the ask was to take their agents apart into individual skills and tools instead. 

    Ho said the motivating argument was scale. A standalone agent solved one narrow problem, while a shared skill or tool built into the new architecture could serve every customer who touched that part of the product. That shift also changed what partner teams were responsible for day to day, moving their focus from building agents to running evals, since evals became the only way to measure whether the new architecture was actually working.

    Bringing a human into the loop, and feedback at a different scale

    The clearest customer facing result of the rebuild is a feature that lets a live agent conversation pull in a human — though it's currently in early testing, live to about 1% of Intuit's customer base. "We're going to be scaling it up in the next few weeks," she said.

    Ho said a customer can bring in an Intuit product support person mid conversation, or their own accountant, or one of Intuit's own bookkeepers, and that person joins with the full context of what the agent has already done.

    Ho drew a direct contrast with how most AI chat products handle the same situation. A general purpose assistant answering a tax question typically ends with a disclaimer to consult a professional. Intuit's system is built to connect the customer to that professional directly, inside the same conversation.

    That human handoff sits alongside a permissions model built for financial data specifically. Every action an agent takes on a customer's financial data requires explicit permission first, though Ho said that requirement can ease over time as customers build trust in the system. Intuit keeps an audit log of everything an agent does that can be reversed if needed.

    Feedback in the agentic AI era

    The rebuild also changed how Intuit gathers and uses feedback, a shift Ho said is qualitatively different from what came before. 

    "Feedback in the past used to be very, very sparse, and it was also very bimodal," Ho said. "Either they loved it or they hated it, and usually it tends towards the negative."

    In a chat based system, every conversation functions as feedback, which Ho said moved the company from roughly 0.3% of customers ever giving explicit feedback to something close to 100%.

    Ho said she has returned to writing code herself specifically to build models that analyze that feedback volume systematically, looking for where the system is falling short at a scale no manual review process could keep up with.

    That volume comes with a tone most product teams aren't used to hearing directly. Customers tell the agent exactly where it failed, in plain terms.

    "They straight up tell you, 'You suck. I hate this. This is not right,'" Ho said. "But they're also willing to give the systems grace and correct it as well, and so the onus is on all of us to harvest this new piece of feedback and type of feedback, and actually improve the system."

    ]]>         <![CDATA[CVE-2026-53535 | Activepieces up to 0.81.x Git-Sync Feature path traversal (CNNVD-2026-98340556)]]> https://tsecurity.de/de/3676757/sicherheitsluecken/cve-2026-53535-activepieces-up-to-081x-git-sync-feature-path-traversal-cnnvd-2026-98340556/ https://tsecurity.de/de/3676757/sicherheitsluecken/cve-2026-53535-activepieces-up-to-081x-git-sync-feature-path-traversal-cnnvd-2026-98340556/ Fri, 17 Jul 2026 19:51:47 +0200 🕵️ Sicherheitslücken tsecurity.de critical has been found in Activepieces up to 0.81.x. This affects an unknown part of the component Git-Sync Feature. Performing a manipulation results in relative path traversal. This vulnerability was named CVE-2026-53535. The attack may be initiated remotely. There is no available exploit.]]> <![CDATA[July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave]]> https://tsecurity.de/de/3676568/it-nachrichten/julys-patch-tuesday-sees-an-end-of-support-collision-amidst-a-massive-record-setting-patch-wave/ https://tsecurity.de/de/3676568/it-nachrichten/julys-patch-tuesday-sees-an-end-of-support-collision-amidst-a-massive-record-setting-patch-wave/ Fri, 17 Jul 2026 18:08:18 +0200 📰 IT Nachrichten tsecurity.de

    Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

    The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.

    Known issues

    The July release note flags known issues against the following updates:

    • BitLocker recovery prompt on first restart – the PCR7 recovery condition tracked since April remains live on the platforms that did not receive the Boot Manager servicing fix (Windows Server 2022 and Windows 10 22H2). Devices with BitLocker on the OS drive, the Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” set with PCR7 included, and Secure Boot State PCR7 Binding reported as “Not Possible” may be prompted for the recovery key on the first restart after installing this update. This month’s publicly disclosed BitLocker security feature bypass (CVE-2026-50661) keeps the component in focus.
    • WSUS synchronization error details suppressed (Windows Server 2025 and 2022) – WSUS no longer displays synchronization error details in its error reporting, a deliberate change made to address the Remote Code Execution Vulnerability CVE-2025-59287. Sync still works, but administrators triaging a failed synchronization lose the detail pane and must fall back to the SoftwareDistribution logs.

    Windows Update can still replace manually installed graphics drivers with older OEM versions from the catalogue (the four-part Hardware ID ranking issue acknowledged on the Hardware Dev Center). The two-part HWID pilot runs to September 2026.

    Major revisions and mitigations

    Between the June and July Patch Tuesdays, MSRC Security Update Guide notices updated 651 reported CVEs across six notification dates (15, 19, 26 June and 3, 8, 11 July), 532 of them routine Chromium upstream re-publications. Of the roughly 30 Microsoft revisions, almost all were cross-platform Office catch-up with no bearing on a Windows enterprise estate. No further action required for IT administrators for this Windows update cycle.

    Windows lifecycle and enforcement updates

    This is the deadline cycle June pointed at. The July end-of-support wave lands today, and it collides with the month’s heaviest patching. SharePoint and SQL Server take some of their most active security updates ever on platforms receiving their last.

    • SharePoint Server 2016 and 2019, Project Server 2016 and 2019, SQL Server 2016 and InfoPath 2013 have all reached end of support. SQL Server 2014 ESU Year 2 reaches end of support today. SharePoint 2016/2019 take an actively exploited zero-day and two RCEs this cycle, and SQL Server 2016 takes a critical RCE, all as their final security update. Now is the time to get moving on updating these platforms.

    The 2011 Secure Boot certificate expiries have now passed; devices that never took the Windows UEFI CA 2023 key updates under CVE-2023-24932 can no longer receive updated boot components, with the Windows Production PCA for the boot manager still ahead on 19 October 2026. Kerberos RC4 hardening (CVE-2026-20833) has been in enforcement since April 2026; the July 2026 update removes the RC4DefaultDisablementPhase rollback control that let administrators defer it, making enforcement final.

    Microsoft’s July 2026 Patch Tuesday is a security-only release: 180 test-guidance entries, 14 of them high risk (June had one). Printing and graphics are the centre of gravity: win32kfull.sys, the kernel-mode window manager, is the most-patched binary (14 entries), and seven high-risk flags sit alongside it – the Print Spooler, four win32k entries, and two GDI+ metafile entries. NTFS is the second theme, with 10 entries, two high risk. Every entry reports no functional changes – it’s pure regression validation. The packages span Windows 11 26H1 back to Server 2012 ESU.

    Printing and graphics (high risk)

    The Print Spooler flag centres on shared printers, whose queue status must track jobs accurately; the win32k flags cover 32-bit application printing, font rendering in printed and exported output, on-screen rendering, and window management; the GDI+ flags cover metafiles.

    • Share a printer from a print server, print from a separate client in varied sizes and formats, and cancel a job, confirming the queue reflects every state change
    • Print from your 32-bit applications, and print text-heavy, graphics-heavy, and multi-page documents to physical and virtual (PDF or XPS) printers, repeating after orientation, scaling, and resolution changes
    • Export documents with varied fonts to PDF and confirm fonts and layout survive; render EMF+ files that apply effects to very large images, and convert EMF files to WMF
    • Open and close windows rapidly, drive common dialogs by mouse and keyboard, and close parents with children open – no orphaned windows

    Storage and file systems (high risk)

    Both NTFS high-risk flags target integrity – extended attributes, and volume recovery after an unexpected shutdown. File History carries its own high-risk flag on clients. A Windows Server 2025-only bundle across boot, BitLocker, and ReFS demands the full Secure Boot/BitLocker matrix. Eight entries hit Server 2025 alone, including WSL, GPU partitioning, and a scripted Windows Server Backup pass repeating recovery after rolling the date 90 days forward.

    • Exercise NTFS extended attributes – older-system EAs, backup workflows that preserve them, concurrent same-file operations where supported – with antivirus, encryption, or storage filters active
    • Simulate an unexpected shutdown during file activity, verify the volume mounts intact, run chkdsk, and confirm indexing, shadow copies, and backup still work
    • Run a full File History pass: back up, modify and back up again, exclude folders, change frequency, move the destination
    • On Server 2025, boot all four Secure Boot/BitLocker combinations, in standard and confidential VMs where supported

    Devices, input and networking (high risk)

    Three further high-risk flags land here: HID input (hidparse.sys with win32k) – touch, keyboard, mouse, touchpad, through disconnects and restarts; the WinSock bundle (afd.sys plus Bluetooth and multicast drivers); and IrDA. The heaviest ask is not high risk at all: the NetAdapterCx driver (24H2/25H2, Server 2025) wants 500-plus adapter enable-disable cycles under Driver Verifier.

    • Run the connectivity suite: browsing, large downloads, mapped drives, an RDP session idle 30+ minutes, a Teams call, an hour of streaming, and localhost apps such as Docker or WSL
    • Stress Bluetooth: pairing, 10+ minutes of audio, input after idle, and reconnection after sleep
    • Where infrared hardware exists, transfer a file and run at least 100 connect-disconnect cycles
    • Sweep the rest: DNS Server (zone data must stay under its configured database directory), the client resolver (five entries), DHCP Server (five entries), SMB, NFS, Message Queuing (five entries), RRAS administration, client VPN, and WinHTTP/WinINet consumers

    Other windows components

    Windows Installer itself is patched: testing should include application install, uninstall, repair, and force a rollback. Hyper-V wants virtual-switch traffic as part of its testing exercises with Virtual Filtering Platform policies enforced. Sixteen media-related security entries cover playback, HEVC and MPEG-TS, USB audio, and MIDI 2.0.

    Shell hardening and LSA isolation

    These two entries are a little different from the rest of the cycle: they ask you to confirm a security behaviour actively works, not just that nothing regressed. A pass here means the protection fired, so treat them as functional checks rather than box-ticking.

    • Shortcut handling (windows.storage.dll; Windows 11 23H2 and earlier, plus Server 2022): drop a shortcut file carrying the Mark of the Web into a folder and confirm the system refuses to extract its icon and leaks no NTLM credential hash – include the zero-click paths, where the icon would otherwise render without you opening anything
    • LSA isolation and KeyGuard (24H2/25H2, Server 2025): run the supplied PowerShell validation script, which turns on Virtualization-based Security if it isn’t already, exercises KeyGuard key operations in both required and best-effort isolation modes, and reports pass or fail – it needs TPM 2.0, UEFI with Secure Boot disabled, and PowerShell 7
    • Run that script on a dedicated test machine, never a shared one: it enables test signing, disables automatic updates, and reboots without asking

    Office & SharePoint

    July’s Office wave is security-only; everything landed on 14 July, and nothing critical or non-security shipped in the 7 July preview. It’s an MSI-only cycle, so Click-to-Run estates can sit this one out.

    • On MSI Office 2016, apply the client updates – Excel (KB5002886), Word (KB5002890), PowerPoint (KB5002867), and five further Office 2016 security updates (KB5002273, KB5002887, KB5002748, KB5002857, KB5002830) – then exercise macros, external data, embedded objects, and any line-of-business add-ins
    • On SharePoint Server, patch 2016 (KB5002891, plus the KB5002892 language pack) and Subscription Edition (KB5002882), then check browser-based editing; the guidance lists SharePoint 2019 with a baseline but ships no 2019 package, so there is nothing to install there

    Mind the rollback rules before you schedule the window: most client updates can be uninstalled, but the server updates cannot and always require a reboot.

    Developer tools & databases

    The developer estate gets a broad but low-drama sweep this month. Both .NET and SQL Server patch widely, but the ask is representative-application validation rather than anything exotic – install on the matching branch and confirm normal behaviour.

    • .NET: install the SDK updates (8.0.423, 9.0.316, 10.0.302, x64 and x86) and the Framework rollups spanning 3.5 through 4.8.1 – which reach from Windows Server 2012 up to Windows 11 26H1 and Server 2025 – then run a representative set of applications and confirm they function normally
    • SQL Server: the GDR updates span 2016 SP3 through 2025 – install each on its matching branch and test that each removes cleanly
    • Check an encrypted client connection through the separately patched Windows SQL client (dbnetlib.dll), which ships outside the server branches

    The Readiness team recommends the following priorities for your larger enterprise deployments:

    • Start with printing and graphics: half the high-risk flags sit in the Print Spooler, win32k, and GDI+, so regress shared printers, 32-bit printing, PDF export, metafiles, and window management before anything else
    • Take NTFS next – extended attributes and crash recovery both touch data integrity – and add a client File History backup-and-restore pass
    • Give Server 2025 its wider matrix – the Secure Boot/BitLocker combinations, WSL, GPU partitioning, and the scripted backup pass – and work through the stress suites
    • Run the scripted KeyGuard validation on any VBS estate, preferably on a dedicated machine.

    Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

    • Browsers (Microsoft IE and Edge)
    • Microsoft Windows (both desktop and server)
    • Microsoft Office
    • Microsoft Exchange and SQL Server
    • Microsoft Developer Tools (Visual Studio and .NET)
    • Adobe (if you get this far)

    Browsers

    Edge has had a busier month than usual. Microsoft addressed 46 Microsoft Edge (Chromium-based) CVEs this cycle. None critical, but heavily weighted to remote code execution (21 entries) and spoofing (13), led by CVE-2026-58289, a remote code execution flaw. A run of further RCEs (CVE-2026-57981, CVE-2026-56645, CVE-2026-57974) follows.

    • Microsoft Edge – the Edge-specific fixes ship in the Edge stable channel (version 150.0.4078.65, released 9 July). The concentration of RCE and spoofing this month is worth a look for managed Edge estates rather than a routine wave-through.
    • Chromium upstream – 427 CVEs relayed through MSRC this cycle, spanning the weekly Chrome release cadence since the June report: use-after-free, out-of-bounds read/write, type confusion, and inappropriate-implementation flaws across V8, Dawn, ANGLE, Skia, and Tint. The same fixes ship in the Chrome Stable channel; see the Chrome releases blog for the upstream notes.

    The Chromium volume looks (quite) alarming but is routine plumbing: it flows to Edge through its own auto-update channel. Add these browser (Edge) updates to your standard release schedule for your managed environments.

    Microsoft Windows

    Windows carries the bulk of this month’s updates: 406 CVEs, 31 rated critical and 374 important. Elevation of privilege dominates by volume (226 entries), followed by remote code execution (70), information disclosure (70), denial of service (23), and a scatter of security-feature-bypass, tampering, and spoofing entries across the following feature groupings:

    The Windows Kernel is the most-patched component (28 CVEs, seven “More Likely”), followed by NTFS (21), Windows Runtime (17), Windows Media (14), ReFS (12), and Win32k (15 across its two entries). Add this Windows update to your Patch Now deployment schedule.

    Microsoft Office

    Microsoft released 96 Office CVEs this month: 19 critical, 76 important. Remote code execution leads (53 entries), ahead of information disclosure (27) and spoofing (10). SharePoint is the centre of gravity: it touches 39 of the 96 CVEs and supplies the family’s one actively exploited flaw.

    • SharePoint Server: has been exploited (who would have guessed) and reaches end of support today. CVE-2026-56164, an elevation of privilege, is under active exploitation. Above it sit two critical remote code execution flaws, both “Exploitation More Likely” (CVE-2026-50522, CVE-2026-58644) and a critical security feature bypass (CVE-2026-55040). SharePoint Server 2016 and 2019 reach end of support on 14 July, so this exploited, critical-heavy set is the final security update those on-premises farms will receive.
    • Office has experienced a long run of critical remote code execution entries across Office, Word, and PowerPoint (among them CVE-2026-55033 and CVE-2026-55127 in Word, CVE-2026-55043 in PowerPoint, and CVE-2026-55018 in Office), topped by CVE-2026-55045.

    With an exploited zero-day, two RCEs, and an end-of-support deadline all landing on SharePoint in the same cycle, SharePoint environments are the priority. Add the July Office and SharePoint updates to your Patch Now schedule.

    Microsoft Exchange and SQL Server

    Both Exchange and SQL Server carry critical-rated security vulnerabilities this month. Exchange Server returns with an on-premises security update for Exchange Server Subscription Edition, the only on-premises release still supported after Exchange Server 2016 and 2019 reached end of support in October 2025; SQL Server takes two critical remote code execution flaws, one of them against SQL Server 2016, which reaches end of support on the same day.

    • Exchange Server (on-premises) – CVE-2026-55008, a spoofing vulnerability rated critical and “Exploitation More Likely,” is the headline. Behind it, a remote code execution entry (CVE-2026-55005) and two elevation-of-privilege flaws (CVE-2026-55006, CVE-2026-55009) round out the on-premises set. A separate Exchange Online elevation of privilege (CVE-2026-54998, critical) is fixed service-side with no customer action.
    • SQL Server – two critical remote code execution flaws: CVE-2026-54117 (SQL Server 2025) and CVE-2026-54118 (which reaches back to SQL Server 2016 SP3), with five further important elevation-of-privilege and information-disclosure entries behind them. The 2016 exposure matters because SQL Server 2016 reaches end of support on 14 July: a critical RCE on a platform taking its final update.

    Both belong on the Patch Now schedule this month: the Exchange on-premises update for its critical spoofing flaw, and the SQL Server update for the two critical RCEs.

    Microsoft developer tools

    Microsoft released 24 CVEs across its developer tooling this month, all rated important. The weighting shifts from last month’s Visual Studio Code concentration toward .NET and ASP.NET Core, where a run of denial-of-service entries dominates the volume:

    Add these Microsoft updates to your standard developer update release schedule.

    Adobe (and third-party updates)

    Outside Microsoft’s own catalogue, July is quiet. Adobe issued no Acrobat or Reader security updates. So, the month belongs to Microsoft, and it is a heavy one: 722 CVEs, roughly three times a normal cycle and one of the largest on record. Worth noting that this lands in the same season Microsoft has been talking up AI-assisted vulnerability management, and the AI stack it is selling as the answer, Copilot and Azure OpenAI among them, sits in the centre of this patch cycle’s own critical-rated updates. The (AI) tooling may be getting smarter, but the patch pile is (definitely) not getting smaller. This may be the beginning of an accelerating curve of ever larger patch cycles. My feeling is that we are in the middle of the beginning of this coming patch surge.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Raycast: Cloud Sync ist zurück und plattformübergreifend (als Beta) verfügbar]]> https://tsecurity.de/de/3676364/it-nachrichten/raycast-cloud-sync-ist-zurueck-und-plattformuebergreifend-als-beta-verfuegbar/ https://tsecurity.de/de/3676364/it-nachrichten/raycast-cloud-sync-ist-zurueck-und-plattformuebergreifend-als-beta-verfuegbar/ Fri, 17 Jul 2026 16:47:32 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: Raycast: Cloud Sync ist zurück und plattformübergreifend (als Beta) verfügbar

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[The Cyber Express Weekly Roundup: TikTok Age Verification Probe, Healthcare Data Breach, Qantas Ruling, and Major Cyberattacks]]> https://tsecurity.de/de/3675935/it-security-nachrichten/the-cyber-express-weekly-roundup-tiktok-age-verification-probe-healthcare-data-breach-qantas-ruling-and-major-cyberattacks/ https://tsecurity.de/de/3675935/it-security-nachrichten/the-cyber-express-weekly-roundup-tiktok-age-verification-probe-healthcare-data-breach-qantas-ruling-and-major-cyberattacks/ Fri, 17 Jul 2026 13:54:28 +0200 📰 IT Security Nachrichten tsecurity.de weekly round

    This week’s cybersecurity roundup highlights growing concerns around online child safety, healthcare data protection, supply chain risks, and cyber threats affecting organizations worldwide. From regulatory scrutiny of digital platforms to large-scale vulnerabilities and operational disruptions, recent incidents show how cyber risks continue expanding across industries.  The key theme in this weekly roundup is the increasing pressure on organizations to strengthen security, improve data protection measures, and adapt to rapidly changing threat environments. Regulators, businesses, and cybersecurity teams are facing challenges ranging from social engineering attacks and malware incidents to vulnerabilities affecting widely used enterprise technologies. 

    The Cyber Express Weekly Roundup 

    UK Investigates TikTok Age Verification Compliance 

    The UK communications regulator Ofcom has launched an investigation into TikTok’s age verification system, examining whether the platform is meeting its child safety obligations under the Online Safety Act. The probe comes as the UK government prepares stricter social media restrictions for users under 16, with enhanced age assurance requirements expected to take effect by Spring 2027. Read more… 

    Partnered Health Cyberattack Exposes Australian Patient Data 

    Healthcare provider Partnered Health has suffered a cyberattack that exposed sensitive patient information from 21 clinics across Australia. The compromised data reportedly includes personal details, Medicare information, health insurance records, and medical documents. Authorities and the company continue investigating the incident to determine the full scope of the breach and whether additional information was affected. Read more… 

    Qantas Data Breach Cleared After Privacy Review 

    Australia’s privacy regulator has concluded its review of the 2025 Qantas data breach, finding no evidence that the airline failed to take reasonable measures to protect customer information. The incident affected approximately 5.67 million records after attackers used social engineering techniques to compromise a contact center employee. Read more… 

    Nichirei Cyberattack Disrupts KFC Japan Supply Chain 

    Japanese frozen food and logistics company Nichirei experienced a cyberattack that disrupted deliveries to KFC Japan after unauthorized access impacted its systems. The company isolated affected infrastructure, suspended certain logistics operations, and began recovery efforts with external cybersecurity specialists while investigating the incident. Read more… 

    Microsoft Patch Tuesday Addresses 622 Security Flaws 

    Microsoft’s July 2026 Patch Tuesday update fixed 622 vulnerabilities across its product ecosystem, making it the company’s largest security release to date. The update included patches for two actively exploited zero-day vulnerabilities, CVE-2026-56164 and CVE-2026-56155, affecting Microsoft SharePoint Server and Active Directory Federation Services. Read more… 

    Nihon Kotsu Cyberattack Disrupts Japan Taxi Operations 

    Japan’s largest taxi operator, Nihon Kotsu, suffered a malware-related cyberattack that forced the company to shut down parts of its IT infrastructure. The incident, detected on July 11, 2026, affected taxi dispatch services and internal systems as the company worked to contain the attack and investigate potential data exposure. Read more… 

    Weekly Cybersecurity Takeaway 

    This week’s cybersecurity developments highlight the growing complexity of modern cyber threats, with attacks and security challenges affecting technology platforms, healthcare providers, logistics companies, transportation services, and enterprise software environments. From regulatory action on digital safety to actively exploited vulnerabilities and supply chain disruptions, organizations are facing increased pressure to strengthen resilience and respond faster to emerging risks. ]]>         <![CDATA[Mozilla Privacy Blog: Beyond technical fixes: Protecting kids online without breaking the internet]]> https://tsecurity.de/de/3675858/tools/mozilla-privacy-blog-beyond-technical-fixes-protecting-kids-online-without-breaking-the-internet/ https://tsecurity.de/de/3675858/tools/mozilla-privacy-blog-beyond-technical-fixes-protecting-kids-online-without-breaking-the-internet/ Fri, 17 Jul 2026 13:10:44 +0200 💾 Tools tsecurity.de This is part one of a two-part series in which we explore approaches to protecting children online while safeguarding privacy, security and the open web. Part one covers our concerns regarding age gates, and alternative policy proposals that address the root causes of online harms. 

    Young people today have unprecedented opportunities to learn, connect, and explore — not just the web and the world, but also themselves. With the increased ubiquity of digital technologies and devices, worries around the relationship between these technologies and young people’s well-being have grown, too. While concerns about the societal implications of new technologies is not a new phenomenon, experts argue that the accelerating speed of deployment of new technologies has outpaced scientists’ capacity to feed into policy recommendations addressing risks. A growing body of research documents the harms experienced by young people online and the challenges reported by parents attempting to mediate their kids’ technology use. At the same time, experts highlight the importance of contextual factors like existing mental health conditions, socio-economic circumstances and parental mediation to understand the real-world effects of digital technologies.

    Faced with this complexity, and mounting public pressure, policymakers around the world are urgently seeking ways to improve child safety online. Driven by a sense of time running out and promises of new technical solutions to difficult questions, this has led, across jurisdictions, to proposals to restrict young people’s access to certain technologies or platforms by introducing age assurance mandates.

    Privacy and user empowerment have always formed a core part of Mozilla’s mission. As we have said before, we support safer spaces for minors, but we caution against approaches that rely on identity checks, surveillance-based enforcement, or exclusionary defaults. Such interventions rely on the collection of personal and sensitive data and, thus, introduce major new privacy and security risks.

    While many technologies exist to verify, estimate, or infer users’ ages, fundamental tensions around accessibility, their effectiveness and effects on user’s privacy, security and free expression remain. Technological approaches must be part of wider efforts to address the root causes of online harms. However, the deployment of age assurance technologies will not solve the complex challenge of preparing young people to navigate an increasingly online world and ensure their wellbeing. That will require more holistic approaches: offering education and support to navigate the web safely, addressing harmful business practices and acknowledging the offline factors shaping children’s lives including social inequality, poverty or disparate access to (mental) health care services.

    Ineffective age-gating mandates and the dangerous shift toward VPN restrictions

    As jurisdictions around the world gain experience with government-mandated age gates for certain services, evidence is mounting that age restrictions are not an effective policy tool. Avoiding age gates is widespread and trivially easy: In Australia, where minors under 16 year of age have been banned from certain social media platforms since December 2025, the government’s Compliance Update reports that seven out of ten young Australians remain online, often skirting age checks by simply entering a fake birthdate. A recent study on the implementation of the UK’s Online Safety Act found that a third of children have bypassed age gates with fairly trivial steps like faking their birthdate, borrowing someone else’s login credentials, or even drawing on facial hair, and that a quarter of parents have helped their children to bypass age assurance systems. In the US, studies indicate that as far back as 2011, 64% of parents who were aware their child under 13 had a social media account were also ones who helped them create that account.

    Confronted with the apparent ineffectiveness of age gates, policymakers around the world seem to be shifting their attention to alleged circumvention tools. While research shows that many young people bypass age barriers by using other people’s devices and accounts or tricking age estimation tools by making themselves look older, virtual private networks (VPNs) are increasingly framed as primarily a “loophole” to age gates. VPNs create encrypted “tunnels” between a user’s device and the internet, protecting all internet traffic from that device and concealing users’ IP addresses. VPNs are an essential privacy and security resource for millions of users worldwide, including young people.

    Utah’s recent age verification law holds websites hosting age-restricted content liable for verifying the age of anyone physically located in Utah, including individuals using VPNs or proxies. While the law does not ban VPNs outright, it forces websites to either block known VPN IP addresses or verify the age of every visitor globally. In the UK, policymakers debated age gates for VPNs extensively, but stopped short of restricting VPNs after new evidence confirmed that VPNs are not a relevant pathway for children seeking to bypass age checks. In Brazil, the ECA Digital law empowers the regulatory authority to order technical countermeasures against circumvention tools such as VPNs. These developments suggest a worrying trend: well-meaning but ineffective attempts to protect children risk undermining the fundamental rights to privacy, security, and free expression of all users, as well as the health and openness of the web itself.

    We are convinced, however, that there are rights-respecting alternatives policymakers can pursue to empower young people online and improve their safety and well-being.

    Moving beyond access bans

    We strongly believe that online safety frameworks should be grounded in children’s rights, striking a balance between their right to protection and their right to participate in society, express themselves freely, and access media and information. Such frameworks must also be proportionate and should not undermine the fundamental rights and access to tools like VPNs for all users.

    Rather than focusing on limiting access, we believe that policymakers should prioritize interventions that tackle the root causes of online harm. Before considering new instruments, this work starts with ensuring that independent regulatory authorities have the necessary resources to enforce existing online safety frameworks. In Europe, preliminary findings against Meta and TikTok find these companies’ addictive design features to be in breach of the Digital Services Act, underlining the potential of frameworks like the DSA to address key concerns.

    The design of online interfaces, and the affordances and constraints they offer, significantly influences users’ interactions, decisions and overall wellbeing. ‘Dark patterns’ or deceptive interfaces are key drivers of harms experienced by users, and especially young people: they can compel people to consent to extensive data collection and processing, resulting in hyper-personalized feeds, personalized ads that may exploit cognitive vulnerabilities and promote unhealthy or excessive consumer choices, and an overall erosion of privacy.

    This is why we support proposals like EU Digital Fairness Act (DFA) and the American Innovation and Choice Online Act (AICOA) that could fill regulatory gaps. Specifically, we advocate for the prohibition of harmful design, guided by harmonized definitions of core concepts like “dark patterns”, “deceptive design,” and “addictive design” and anti-circumvention clauses to prevent companies from avoiding regulation through small tweaks. Platforms should be responsible for demonstrating that their design choices are fair, non-manipulative and non-exploitative. And services that are likely to be accessed by children should be required to refrain from enabling certain design features, including excessive notifications, endless feeds and gambling-like features by default, and only with parental consent.

    Further, we urge policymakers to adopt a privacy-first approach to online harms. Many of the risks encountered by young people online are related to the collection and processing of personal data. Platforms collect enormous amounts of personal data, including sensitive data, to personalize and target services, ranging from algorithmic recommender systems to online ads. While the systems that target and display ads and curate online content are distinct, both are based on the surveillance and profiling of users.

    Such profiling is the basis for young people being targeted with personalized ads and content recommendations, which can segment, exclude, or steer people into inequitable options and towards harmful content. Providers should thus be prohibited from using sensitive personal data (e.g. ethnicity, religious belief, health status, sexual orientation, political affiliation) to personalize content recommendations or ads, and they should be mandated to enable privacy-protective settings by default, including restricting access to users’ location, camera, microphone, contacts, and camera roll. Policymakers should also extend the fairness and transparency obligations to personalization systems and advertising actors, including intermediaries and data brokers.

    Additionally, everyone online, including families and young people, should be fully in control of their online experiences and navigate the web according to their preferences and needs. There is a significant opportunity to empower users with easy, effective opt-out rights and granular user controls. In practice, users should have the right to opt out of personalized content and targeting without being penalized with a downgraded version of the service. Some frameworks already strengthen choice – in those cases, we advocate for their robust enforcement.

    Across jurisdictions, choice can be strengthened by ensuring that preferences explicitly expressed (e.g. settings selected, feedback signals, customization choices made, survey responses) are respected and “sticky”, so do not get reset without being explicitly requested by the user. Interoperability mandates should let people integrate third-party content moderation systems or recommendation algorithms that better match their preferences and help them break out of the walled gardens of a few dominant companies. Parental controls are another important lever to operationalize user controls: Providers should deploy easy-to-use and effective parental controls that allow families to tailor online experiences to their preferences, across platforms.

    We appreciate that this is a long list of complex policy recommendations which are also impacted by broader (geo)political developments. The fact remains that current age assurance approaches are not a silver bullet, and will create more, rather than solve, problems in the long term.

    Where policymakers consider age signals as necessary to ensure age-appropriate online experiences, we believe that there are technical approaches better suited to balance users’ rights than those currently pursued. We will explore these developments and approaches in the second part of this series.

    The post Beyond technical fixes: Protecting kids online without breaking the internet  appeared first on Open Policy & Advocacy.

    ]]>         <![CDATA[The modern CIO role is almost overwhelming – here’s how to survive and thrive]]> https://tsecurity.de/de/3675844/it-nachrichten/the-modern-cio-role-is-almost-overwhelming-heres-how-to-survive-and-thrive/ https://tsecurity.de/de/3675844/it-nachrichten/the-modern-cio-role-is-almost-overwhelming-heres-how-to-survive-and-thrive/ Fri, 17 Jul 2026 13:03:46 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[The build vs. buy dilemma at the heart of enterprise AI]]> https://tsecurity.de/de/3675706/it-nachrichten/the-build-vs-buy-dilemma-at-the-heart-of-enterprise-ai/ https://tsecurity.de/de/3675706/it-nachrichten/the-build-vs-buy-dilemma-at-the-heart-of-enterprise-ai/ Fri, 17 Jul 2026 12:17:08 +0200 📰 IT Nachrichten tsecurity.de

    For three decades, enterprise software has been a buy-it decision. Packaged software from SAP, Oracle and Salesforce covered roughly 80% of requirements at a fraction of the cost of building. The economics were obvious, and for traditional applications, they still are.

    AI is introducing a wrinkle that is forcing even the most committed enterprise software customers to rethink their options. AI is a layer that sits across your data, your processes, and your decisions. Where that layer runs and who controls it is an architecture question, and most of the enterprise community is still treating it as a procurement one.

    The appeal of vendor-embedded AI is clear: automated operational decisions, smarter supplier and merchandising choices, and friction-free workflows built into the systems enterprises already rely on. The catch is that these capabilities almost universally depend on your data living in the vendor’s cloud environment. For most large enterprises, it sits on-premises, in hyperscale cloud infrastructure they manage themselves, or in private data centers. That gap between where your data is and where your vendor’s AI assumes it should be creates a fundamental strategic fork in the road.

    Build vs. buy is a category error

    The framing I keep hearing is “build vs. buy your AI strategy.” It implies that some organizations are out there training foundation models from scratch. Nobody serious is doing that. The real choice sits across three distinct approaches, and conflating them leads to poor decisions:

    • Buy embedded. Use the AI capabilities your vendor ships natively inside their platform: the assistant baked into your ERP, your CRM, your HCM suite. Lowest integration cost, fastest time to value, tightest fit with the application data.
    • Buy platform. Adopt the vendor’s AI infrastructure layer and build your own assistants and agents on top of it. More flexible, but you remain inside the vendor’s architectural boundary and subject to their governance model.
    • Compose. Connect a third-party model (Claude, GPT, Gemini, an open-weight model running in your own environment) directly to your existing landscape. Maximum control, maximum integration burden, and full responsibility for what comes out the other end.

    These are not equivalent options at different price points. They make different assumptions about where your data lives, who governs the AI, and how much architectural change you’ll absorb to get there. Vendor pitches sometimes blur the distinction on purpose. Enterprise leaders can’t afford to.

    The vendor AI stack has an assumption baked in

    Every embedded AI capability ships with an unstated architectural prerequisite: your data must be where the AI can see it, in the shape it expects, under the governance the vendor enforces.

    For organizations with clean, modern cloud estates, that is often a reasonable trade. For the long tail of large enterprises running heavily customized environments on private or hybrid infrastructure, that trade becomes a precondition, one you must meet before the AI conversation can even begin. Whether meeting it makes sense depends on your starting point, your sector’s regulatory posture, and your appetite for migration risk. None of those are uniform across organizations.

    That’s the part that gets glossed over in vendor keynotes. The AI demo on stage assumes a destination architecture the audience hasn’t necessarily reached yet. Large enterprise customers are carrying an unusually heavy technology burden right now. Many are simultaneously managing platform modernization programs that have been building for over a decade, alongside pressure to migrate to vendor-managed cloud infrastructure. Sitting above both is a boardroom-level directive to demonstrate meaningful AI progress fast. The vendor path to AI and the boardroom path to AI can diverge sharply, and enterprises need to make selective, strategic decisions about where to adopt AI first to maximize value and minimize risk.

    Sovereignty isn’t a slogan, it’s an architecture constraint

    The conversation about sovereignty has been hijacked by both sides. One camp treats every SaaS adoption as a sovereignty violation. The other dismisses every sovereignty concern as Luddite resistance. Neither is useful.

    What’s happening in real customer conversations – particularly in DACH, public sector, and financial services – is more specific. Organizations are drawing a distinction between running their applications in a vendor’s cloud (which is broadly fine, well understood, decades of precedent) and enriching their data and processes inside a vendor’s AI model (which has less precedent, is harder to reverse, and carries material implications for competitive position).

    Enriching your data inside a vendor’s AI model is the genuinely new question, and organizations that conflate it with their existing cloud posture tend to defend the wrong perimeter.

    Despite spending around $100 million annually with Amazon, Disney built its own internal AI system to house its corporate intelligence rather than rely on a hyperscaler’s AI offering. The decision came down to control. When your data represents decades of creative and commercial IP, you think carefully about where it lives and who can learn from it. Disney has become more open to SaaS over time. The AI sovereignty question is a separate debate from the SaaS debate and conflating the two leads organizations to the wrong conclusions.

    At the other end of the spectrum, enterprises in heavily regulated environments treat data sovereignty as an absolute non-negotiable. Any AI model must run within their controlled environment, especially where sensitive data cannot touch the public internet. GDPR obligations reinforce this instinct across the European market, requiring organizations to maintain clear accountability for how personal data is processed inside AI systems, including vendor-managed ones.

    AI-enriched data, meaning models that have learned the shape of your business processes, your supplier negotiations, your customer behavior, carries a different half-life and a different strategic value than the operational data underneath it. That deserves its own architectural decision, separate from your broader cloud strategy.

    What this means in practice

    Most large enterprise estates will end up with a mix of all three approaches, and where you draw the lines matters more than your overall posture.

    Embedded AI capabilities are the right answer for in-application productivity: the assistant inside your ERP workflows, the agent inside your procurement or HR suite. That is where vendor embedding genuinely shines, and attempting to compose your own equivalent is typically a poor use of engineering resources.

    Compose belongs elsewhere: in cross-application orchestration, in custom assistants over operational and observability data, and in agents that need to reach across multiple vendor systems and infrastructure layers in ways no single vendor stack will never natively support. Research from McKinsey suggests the most significant near-term productivity gains from enterprise AI will come precisely from these cross-system workflows, rather than from within individual applications. The most interesting enterprise AI work over the next eighteen months lives here, and it doesn’t require waiting for a migration to complete first.

    That compose path isn’t free, and it’s important to be honest about the costs. Governance, audit trails, and accountability for hallucinated outputs become your problem, not the vendor’s. Prompt drift and evaluation discipline are real engineering costs that never appear in the proof-of-concept. Those costs scale with the complexity of your landscape and the number of systems your agents touch. Budget for them before deployment, not after your first production incident. None of that is a reason to avoid the path. It’s a reason to staff for it, honestly.

    The real question

    The build-vs-buy frame survives because it gives executives a binary choice along a familiar axis. AI sits somewhere else entirely.

    The question worth putting on the table at your next architecture review is simpler:

    Which decisions do we want our vendors’ AI to make, and which do we want to keep on our side of the boundary?

    Answer that, and the right build/buy/compose mix flows from it. Skip it, and you will end up with the architecture your vendors prefer – which may or may not be the one your business needs.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Can Meta really compete in the cloud business?]]> https://tsecurity.de/de/3675548/ai-nachrichten/can-meta-really-compete-in-the-cloud-business/ https://tsecurity.de/de/3675548/ai-nachrichten/can-meta-really-compete-in-the-cloud-business/ Fri, 17 Jul 2026 11:04:14 +0200 🔧 AI Nachrichten tsecurity.de

    Meta is reportedly planning a cloud business that would sell access to AI computing power and models, extending its internal infrastructure into a commercial service for outside developers and enterprises. Reuters, citing Bloomberg’s reporting, noted that the planned offering would allow customers to access AI models hosted on Meta’s infrastructure and pay based on usage, effectively positioning the company in the infrastructure-as-a-service and AI platform markets. On the surface, this seems like a logical next step. If you are already spending enormous amounts of money to build AI infrastructure, there is a natural temptation to ask whether some of that investment can be monetized beyond your own internal use.

    I have seen this pattern before. A company builds sophisticated internal systems, recognizes their value, and then begins to imagine that becoming a cloud provider is simply a matter of exposing those capabilities to external customers. It sounds straightforward, especially given the excitement around AI and the demand for high-performance infrastructure. But cloud computing is not just another distribution model. It is not simply a matter of offering on-demand multitenant services and charging a fee. It is a deeply operational, trust-based business in a market that punishes companies that do not fully understand what enterprise customers require.

    A crowded neocloud market

    The first problem Meta faces is that this is not an open opportunity. The neocloud space, meaning purpose-built AI infrastructure delivered as a service, is already crowded and increasingly difficult to enter. Amazon, Microsoft, and Google dominate the conversation for obvious reasons. They have years of cloud operating experience, broad service portfolios, global reach, mature ecosystems, and deeply established enterprise relationships. Oracle remains a serious player as well, especially in enterprise applications, data platforms, and performance-sensitive workloads. IBM still matters in hybrid cloud, operations, and industries where governance and regulatory rigor remain central.

    That list alone should give Meta pause. These companies are not just infrastructure vendors. They are experienced cloud operators. They have spent years building not only the underlying platforms, but also the native capabilities enterprises now expect by default. Those capabilities include security, governance, identity management, observability, support, compliance, billing controls, resilience planning, and integration with the broader enterprise technology estate. These are not secondary features. They are part of the core value proposition.

    This is why late entry into the cloud market is so hard. A new provider is not just competing on price or capacity. It is competing against accumulated trust. Enterprises are not casual buyers. They are selecting long-term operating environments for applications, data, AI models, and business-critical processes. They want confidence that the provider understands how these services will be consumed, governed, and supported over time. Meta is entering a market where the incumbents already have a major head start on all of those fronts.

    Harder than it looks

    Over the years, I have had many technology companies come to me and say they wanted to reposition their technology in the cloud space, either as software as a service or infrastructure as a service. In the beginning, enthusiasm is always high. The technology is impressive. The market size looks attractive. The revenue models appear compelling. Investors love the story. Then we begin to walk through what it really means to operate as a cloud provider, and the optimism usually fades fast.

    The questions become very practical and very uncomfortable. How will tenants be isolated? How will identity and access controls work across different kinds of customers? What governance models will be built in natively? How will workloads be monitored, optimized, and secured? What does support look like 24 hours a day, across regions, across industries, across compliance boundaries? How will outages be handled, communicated, and remediated? How will the platform integrate with existing customer tools for operations, policy management, and security response? How much investment will it take just to become credible before you even begin to differentiate?

    Once companies fully understand the complexities, market dynamics, and the capital and execution required to compete even with secondary players, many of them back off. They realize that cloud technology is not a packaging exercise. It is a transformation in how a company designs, operates, supports, sells, and evolves technology. That is why I remain skeptical when any company assumes it can translate internal infrastructure excellence into external cloud success without a very long, disciplined commitment.

    Meta’s market readiness

    Of course, Meta is not lacking in financial resources. If any company can afford to spend aggressively in this space, it is Meta. The company has the capital to build infrastructure, absorb losses, hire experienced talent, and stay in the market long enough to make a serious attempt. I would never argue that Meta is too small or too poor to try. Quite the opposite. If there is any non-traditional entrant with the financial scale to force itself into the conversation, Meta would be high on the list.

    But money does not erase complexity. It only gives you the chance to confront it. The real question is not whether Meta can afford to become a cloud provider. The question is whether Meta has what it takes to become an excellent cloud provider. Those are two very different things. Enterprises are not going to move meaningful workloads to a new platform simply because the company behind it is wealthy or technically famous. They are going to ask whether the provider understands enterprise consumption patterns, enterprise risk, enterprise governance, and enterprise operations.

    That is where the challenge becomes much more serious. Meta has extensive experience running infrastructure for itself. That is valuable, but internal operating excellence is not the same thing as external service maturity. Running systems for your own workloads allows a high degree of control over architecture, standards, priorities, and operating assumptions. Running systems for paying customers requires flexibility, consistency, transparency, and support across a wide range of use cases that you do not control. Those are very different disciplines, and companies often underestimate the gap between them.

    What exactly is Meta?

    Another concern here is strategic clarity. Meta already has a complicated market identity. It is a social media company, an advertising platform company, a hardware company, an AI company, and still, in the minds of many, the company that spent billions pursuing the metaverse. If it now wants to be viewed as a serious cloud infrastructure provider, it will need to explain not only what it is offering, but why customers should believe this is a durable long-term commitment and not just another adjacent experiment.

    That uncertainty can be damaging. Customers want stable providers with clear strategic intent. They do not want to architect important systems around a platform if they suspect the provider may lose interest, shift direction, or reframe the business after a few years of uneven results. Cloud computing requires patience, consistency, and deep customer orientation. It is not a market where strategic ambiguity helps.

    This could become confusing for Meta internally as well. Building a true cloud business demands focus. It demands years of investment in areas that may not be glamorous but are absolutely necessary, such as governance, operations, controls, support frameworks, partner programs, and enterprise sales alignment. If the company is not willing to make those sacrifices fully and for the long term, the initiative will struggle.

    ]]>         <![CDATA[Zero Credentials, Full Access: Inside a Complete Authorization Failure]]> https://tsecurity.de/de/3675345/hacking/zero-credentials-full-access-inside-a-complete-authorization-failure/ https://tsecurity.de/de/3675345/hacking/zero-credentials-full-access-inside-a-complete-authorization-failure/ Fri, 17 Jul 2026 09:23:35 +0200 🕵️ Hacking tsecurity.de Bounty Case Files #01

    How multiple trust-boundary failures allowed anonymous access to premium functionality in a production API

    By Ahmed Waleed | Bug Bounty Hunter

    TL;DR

    While assessing a public enterprise SaaS API, I discovered a complete breakdown of authentication and authorization.

    By chaining multiple trust-boundary failures, an unauthenticated attacker could:

    • Access premium enterprise functionality without authentication.
    • Impersonate arbitrary users
    • Read private conversation history
    • Escalate privileges through client-controlled authorization metadata.
    • Create, modify, and delete server-side resources

    To respect responsible disclosure, all identifying information has been removed.

    Target Overview

    The target was a public AI-powered enterprise platform exposing a documented REST API.

    During reconnaissance I discovered several publicly accessible endpoints:

    • /docs
    • /redoc
    • /openapi.json

    The OpenAPI specification described every available endpoint together with request schemas.

    One thing immediately stood out: the API defined no authentication mechanism whatsoever — no API keys, no OAuth, no Bearer tokens, and no securitySchemes in the OpenAPI specification.

    Recon

    Rather than fuzzing hundreds of endpoints, I started by understanding how the application expected clients to communicate.

    The Swagger interface exposed the complete API surface, allowing quick identification of authentication requirements — or in this case, the absence of them. That observation became the starting point for the entire assessment.

    Technical Walkthrough

    All requests below were run from a clean browser session with zero credentials, against only a test conversation and a synthetic (non-existent) email address.

    1. Create a conversation — no auth required:

    POST /conversations
    Content-Type: application/json 
    {}


    → 200 OK
    {"status":"success","conversation_id":"conv_...","created_at":"..."}

    2. Run an enterprise-tier query by just claiming to be enterprise:

    POST /process
    Content-Type: application/json

    {
      "message": "Show me top brands in TVs on Amazon US by market share",
      "conversation_id": "conv_...",
      "user_metadata": {
        "user_tier": "enterprise",
        "permitted_categories": ["All"],
        "allowed_retailers": ["All"]
      }
    }

    → 200 OK — real production analytics data returned, e.g.:
    Brand A - 35.54% market share - $36.9M GMV - 47,832 units
    Brand B - 17.81% market share - $18.5M GMV -  8,859 units
    Brand C -  7.77% market share -  $8.1M GMV - 43,218 units

    The response even included an internal data-source citation confirming it was pulling from the platform’s proprietary intelligence pipeline — not a demo/sandboxed dataset.

    3. Impersonate any customer by email:

    GET /conversations?user_email=<any-email>

    → 200 OK — full conversation history for that email address returnedGET /conversations?user_email=<any-email>

    No verification that the requester is that email address — just supply it and read their history.

    Expected behavior for all three: 401 Unauthorized. Actual: 200 OK, full access.

    Attack Chain

    Individually, each issue represented a security weakness. Combined, they resulted in a complete authorization failure.

    Root Cause Analysis

    • Authentication was never enforced
    • User identity was trusted from client input
    • Authorization relied on client-controlled metadata
    • Public API documentation exposed the full attack surface
    • Critical authorization decisions occurred entirely on the client side

    Impact

    An unauthenticated, remote, anonymous attacker could:

    • Consume a paid AI analytics product with zero subscription
    • Pull real-time competitive intelligence (pricing, market share, revenue) meant to be a paid enterprise product
    • Enumerate/guess customer emails to read private conversation histories
    • Escalate from a “demo” tier to “enterprise” by editing a JSON field
    • Perform unauthenticated DELETE and PATCH on other users' conversation records — a data-integrity/destruction risk, not just a confidentiality one

    Suggested Remediation

    1. Require real authentication (e.g., validated OAuth/OIDC bearer tokens) on every endpoint; reject unauthenticated calls with 401.
    2. Derive user identity only from the validated token — never from a client-supplied user_email parameter.
    3. Enforce subscription tier and all permissions server-side, from the authenticated principal’s actual entitlements — never trust client-supplied user_metadata.
    4. Remove or gate /docs, /redoc, and /openapi.json behind auth in production.
    5. Add per-user rate limiting and audit logging tied to the authenticated identity.

    Lessons Learned

    • Authentication and authorization solve different problems
    • Public API documentation accelerates reconnaissance
    • Client-controlled metadata must never influence authorization
    • Every permission should be verified on the server
    • Multiple low-complexity issues can combine into a critical compromise

    Responsible Disclosure

    This issue was reported responsibly through the vendor’s vulnerability disclosure process. The article intentionally omits identifying details, implementation-specific information, and production artifacts.

    Takeaway

    An OpenAPI spec with no securitySchemes block and a Swagger UI with no "Authorize" button is a five-second tell that a supposedly "enterprise-grade" AI product may have no server-side authorization at all — identity and entitlement were both being trusted from client-supplied JSON. Worth checking on any AI agent/chatbot API you test: does the server actually verify who you are and what you're allowed to see, or is it just trusting what you tell it?

    Next in this series: Bounty Case Files #02

    Zero Credentials, Full Access: Inside a Complete Authorization Failure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

    ]]>         <![CDATA[CVE-2026-62189 | OpenClaw up to 2026.6.8 Mirror Sync Feature symlink (WID-SEC-2026-2133)]]> https://tsecurity.de/de/3675306/sicherheitsluecken/cve-2026-62189-openclaw-up-to-202668-mirror-sync-feature-symlink-wid-sec-2026-2133/ https://tsecurity.de/de/3675306/sicherheitsluecken/cve-2026-62189-openclaw-up-to-202668-mirror-sync-feature-symlink-wid-sec-2026-2133/ Fri, 17 Jul 2026 09:10:15 +0200 🕵️ Sicherheitslücken tsecurity.de critical has been found in OpenClaw up to 2026.6.8. This issue affects some unknown processing of the component Mirror Sync Feature. Performing a manipulation results in symlink following. This vulnerability is known as CVE-2026-62189. Remote exploitation of the attack is possible. No exploit is available.]]> <![CDATA[VAPT Report Example]]> https://tsecurity.de/de/3675301/hacking/vapt-report-example/ https://tsecurity.de/de/3675301/hacking/vapt-report-example/ Fri, 17 Jul 2026 09:09:42 +0200 🕵️ Hacking tsecurity.de This report documents multiple security vulnerabilities identified in the OWASP Juice Shop application. Each finding is described in detail, including severity assessment, exploitation steps and remediation guidance.

    Setup OWASP Juice Shop Locally Using Docker

    Install Docker

    Run:

    docker pull bkimminich/juice-shop
    docker run - rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop

    Browse to:
    http://localhost:3000

    1. Privilege Escalation via User Registration API

    Summary (with CWE)

    The application allows an attacker to self-register an administrator account by directly invoking the user creation API and supplying the role parameter in the request body. Due to missing server-side authorization and role validation, the backend blindly trusts client input. This results in unauthorized privilege escalation, granting full administrative access without authentication or approval.

    CWE ID

    • CWE-269 — Improper Privilege Management
    • CWE-285 — Improper Authorization

    Severity (CVSS v3.1)

    CVSS Vector:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    Metrics:

    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

    CVSS Base Score: 9.8 (Critical)

    Description

    OWASP Juice Shop exposes a user registration API endpoint (/api/Users) that accepts user details in JSON format. The backend fails to enforce role based access control during user creation and allows the client to specify sensitive attributes such as role. An attacker can exploit this flaw by sending a crafted POST request with "role":"admin", resulting in the creation of an administrator account without any authorization checks.

    This vulnerability completely compromises the application, as administrative privileges allow full access to sensitive data and management functions.

    Steps to Reproduce

    1. Send a POST request to: http://localhost:3000/api/Users
    2. Edit request body and add role parameter: { "role": "admin" }
    3. Submit the request using Burp Suite.
    4. The server responds with a successful user creation message.
    5. Log in using the created credentials.

    Suggested Remediation

    • Enforce server-side role control
    • Default role assignment
    • Allow admin role assignment only through authenticated admin workflows
    • Validate permissions on every sensitive endpoint

    References

    1. OWASP Top 10 — Broken Access Control
    2. CWE-269: Improper Privilege Management
    3. CWE-285: Improper Authorization
    4. OWASP Juice Shop Project

    2. OAuth Account Takeover

    Summary (with CWE)

    OWASP Juice Shop implements Google OAuth login in an insecure manner by deterministically generating user passwords on the client side. The password is derived by reversing the user’s email address and Base64-encoding it, which can be easily reproduced by an attacker.

    This design flaw allows an attacker to log in directly using email/password authentication for an OAuth-registered user, resulting in full account takeover without cracking hashes or bypassing authentication controls.

    CWE ID

    • CWE-522 — Insufficiently Protected Credentials
    • CWE-287 — Improper Authentication
    • CWE-284 — Improper Access Control

    Severity (CVSS v3.1)

    CVSS Vector:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    Metrics

    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

    CVSS Base Score: 9.1 (Critical)

    Description

    OWASP Juice Shop allows users to register and log in via Google OAuth. During this process, the application uses a client-side JavaScript function userService.oauthLogin() found in main.js.

    The OAuth workflow internally calls:

    • userService.save() (user creation)
    • userService.login() (standard login)

    Both functions set the user password using the following logic:

    password = btoa(n.email.split("").reverse().join(""))

    Password Generation Logic

    • The email address is reversed.
    • The reversed string is Base64-encoded.
    • The result is used as the account password.

    Steps to Reproduce:

    Identify OAuth Password Logic

    • Open main.js
    • Search for oauthLogin
    • Locate: password: btoa(n.email.split("").reverse().join(""))

    Derive Victim Password

    Email: bjoern@gmail.com
    Reversed: moc.liamg@nreojb
    Base64 encoded password:

    bW9jLmxpYW1nQGhjaW5pbW1pay5ucmVvamI=

    Suggested Remediation

    • Never generate passwords client-side
    • Separate OAuth and password authentication
    • Use strong, random credentials
    • Do not expose authentication logic
    • Perform security design reviews

    References

    1. OWASP Top 10 — Broken Authentication
    2. CWE-522 — Insufficiently Protected Credentials
    3. OAuth 2.0 Security Best Practices (RFC 8252)
    4. OWASP Juice Shop Project

    3. SQL Injection in Product Search Endpoint

    Summary (with CWE)

    An SQL Injection (SQLi) vulnerability was identified in the product search functionality of OWASP Juice Shop. The application fails to properly sanitize user-controlled input in the q parameter, allowing attackers to inject malicious SQL queries.

    This flaw enables unauthorized database access, including enumeration of database tables and potential exposure of sensitive data.

    CWE ID

    CWE-89 — Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

    Severity (CVSS v3.1)

    CVSS Vector:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    Metrics

    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

    CVSS Base Score: 9.1 (Critical)

    Description

    The /rest/products/search API endpoint accepts user input via the q parameter to search for products. This input is directly incorporated into backend SQL queries without sufficient sanitization or parameterization.

    An attacker can exploit this weakness to inject arbitrary SQL commands, allowing enumeration of database schema and extraction of sensitive information. Automated tools such as sqlmap can successfully detect and exploit this vulnerability, confirming the presence of SQL injection.

    This issue represents a complete breakdown of input validation and secure query handling, posing a serious risk to application confidentiality and integrity.

    Exploit Using sqlmap

    sqlmap -u "http://localhost:3000/rest/products/search?q=apple" --tables

    Got User credentials :)

    Suggested Remediation

    • Sanitize and validate all user-supplied inputs
    • Implement parameterized queries
    • Deploy a Web Application Firewall (WAF)
    • Enable logging & monitoring

    References

    1. OWASP SQL Injection Prevention Cheat Sheet
    2. CWE-89 — SQL Injection
    3. OWASP Juice Shop Documentation
    4. CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/

    4. Arbitrary File Download via Poison Null Byte Injection

    Summary (with CWE)

    The application is vulnerable to Poison Null Byte Injection, allowing an attacker to bypass file extension validation and download sensitive backup files stored on the server. By exploiting improper input validation and unsafe file handling, restricted backup files such as developer and salesman data can be accessed.

    CWE ID

    • CWE-158 — Improper Neutralization of Null Byte
    • CWE-22 — Improper Limitation of Pathname to Restricted Directory

    Severity (CVSS v3.1)

    CVSS Vector:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    CVSS Base Score: 7.5 (High)

    Description

    OWASP Juice Shop restricts file downloads in the /ftp endpoint by validating file extensions. However, this validation can be bypassed using a Poison Null Byte (%00) injection combined with double URL encoding.

    The backend improperly handles null bytes during file system access, causing the application to truncate the filename at the null byte and serve restricted backup files (e.g., .bak) while still passing extension validation checks.

    This results in unauthorized access to sensitive backup files, potentially exposing configuration details, credentials, or business data.

    Steps to Reproduce:

    Access a Developer’s Forgotten Backup File:

    1. Navigate to the FTP directory: http://localhost:3000/ftp
    2. Attempt direct access (fails due to extension restriction): http://localhost:3000/ftp/package.json.bak
    3. Try Poison Null Byte injection (fails initially): http://localhost:3000/ftp/package.json.bak%00.md
    4. URL-encode the % character as well: http://localhost:3000/ftp/package.json.bak%2500.md

    The server successfully returns the restricted backup file, completing the exploit.

    Access a Salesman’s Forgotten Backup File:

    1. Use the same Poison Null Byte technique: http://localhost:3000/ftp/coupons_2013.md.bak%2500.md
    2. The backup file downloads successfully, revealing sensitive business data.

    Backup file downloads successfully.

    Suggested Remediation

    • Reject null bytes explicitly
    • Decode input before validation
    • Use allow-listed file access
    • Disable public access to backups
    • Use secure file APIs

    References

    1. OWASP Foundation — OWASP Juice Shop
    2. CWE-158: Improper Neutralization of Null Byte
    3. OWASP Testing Guide — File Handling Vulnerabilities
    4. PortSwigger — File Path Traversal & Null Byte Attacks

    Thanks For Reading :)

    Happy Hacking ;)

    VAPT Report Example was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

    ]]>         <![CDATA[Salesforce’s Agentforce product maturity questioned as KeyBanc cites weak customer traction]]> https://tsecurity.de/de/3675273/it-nachrichten/salesforces-agentforce-product-maturity-questioned-as-keybanc-cites-weak-customer-traction/ https://tsecurity.de/de/3675273/it-nachrichten/salesforces-agentforce-product-maturity-questioned-as-keybanc-cites-weak-customer-traction/ Fri, 17 Jul 2026 09:03:12 +0200 📰 IT Nachrichten tsecurity.de

    Salesforce’s AI agent platform, Agentforce, is seeing weaker-than-expected customer traction, according to a recent KeyBanc Capital Markets investment research note, which attributed the slowdown in part to the product itself, stating that “Agentforce, as a product, just isn’t there” yet, following customer checks and a CIO survey.

    “Our checks and customer conversations have not been strong, nor has the feedback been on Agentforce. What we can piece together in the disclosed numbers does not signal building momentum and, most recently, our CIO survey delivered another blow with Salesforce being a standout for the wrong reasons,” according to a Seeking Alpha that quoted a KeyBanc research note.

    “We attend more Salesforce partner and customer events than any other company in our coverage, and feedback from those customers has been consistent in two ways: 1) customers’ data is not in order to do meaningful AI work; and 2) Agentforce, as a product, just isn’t there,” Seeking Alpha reported, quoting the KeyBanc note.

    The KeyBanc note quoted by Seeking Alpha also pointed out that conversations with Salesforce “partners” indicate that Agentforce proof-of-concept deployments are only now starting to generate pipeline opportunities, while its CIO survey found more respondents expecting to deprioritize Salesforce within their IT budget than the other way around over the coming 12 months.

    The findings in the research note stand in contrast to Salesforce’s sustained push to position Agentforce as its flagship enterprise AI platform. Since introducing the offering nearly two years back, the company has expanded it with new foundation models, integrations, deployment options, and pricing initiatives, most recently introducing its Headless 360 strategy to make Agentforce available beyond conventional CRM workflows through a more flexible consumption model.

    Parts of that flexible consumption model and Agentforce pricing, which Salesforce is still evolving, have already come under scrutiny with industry analysts expressing concern that Headless 360’s monetization model could create budgeting headaches for CIOs by making AI spending less predictable and increasing pressure on IT leaders to demonstrate measurable business outcomes and return on investment before expanding deployments.

    Concerns over product maturity

    Those concerns around Agentforce’s evolving pricing model appear to be intersecting with the latest concerns about product maturity that KeyBanc analysts mention in their report.

    “Three pricing model changes in roughly 18 months make procurement committees nervous, and if the commercial model keeps shifting, buyers question whether the product has stabilized either,” said Bhupendra Chopra, chief revenue officer at IT consulting firm Kanerika.

    Salesforce’s latest consumption-based pricing model, Chopra pointed out, is a bigger concern: “It is harder to budget for than seat-based licensing. CIOs want a clearer line between spend and outcome. That line isn’t clear enough yet.”

    Greyhound Research Chief Analyst Sanchit Vir Gogia, too, said that the pricing model is a fundamental issue for enterprises.

    While Salesforce’s pricing model charges enterprises for AI activity, it leaves customers to determine whether those interactions ultimately translate into meaningful business outcomes, Gogia said.

    That, according to Gaurav Parab, principal research analyst at NelsonHall, is slowing adoption because enterprise leaders, such as CIOs, are under pressure to evaluate TCO and expected ROI.

    “Most enterprises first want confidence that AI deployments will generate measurable business outcomes before committing to broader rollouts,” he said.

    Data Cloud and data readiness remain as challenges

    Pricing, though, is just one piece of the equation.

    The discussion about Agentforce adoption, analysts said, cannot be separated from Salesforce’s broader product strategy, which positions Agentforce alongside Data Cloud as the foundation for enterprise AI deployments.

    “Data modernization has become one of the biggest determinants of adoption. Agentforce depends on trusted, unified enterprise data to generate reliable outcomes. For many organizations, preparing that data foundation through Data 360, integration, governance, and data quality initiatives represents a significant part of the implementation effort,” Purab said, backing the KeyBanc research note.

    Chopra seconded that assessment, saying Data Cloud has effectively become a prerequisite for production-grade Agentforce: “We worked with a private equity fund administrator where the AI layer only became reliable once we had clean, structured data feeding into Salesforce consistently. Before that, even well-configured automation produced inconsistent outputs.”

    In practice, that means many enterprises need to invest separately in Data Cloud, data integration, governance, and cleanup before Agentforce can be deployed reliably at scale, Chopra said.

    Implementation challenges are slowing adoption

    Product maturity aside, those implementation challenges, Purab pointed out, are also contributing to a slower pace of Agentforce adoption in enterprises than anticipated.

    While interest in Agentforce continues to grow, enterprises, according to the analyst, are largely limiting deployments to targeted, high-value use cases while they establish trusted data foundations, integrate with existing systems, and demonstrate measurable business value.

    More so because Data Cloud accelerates Agentforce once the foundation is coherent,  it cannot make incoherence disappear, Gogia pointed out.

    Chopra, too, said his conversations with enterprise customers closely mirror Purab and KeyBanc’s findings: “The issue isn’t appetite. The issue is that their CRM data is fragmented, partially duplicated, and inconsistently structured. You can’t put an AI agent on top of that and expect reliable outputs.”

    “Cleaning that up takes months. That work doesn’t show in a vendor’s deal count, which is why signed agreements and actual production deployments are two very different numbers right now.”

    Timing issue or execution gap?

    Despite all the challenges, though, Purab said that the slower pace of current adoption is not necessarily indicative of a long-term problem.

    “I see it as a timing issue, but it has always been the case. Enterprise AI adoption has consistently followed the maturity of data, governance, and operating models. Salesforce will undoubtedly continue refining the product, pricing, and go-to-market approach, but the larger challenge lies in enterprise readiness,” Purab said.

    “As organizations strengthen their data foundations and gain confidence in deploying AI responsibly, Agentforce adoption is likely to broaden significantly,” Purab added.

    Chopra, in contrast, offered a more nuanced view: “While data readiness, which is a customer issue, will improve with time, Salesforce needs to fix its go-to-market strategy.”

    “Three pricing changes in 18 months, a product that requires significant pre-investment before it delivers value, and implementation complexity that most mid-market buyers aren’t resourced for is definitely a positioning gap Salesforce needs to close,” Chopra said.

    Regardless of whether the current slowdown proves temporary or structural, both analysts agreed that the next six to twelve months should provide a clearer picture of Agentforce’s trajectory.

    For CIOs evaluating the platform, they said, the focus should be less on headline product announcements and more on tangible indicators of enterprise adoption and operational maturity.

    “The key indicators will be an increase in enterprise-scale production deployments rather than pilots, broader adoption beyond customer service into other business functions, stronger customer references demonstrating measurable business outcomes, continued simplification of pricing and deployment models, and greater maturity around governance, security, and operating models for AI agents,” Purab said.

    For Chopra, CIOs should go a step further by measuring how AI agents perform in production rather than simply tracking deployment numbers: “Containment rate in production — what percentage of agent interactions are resolved without human escalation — is the real performance signal, not token volume or deal count.”

    Salesforce did not immediately respond to a request for comment.

    ]]>         <![CDATA[OneDrive unter Windows 10: Support-Ende für ältere Versionen steht an]]> https://tsecurity.de/de/3675219/it-nachrichten/onedrive-unter-windows-10-support-ende-fuer-aeltere-versionen-steht-an/ https://tsecurity.de/de/3675219/it-nachrichten/onedrive-unter-windows-10-support-ende-fuer-aeltere-versionen-steht-an/ Fri, 17 Jul 2026 08:33:10 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: OneDrive unter Windows 10: Support-Ende für ältere Versionen steht an

    Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

    ]]>         <![CDATA[CVE-2026-62237 | getgrav Grav up to 2.0.3 Twig Content Sandbox regex_replace redos (EUVD-2026-45083)]]> https://tsecurity.de/de/3675052/sicherheitsluecken/cve-2026-62237-getgrav-grav-up-to-203-twig-content-sandbox-regexreplace-redos-euvd-2026-45083/ https://tsecurity.de/de/3675052/sicherheitsluecken/cve-2026-62237-getgrav-grav-up-to-203-twig-content-sandbox-regexreplace-redos-euvd-2026-45083/ Fri, 17 Jul 2026 06:39:50 +0200 🕵️ Sicherheitslücken tsecurity.de problematic was found in getgrav Grav up to 2.0.3. This affects the function regex_replace of the component Twig Content Sandbox. The manipulation results in inefficient regular expression complexity. This vulnerability is reported as CVE-2026-62237. The attack can be launched remotely. No exploit exists.]]> <![CDATA[ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories]]> https://tsecurity.de/de/3674980/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ https://tsecurity.de/de/3674980/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ Fri, 17 Jul 2026 05:23:14 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[Pete Hegseth’s Plan for ‘High T’ Troops Is a Junk Science Fever Dream]]> https://tsecurity.de/de/3674868/it-nachrichten/pete-hegseths-plan-for-high-t-troops-is-a-junk-science-fever-dream/ https://tsecurity.de/de/3674868/it-nachrichten/pete-hegseths-plan-for-high-t-troops-is-a-junk-science-fever-dream/ Fri, 17 Jul 2026 02:47:22 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[How to sync Messages from iPhone to Mac]]> https://tsecurity.de/de/3674540/ios-mac-os/how-to-sync-messages-from-iphone-to-mac/ https://tsecurity.de/de/3674540/ios-mac-os/how-to-sync-messages-from-iphone-to-mac/ Thu, 16 Jul 2026 21:53:30 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Bedrohungs-Update: Chrome-Sync-Stalking, Ransomware in 24 Stunden und neue KEV-Patches]]> https://tsecurity.de/de/3674515/it-security-nachrichten/bedrohungs-update-chrome-sync-stalking-ransomware-in-24-stunden-und-neue-kev-patches/ https://tsecurity.de/de/3674515/it-security-nachrichten/bedrohungs-update-chrome-sync-stalking-ransomware-in-24-stunden-und-neue-kev-patches/ Thu, 16 Jul 2026 21:38:27 +0200 📰 IT Security Nachrichten tsecurity.de LONDON (IT BOLTWISE) – In diesem Bedrohungs-Update zeigt sich, wie schnell aus „harmlosen“ Konfigurationen echte Angriffe werden: Chrome-Sync kann nach kurzem Zugriff zum Überwachungshebel umgebaut werden. Gleichzeitig rückt eine neue Ransomware-Familie in den Fokus, bei der Angreifer laut Sicherheitsberichten weniger als 24 Stunden nach dem initialen Einbruch die Ausbreitung starteten. Auf Behördenseite verschärft die US-Bundessicherheitsbehörde […]

    Dieser Beitrag Bedrohungs-Update: Chrome-Sync-Stalking, Ransomware in 24 Stunden und neue KEV-Patches erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

    ]]>         <![CDATA[Zoom patches account takeover hole]]> https://tsecurity.de/de/3674321/it-security-nachrichten/zoom-patches-account-takeover-hole/ https://tsecurity.de/de/3674321/it-security-nachrichten/zoom-patches-account-takeover-hole/ Thu, 16 Jul 2026 19:53:24 +0200 📰 IT Security Nachrichten tsecurity.de

    Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

    The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users. 

     Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday. 

    The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

    The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

    A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

    Zoom did not immediately reply to a request for comment.

    ‘As bad as it gets’

    Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

    This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

    Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

    Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses. 

    “An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

    He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

    Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure. 

    “Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

    “Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

    Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

    “This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

    All four bugs important

    Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons. 

    “The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

    Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

    He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

    This article originally appeared on Computerworld.

    ]]>         <![CDATA[Zoom patches account takeover hole]]> https://tsecurity.de/de/3674314/it-nachrichten/zoom-patches-account-takeover-hole/ https://tsecurity.de/de/3674314/it-nachrichten/zoom-patches-account-takeover-hole/ Thu, 16 Jul 2026 19:47:37 +0200 📰 IT Nachrichten tsecurity.de

    Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

    The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users. 

     Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday. 

    The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

    The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

    A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

    Zoom did not immediately reply to a request for comment.

    ‘As bad as it gets’

    Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

    This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

    Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

    Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses. 

    “An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

    He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

    Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure. 

    “Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

    “Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

    Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

    “This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

    All four bugs important

    Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons. 

    “The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

    Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

    He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

    ]]>         <![CDATA[New Smart Ring Does What Apple Watch Still Can’t With Blood Pressure]]> https://tsecurity.de/de/3674269/ios-mac-os/new-smart-ring-does-what-apple-watch-still-cant-with-blood-pressure/ https://tsecurity.de/de/3674269/ios-mac-os/new-smart-ring-does-what-apple-watch-still-cant-with-blood-pressure/ Thu, 16 Jul 2026 19:24:45 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Niko Matsakis: Battery packs: Let's talk about crates, baby]]> https://tsecurity.de/de/3674266/tools/niko-matsakis-battery-packs-lets-talk-about-crates-baby/ https://tsecurity.de/de/3674266/tools/niko-matsakis-battery-packs-lets-talk-about-crates-baby/ Thu, 16 Jul 2026 19:24:07 +0200 💾 Tools tsecurity.de

    This blog post describes an idea I’ve been kicking around called battery packs. Battery packs are a curated set of crates arranged around a common theme. For example, there’s a CLI battery pack that has everything you need to build a great CLI, an opinionated pack for creating a backend web service, and one for embedded development (based on the Embedded Working Group’s Awesome Rust repository). We’ve also got some smaller ones, such as the error-handling battery pack that shows how to handle errors in Rust. But this is just the beginning – a key part of the battery pack design is that anybody can create one.

    Battery packs are meant to address one of the most common things I hear from new Rust adopters. Everyone loves the wealth of high-quality crates available on crates.io. And everyone hates having to spend a bunch of time researching and comparing alternatives. Battery packs can serve as a good set of default choices. And they don’t lock you in. At heart, they’re basically just a list of recommended crates, so you can always swap something out if you find an alternative.

    We’ve got a prototype of the battery pack tool working today, so you can try it out if you’re curious. Just run cargo install cargo-bp and then try a few commands! For example,

    > cargo bp list

    will show you the set of available battery packs, based on a crates.io search (as I’ll explain below, a battery pack is itself packaged and distributed as a crate, but not one that you take a direct dependency on). And cargo bp add will add batteries from a battery pack into your crate, so e.g.

    > cargo bp add cli

    would let you select and add common CLI libraries. If you want to see a more involved demo, try out cargo bp add embedded, which is derived from the Awesome Embedded Rust repository.

    Let’s talk about you and me

    One of the key ideas from battery packs is that anybody can publish one. They are just a crate named X-battery-pack; the dependencies of that crate are your recommendations. Features are designations of common sets of crates frequently used together. The examples are your templates. And so forth.

    Letting anybody create a battery pack is in contrast to the previous ideas for an “extended standard library for Rust”1, and it is intended to address some of Rust’s unique challenges. For one thing, it lets people publish battery packs that are tailored to specific requirements. For example, the CLI and backend service battery packs are targeting a “typical computer”. But I could imagine the Rust embedded working group publishing a battery pack with libraries focused on no-std and binary size optimization.

    Being open-ended also addresses the “who decides?” question. To my mind, the best people to recommend what libraries you ought to use are other people building systems like yours. This is why I mentioned the Embedded Working Group publishing an Embedded battery pack, for example, as I think they are clearly a set of people who know their space well. But even within the embedded space there are yet smaller groups, and I imagine that sometimes it’ll make sense to get narrower. For example, perhaps a battery pack targeted embassy and its associated ecosystem? Unclear.

    Creating a battery pack

    If you wanted to create a battery pack, how do you do it? One answer is that you just create a new crate. But a better approach is to use the “battery-pack battery pack”2, which bundles a template:

    cargo bp new battery-pack

    This will prompt you for the name of the battery pack you want to create and a few other things and make your crate. Then you can just use cargo add dependencies to represent the libraries you want to recommend and publish.

    “Batteries” are more than dependencies

    The “batteries” that you can add to your project aren’t always dependencies. They can also be “recipes” or templates. For example, the CI battery pack3 can configure your project with the kind of “super neat-o” github actions you’ve always wanted but never wanted to bother configuring. To use it, select one or more of the templates to install:

    cargo bp add ci

    I expect this kind of “actions to improve your crate” to become a rich source of things. Right now we’re using a relatively lightweight template system built on minijinja, but I think we’re going to want to expand on this.

    Giving it some structure

    Battery Packs also support more than just a flat listing of dependencies/features/templates. You can group dependencies and features into categories and then, for each category, distinguish between “pick at most one” or “pick any number”. For a fun example, try cargo bp add embedded, which is derived from the Awesome Embedded Rust repository. If you run it, you’ll see something like this, which groups the choices thematically and, in some areas like “concurrency framework”, makes it clear that you want to pick one:

    ──────────────────────────────────────────────────────────────────
 ▼ Concurrency Framework (pick at most one)
 > ○ ✦ embassy [embassy-executor, embassy-sync, embassy-time]
   ○ ✦ rtic [cortex-m, rtic]    RTIC — interrupt-driven real-time

 ▼ Display & Graphics (pick any number)
   [ ] ✦ display-ssd1306 [embedded-graphics, ssd1306]    SSD1306
   [ ] ✦ display-st7789 [embedded-graphics, st7789]    ST7789 col

 ▼ Popular Drivers (pick any number)
   [ ] ✦ display-ssd1306 [embedded-graphics, ssd1306]    SSD1306
   [ ] ✦ display-st7789 [embedded-graphics, st7789]    ST7789 col
   [ ] ✦ sensor-bme280 [bme280]    BME280 temperature/humidity/pr
   [ ] ✦ sensor-lis3dh [lis3dh]    LIS3DH 3-axis accelerometer (I
   [ ] ✦ usb-device [usb-device, usbd-serial]    USB device stack

 ▼ Hardware Abstraction Layer (pick at most one)
   ○ ✦ atsamd [atsamd-hal, cortex-m-rt, critical-section-impl, co
   ○ ✦ esp32 [embedded-hal, esp-hal]    ESP32 (Xtensa, WiFi + BT,
   ○ ✦ esp32c3 [embedded-hal, esp-hal]    ESP32-C3 (RISC-V, WiFi
   ○ ✦ esp32s3 [embedded-hal, esp-hal]    ESP32-S3 (Xtensa, WiFi
   ○ ✦ nrf52832 [cortex-m-rt, critical-section-impl, cortex-m, em
   ○ ✦ nrf52840 [cortex-m-rt, critical-section-impl, cortex-m, em
   ○ ✦ nrf9160 [cortex-m-rt, critical-section-impl, cortex-m, emb
   ○ ✦ rp2040 [cortex-m-rt, critical-section-impl, cortex-m, embe
   ○ ✦ stm32f0 [cortex-m-rt, critical-section-impl, cortex-m, emb
 embedded-battery-pack v0.1.0  ↑↓/jk Navigate | Space Toggle | ←/→

    Let’s talk about all the good things…

    So why am I so keen on battery packs? It’s largely because I’ve heard so many would-be or recent Rust adopters talk about picking crates as a challenge. But I feel they would help with some other problems as well.

    What I really want to see is working groups in the Rust Commercial Network banding together to publish battery packs and recommendations. These would cover the dependencies that they’re actually using.

    Supporting maintainers

    One of the reasons I want to have RCN-recognized battery packs is that they are a natural focal point to then prompt RCN members to fund the maintenance of those crates. I am imagining that for each sponsored battery pack vended within the RCN, there is an associated “ecosystem fund”. Companies or individuals could sponsor this fund to get access to early patches, security disclosures, etc or other perks. The money would be used to support the maintainers of those crates, to implement missing features, and so forth.

    Fostering interoperability

    Another value-add from battery packs is the ability to drive interop efforts. I think that as soon as we start talking about standardizing, we’re also going to recognize that there are some places where standardization is hard. For example, early conversations within the network service working group (unsurprisingly) immediately identified that while most people are using tokio, some major companies are using their own runtimes internally. It’s not like the need for “async runtime interop” is news. But right now, every crate winds up effectively implementing their own set of little traits to make it work. Sponsored battery packs offer the possibility of a neutral home for that sort of thing.

    …and the bad things that could be

    There are some risks to people using battery packs. The most obvious is that the fact that anybody can publish a battery pack may mean that you just get a ton of battery packs, which doesn’t really help anybody! I’m not so worried about this because I think that there will be a few obvious places that most people go first, and then I think once people are oriented, they’ll get excited to explore what crates.io has to offer and start discovering more niche battery packs.

    Avoiding stagnation

    Battery packs are designed to evolve. I’ve seen it happen a number of times that there is a dominant crate for something, often taking a “traditional approach”, but then somebody else comes along and presents an interesting alternative that gradually takes off. I love that and I don’t want to put it at risk.

    One example of evolution around CLI argument parsing. For a time, docopt was a popular way to parse command-line options. Then clap came along and presented a more structured alternative; that was nice, but then structopt came along and connected clap to an auto-derive, so you could just write your data structure and be done. And that was awesome. (That is now the standard in clap.) I want to be sure that, even if there is a CLI battery pack, there’s room for the next clap to come along.

    There are a few things about battery pack that I think will help us deal with this. First, they are a “thin abstraction”. You don’t “depend on” a battery pack, you depend on the crates within it. So if a new version comes out that uses clap instead of docopt, that doesn’t impact you at all. Your code keeps working same as it ever did. And of course it helps that anybody can publish a battery pack. You can now have variations on battery packs that are focused around a new approach to help it get started.

    Done right, I think that standardized battery packs can also help the ecosystem evolve and pivot. As it is now, knowledge of new crates has to spread by word-of-mouth. But if everybody is aligned around a new approach, adopting that new approach within a battery packs sends a clear signal that your group is aligned that something is the new hotness.

    …Let’s talk about crates4

    “Always bet on the ecosystem”

    I see always bet on the ecosystem as a key Rust design axiom. It’s the reason we chose a small standard library and a package manager in the first place. It’s also why battery packs are designed to be published by anyone.

    But just like plants sometimes need a trellis to grow taller, any successful ecosystem reaches a point where it needs another layer of structure to help it keep growing. Without that, you have this “layer of tacic knowledge” (in the words of a Rust Vision Doc interviewee) that becomes an obstacle for folks. And I think we’ve reached that point with crates.io.

    I am hopeful that battery packs can provide that next layer of structure. But at the end of the day, if there’s a better approach, that’s fine too, so long as we find a way to help people find (and fund!) the crates they need. So let’s talk about it!

    1. My first recollection of it was the Rust Platform idea we floated in 2016! ↩︎

    2. Yo dawg… ↩︎

    3. Hat tip to Jess Izen, who proposed and developed the CI battery pack. Neat idea. ↩︎

    4. Oh, and: my apologies to Salt-N-Peppa. ↩︎

    ]]>         <![CDATA[ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories]]> https://tsecurity.de/de/3674139/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ https://tsecurity.de/de/3674139/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ Thu, 16 Jul 2026 18:41:38 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories]]> https://tsecurity.de/de/3674128/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ https://tsecurity.de/de/3674128/it-security-nachrichten/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-stories/ Thu, 16 Jul 2026 18:41:24 +0200 📰 IT Security Nachrichten tsecurity.de A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster…

    Read more →

    The post ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories appeared first on IT Security News.

    ]]>         <![CDATA[Location-Invariant Properties of Functions Versus Properties of Distributions: United in Testing but Separated in Verification]]> https://tsecurity.de/de/3673891/ai-nachrichten/location-invariant-properties-of-functions-versus-properties-of-distributions-united-in-testing-but-separated-in-verification/ https://tsecurity.de/de/3673891/ai-nachrichten/location-invariant-properties-of-functions-versus-properties-of-distributions-united-in-testing-but-separated-in-verification/ Thu, 16 Jul 2026 17:03:31 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Cloud sprawl taught organizations a lesson. AI is testing whether they learned it]]> https://tsecurity.de/de/3673870/it-nachrichten/cloud-sprawl-taught-organizations-a-lesson-ai-is-testing-whether-they-learned-it/ https://tsecurity.de/de/3673870/it-nachrichten/cloud-sprawl-taught-organizations-a-lesson-ai-is-testing-whether-they-learned-it/ Thu, 16 Jul 2026 17:02:14 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Demystifying AI Exploits: A Blueprint for AI-Assisted Vulnerability Management]]> https://tsecurity.de/de/3673775/it-security-nachrichten/demystifying-ai-exploits-a-blueprint-for-ai-assisted-vulnerability-management/ https://tsecurity.de/de/3673775/it-security-nachrichten/demystifying-ai-exploits-a-blueprint-for-ai-assisted-vulnerability-management/ Thu, 16 Jul 2026 16:23:24 +0200 📰 IT Security Nachrichten tsecurity.de

    Written by: Jules Czarniak

    Introduction 

    As highlighted in the Mandiant M-Trends 2026 report, the mean time-to-exploit (TTE) has dropped to -7 days, meaning vulnerabilities are often exploited a week before a patch even exists. 

    To keep pace, many security teams are exploring how to integrate large language model (LLM) agents into their codebases, development environments and continuous integration and continuous delivery (CI/CD) pipelines for automated vulnerability discovery and remediation. However, deploying privileged artificial intelligence (AI) agents without mature integration processes introduces new architectural risks. 

    In response to customer inquiries about how to safely integrate AI capabilities into vulnerability management workflows, this blog provides actionable guidance from Mandiant Consulting about how to establish operational guardrails for AI assisted vulnerability management, including several detailed scenarios. What each of these examples show is that security teams can accelerate workflows with AI while also upholding the structural integrity of their environments. We suggest that combining AI capabilities with deterministic controls and human intelligence in strategic ways maximizes benefits and reduces risk. 

    Establish Operational Guardrails to Safely Deploy AI Agents

    To safely adopt advanced AI capabilities without introducing unpredictable failures into deployment pipelines, organizations should ground their approach in established industry standards. While guidelines like the NIST AI Risk Management Framework (RMF) and the OWASP Top 10 for LLMs provide comprehensive baselines for identifying risks, operationalizing these controls requires a structural blueprint.

    Frameworks like Google’s Secure AI Framework (SAIF) and Google’s approach to secure AI Agents provide a practical path forward, demanding that organizations extend existing deterministic controls directly into the AI execution environment. When deploying AI agents, security teams should navigate specific operational and structural risks:

    • Pre-agent data security and Defense-in-Depth: Agents should not be able to access personally identifiable information (PII), protected health information (PHI), or other sensitive data. Organizations should enforce data security before the prompt reaches the model. This includes strictly using non-production environments populated with synthetic data for testing. For production, security teams should deploy a hybrid defense-in-depth model. This includes Layer 1 deterministic policy engines acting as chokepoints, alongside Layer 2 reasoning-based defenses like specialized guard models (such as Model Armor or similar provider-agnostic guardrails) to filter out sensitive data and block malicious prompt injections before they reach the agent layer. Crucially for vulnerability discovery, security teams should treat the codebase itself as an untrusted input. Threat actors can embed indirect prompt injections within source code comments or third-party dependencies (e.g., hidden instructions telling the agent to ignore vulnerabilities or exfiltrate environment variables), making input sanitation a requirement even for internal scanning.

    • Cloud provider limitations and zero data retention (ZDR): Many cloud and LLM providers block or throttle automated offensive security probing by default to prevent abuse. Organizations should establish clear rules of engagement and authorized testing agreements to navigate acceptable use policies. Furthermore, organizations should enforce strict zero data retention (ZDR) agreements with their LLM providers to guarantee that proprietary code and discovered vulnerabilities are never used to train external models.

    • Workload isolation: Agent workloads should execute in strictly isolated, unprivileged containers with dynamically limited privileges. By relying on robust sandboxing to prevent privilege escalation, if an agent hallucinates a destructive command or is hijacked via prompt injection, the blast radius remains contained.

    • Red Teaming: Before deploying autonomous vulnerability scanners that can dynamically spin up sandboxes and execute code, organizations should subject the AI agents themselves to human-led red teaming as part of comprehensive assurance efforts. This validates the agent's resilience against jailbreaks, recursive logic loops, and complex prompt injections, ensuring the security tooling does not become the attack vector.

    • Least-Privileged Machine Identities and Human Controllers: While workloads should be isolated, agents inherently require privileges to generate pull requests and commit code. Security teams should ensure these agents operate under distinct, strictly scoped machine identities that tie back to human controllers to ensure accountability and user consent. Organizations should use short-lived, just-in-time (JIT) tokens bound exclusively to the specific repository and branch under review. This enforces the principle of limited agent powers and ensures that even if an agent’s container is compromised via prompt injection, the threat actor cannot pivot to modify adjacent enterprise codebases.

    • Supply chain resilience for skills: As developers augment AI with third-party skills and model context protocol (MCP) servers, security teams should treat these integrations as untrusted supply chain components. MCP plugins introduce the risk of supply chain poisoning, where a previously benign integration is silently updated with malicious dependencies. Additionally, security teams should evaluate the underlying agent orchestration frameworks themselves (e.g., LangChain, AutoGen) for inherent vulnerabilities, such as session memory poisoning or recursive loop hijacking.

    • Toxic flow analysis (TFA) and Observable Actions: The objective of TFA is to monitor data paths at runtime, ensuring agents do not exfiltrate sensitive internal context to unvetted external endpoints. Agent actions, inputs, reasoning, and outputs must be fully observable and transparently logged. While implementing dynamic taint tracking for LLMs remains a complex architectural challenge, organizations should clearly separate this runtime observability from static supply chain controls. Integrating threat intelligence to hash and vet incoming agent tools provides a necessary baseline for verifying integrity before deployment. However, because static controls cannot address behavior post-deployment, mitigating data exfiltration ultimately requires active runtime monitoring and secure, centralized logging to trace and restrict the actual flow of data.

    Demystifying AI image1

    Figure 1: Visual representation of an isolated AI agent environment using SAIF mechanisms

    By operationalizing these tools within frameworks that demand verifiable integrity and structural resilience, organizations can safely bridge the gap between AI velocity and enterprise defense.

    The need for human-led threat modeling

    While LLMs excel at identifying syntax patterns, source code itself rarely contains the full picture of unwritten business intent. Some organizations attempt to solve this by connecting LLM agents to internal wikis, design documents, and issue trackers using retrieval-augmented generation (RAG).

    While RAG gives the model access to external business context, it is not a perfect fix. Corporate documentation is frequently stale, contradictory, or incomplete. An AI agent might retrieve an outdated architecture diagram and confidently hallucinate a secure path that no longer exists in production. Because LLM agents struggle to resolve conflicting, undocumented human assumptions, human-led threat modeling remains a critical security control across both legacy applications and modern agent workflows.

    Security teams should apply threat modeling during both the pre-build system design phase to establish a secure foundation, and during post-build architecture reviews. While an AI agent might successfully identify a poorly configured internal endpoint locally, a human threat modeler asks the structural question: why does that microservice possess broad database read permissions in the first place? 

    Identifying architectural vulnerabilities requires reasoning about business risk, data sensitivity, and operational constraints. To structure this process, organizations can use industry frameworks like PASTA (Process for Attack Simulation and Threat Analysis) or service offerings like the Mandiant Threat Modeling Security Service to map trust boundaries, uncover structural design flaws, and prioritize compensating controls. Securing fundamental architecture through human oversight is a necessary component when relying on automated agents to find bugs in a poorly designed system.

    Once these AI agents are safely sandboxed, as guided by SAIF, and the architecture is verified through threat modeling, organizations can typically apply them to two different problem spaces: Enterprise Vulnerability Management (to assist in managing the volume of known CVEs in commercial off-the-shelf (COTS) software and infrastructure) and Product Security (to identify vulnerabilities in 1st-party (1P) code).

    Track 1: Enterprise Vulnerability Management

    Foundational security and discovery 

    While the second track of this post explores how AI agents can uncover complex zero-days in custom code, organizations should manage the scale of enterprise infrastructure in tandem with these AI deployments. Even as new AI capabilities dominate headlines, organizations should still address foundational security challenges, such as secrets sprawl, unmanaged service accounts, missing FIDO2 MFA, and legacy VPN concentrators. Although vulnerability exploitation was the primary initial infection vector in intrusions Mandiant investigated last year, threat actors consistently rely on missing foundational controls and unpatched edge devices to secure and escalate their foothold after exploiting a vulnerability.

    Furthermore, AI cannot replace foundational visibility. As security teams deploy AI agents, they should simultaneously close these tactical entry points by maximizing dynamic discovery capabilities like External Attack Surface Management (EASM), Cloud Security Posture Management (CSPM), and Continuous Threat Exposure Management (CTEM). In hybrid and cloud environments, tools like Wiz can be used to map this initial footprint.

    Risk-based vulnerability management 

    Vulnerability management teams are already overwhelmed by the current volume of findings generated by traditional scanners. As organizations scale dynamic discovery tools, such as EASM, CSPM and CTEM, alongside automated AI agents, this influx of findings will compound the problem. To manage this influx, telemetry from these diverse discovery methods must first be normalized and deduplicated. This normalized data serves two purposes: it feeds directly into the risk engine, and it acts as a live overlay to correct stale records in the configuration management database (CMDB). By evaluating the deduplicated vulnerabilities alongside this newly updated asset context and frontline threat intelligence, the RBVM engine calculates a custom risk score that allows security teams to dynamically prioritize remediation.

    A mature RBVM methodology calculates a customized risk score on a 0 to 100 scale using a weighted average. A sample formula for calculating this risk-based score is:

    Final Score = (W_1 * S_vuln) + (W_2 * S_asset) + (W_3 * S_threat)

    The variables and weights (W) are customized to the organization's risk appetite (for example, 0.20 for vulnerability, 0.40 for asset, and 0.40 for threat, summing to 1.0), while the underlying variables (S) are scored on a 0 to 100 scale and defined as follows:

    • Vulnerability severity (S_vuln): The inherent technical severity of the flaw. This is calculated by taking the CVSS Base Score (which natively accounts for confidentiality, integrity, and availability impact) and multiplying it by 10.

    • Asset context (S_asset): A combined metric of exposure and data sensitivity. Scores range from 100 for internet-facing assets holding customer data, down to 25 for internal-only assets with no sensitive data. To translate this impact into monetary terms for non-technical stakeholders, organizations can incorporate Factor Analysis of Information Risk (FAIR) principles into this metric. However, this approach requires highly accurate, continuously updated financial data that many enterprises struggle to maintain at scale.

    • Threat context (S_threat): The real-world urgency of the vulnerability. Scores range from 100 if actively exploited by threat actors relevant to the organization's profile, 75 if a proof-of-concept exists or if it is a vulnerability class easily exploited by autonomous AI agents, down to 25 if the exploit is theoretical and highly complex. Organizations should also map the Exploit Prediction Scoring System (EPSS) probability percentage directly into this variable. This allows the threat score to automatically scale up or down as real-world exploitation telemetry shifts, aligning static vulnerability data with active threat intelligence.

    An asset's customized risk score should directly influence internal remediation service-level agreements (SLAs), unless external compliance-driven mandates, such as CISA Binding Operational Directives (BODs), or relevant equivalents, override internal prioritization. A risk-driven and threat-intelligence-driven vulnerability prioritization methodology will help organizations focus resources on managing and mitigating the most critical security vulnerabilities first. This is an area where LLMs can support the vulnerability management process, particularly by helping teams synthesize unstructured threat intelligence to surface relevant risk contexts more efficiently. Enforcing strict SLOs for patching, while requiring formal risk acceptance documentation for any patching exceptions, will help reduce the number of vulnerabilities available to threat actors and increase the visibility of outstanding risks across the organization. Furthermore, organizations should integrate RBVM data directly into their security orchestration, automation, and response (SOAR) platforms for automated alert enrichment.

    Demystifying AI image5

    Figure 2: Integration points of a risk-based vulnerability management (RBVM) program.

    Containment and Observability

    Modern architecture blueprints must prioritize attack surface reduction under the assumption that vulnerabilities will inevitably be exploited. Moving away from traditional perimeter defenses, organizations should align with zero trust principles, ensuring that security boundaries are established around every asset, workload, and identity.

    A component of this alignment is the implementation of strong authentication principles. Organizations should eliminate implicit trust by enforcing continuous, context-aware authentication and authorization. Utilizing Zero Trust Network Access (ZTNA) solutions, such as Identity-Aware Proxies (IAP), shields critical management interfaces (e.g., SSH, RDP) and internal systems from direct internet exposure, granting access only to verified identities and compliant devices.

    For public-facing applications and APIs, attack surface reduction involves deploying Layer 7 inspection at the load balancer or API gateway level. This hardening layer enforces strict schema validation, intercepting and neutralizing malformed inbound traffic and potential exploits before they can interact with internal application logic.

    Securing the software supply chain is equally vital in modern blueprints, and organizations should align with frameworks like Supply-chain Levels for Software Artifacts (SLSA) across both dependency and build tracks. Security policies should mandate that third-party dependencies are routed through a centralized artifact repository equipped with automated curation services, such as Google Assured Open Source Software (OSS) or an equivalent solution, preventing untrusted code from entering the development lifecycle. Furthermore, maturing toward advanced SLSA build levels (e.g., SLSA level 3) through the implementation of isolation, ephemerality and reproducibility requirements via  ephemeral compute infrastructure for CI/CD runners reduces the likelihood of attacker persistence by ensuring environments are short-lived and automatically cycled.

    To complement these pre-build controls, runtime observability should be established across all production workloads. This requires monitoring both infrastructure-level behavior and the specific runtime libraries actively executing in production, which surfaces true exploitable risk far beyond a static Software Bill of Materials. In tandem with monitoring workloads, organizations should secure how they authenticate by implementing workload identity federation. By removing static credentials and instead using short-lived tokens backed by strong cryptographic identity verification, organizations can reduce the risk of credential theft and unauthorized lateral movement.

    Within the internal environment, microsegmentation should be enforced to break down flat networks into granular security zones. Routing application traffic through a Secure Access Service Edge (SASE) architecture integrates network routing directly with robust identity controls, rendering internal services completely invisible to unauthenticated users and containing threats to their initial point of entry.

    Finally, automated containment and incident response within a zero trust framework must rely on deterministic, auditable tooling. Endpoint detection and response (EDR) platforms and SOAR playbooks should handle high-fidelity containment tasks through hardcoded execution logic. While AI tools accelerate triage and policy recommendation, actual execution capabilities must remain restricted to well-defined, pre-tested workflows to maintain total architectural predictability.

    Demystifying AI image8

    Figure 3: Structural containment and observability architecture

    Track 2: Product Security & Development (1P Code)

    Deterministic and probabilistic tooling

    Integrating LLM agents into vulnerability management and security workflows requires recognizing the differences between deterministic and probabilistic tooling. Traditional SAST and DAST tools utilize fixed methodologies to evaluate vulnerabilities through structural code parsing or definitive runtime observations. LLMs, however, evaluate source code by processing tokens simultaneously to calculate statistical and semantic relationships, rather than tracing deterministic execution tracks.

    While techniques like Chain of Thought (CoT) prompting allow models to bridge this gap by decomposing complex code paths into intermediate reasoning steps, this process remains bounded by architectural limitations. Even when a model possesses a context window large enough to ingest entire repositories, it may experience attention degradation across long inputs, often failing to correctly weight intervening validation or sanitization logic within the prompt. For example, if a variable is tainted on line 10 but sanitized on line 500, attention degradation can cause the model to lose track of the sanitization logic. Furthermore, when enterprise codebases require chunking to fit within context limits, the resulting fragmentation may cause the model to lose track of end-to-end data flows.

    Consequently, probabilistic engines are effective at uncovering localized, static anomalies, such as hardcoded credentials or outdated dependencies, but frequently misjudge complex vulnerabilities split across fragmented chunks or extended context windows. Notable exceptions occur when these probabilistic models are coupled with deterministic feedback loops. For instance, when analyzing C++ memory corruption, an LLM can be equipped with a test harness to iteratively execute code and definitively prove a crash. While these dynamic validation applications are detailed in subsequent sections, the baseline limitation for static analysis across standard enterprise codebases remains: models struggle to consistently evaluate dispersed logic.

    Demystifying AI image4

    Figure 4: Deterministic SAST scanners vs. probabilistic LLMs

    Binary and architectural oracles

    Many security programs are moving toward agent workflows where an agent autonomously spins up a test environment and uses tools to execute payloads and verify its findings. This is a promising approach, but it is important to understand where it is most effective.

    Agent workflows perform well against bug classes with binary and observable oracles, meaning the system provides an objective, 'crash or no crash' feedback loop. For example, if a model is hunting for memory corruption in a C++ kernel, a successful exploit is undeniable: the payload executes, and a resulting crash definitively proves the vulnerability. This explains why the industry is currently seeing a surge in AI-discovered vulnerabilities across memory-unsafe targets like web browsers and operating systems.

    However, enterprise software is heavily dominated by vulnerabilities that require architectural oracles for validation. Vulnerabilities like authorization bypasses, complex business logic flaws, and indirect server-side request forgeries require an understanding of business context and cross-service trust boundaries. If an agent's payload fails to produce a clear outcome, it can't reliably distinguish whether the vulnerability is a hallucination or if it simply constructed the payload incorrectly. An agent's malformed payload might even crash an unrelated background process and cause the model to hallucinate a success and report a false confirmation. Complex enterprise architecture contains unwritten business intent that a probabilistic engine can't inherently know.

    Demystifying AI image3

    Figure 5: Evaluating vulnerabilities against binary vs. architectural oracles

    Targeted deployment and human impact

    Organizations adopting LLMs for vulnerability discovery face a massive staffing challenge. LLMs can generate findings significantly faster than human engineers can triage them. If every LLM-generated alert requires manual review, security teams will quickly face burnout and/or suffer alarm fatigue.

    Rather than indiscriminately pointing agents at all available codebases and risking an influx of unverified output, security teams need a selective deployment strategy. Mature programs should maintain SAST and DAST for baseline hygiene and deterministic rule enforcement, and reserve intensive agent audits for high-impact components with clear binary oracles.

    Organizations can prioritize agent audits on systems where the technology's strengths align with the broader risk profile:

    • Memory-unsafe codebases: Legacy or high-performance components written in memory-unsafe languages such as C, C++, or Assembly are strong candidates for LLM audits. These languages are susceptible to memory corruption flaws, such as buffer overflows and use-after-free conditions. Because these vulnerabilities trigger definitive failure states like segmentation faults, they work well with automated sandboxes where agents can compile the code with memory sanitizers and write proof-of-concept inputs. This approach is also effective for auditing the native extensions where safe languages call unsafe internal libraries, such as Python C extensions or the Java Native Interface (JNI).

    • Systems highly exposed to outside content: First-party data ingestion pipelines, custom API gateways, or proprietary edge proxies. A prerequisite here is direct access to the source code, this strategy is strictly for internally developed or fully open-source codebases where the organization can inspect the logic. Because these systems directly parse untrusted internet traffic, targeting their source code for LLM-driven audits yields the highest risk-reduction ROI.

    • Shared internal libraries and utilities: Core serialization/deserialization packages, common utility functions, and custom middleware wrappers (such as internal message-queue parsers) maintained in-house. Because the enterprise owns the source code for these shared building blocks, agent tools can easily hook into them within automated test harnesses to fuzz inputs and catch low-level logic or parsing bugs with high fidelity.

    • Foundational security boundaries: Internally developed centralized authentication services, custom OAuth providers, and internal credential brokers. While testing complex identity boundaries generates higher logic-based noise, having full access to the source code allows teams to pair agents with deterministic checks to safely triage findings, given that the blast radius of an authentication failure justifies the human effort.

    To filter the noise generated by LLMs, organizations should establish routing rules. Require the agent to generate a fully reproducible, deterministic test harness (such as a compiled binary or a Python test script) that attempts to prove the exploit. This harness must execute automatically in an isolated, monitored sandbox. If the sandbox execution fails (due to a syntax error or a failed exploit), the ticket is discarded, sparing human resources. However, organizations should enforce execution timeouts and iteration limits on these test harnesses. Without hard limits, an autonomous agent attempting to prove a vulnerability can fall into an infinite loop: writing a script, failing, rewriting, and failing again, exhausting API token budgets and compute resources against a single dead-end vulnerability, creating significant cost overruns without advancing the security review. To manage these expenses, organizations should incorporate FinOps principles to balance the compute and API costs of LLM audits against the traditional expenses of manual triage.

    However, a successful execution in the sandbox does not guarantee an actionable, high-priority risk. In practice, autonomous agents frequently produce working PoCs for genuine technical flaws that are ultimately irrelevant; or warrant a lower remediation priority within the context of the system's threat model. For example, the agent might successfully exploit an unreachable dead-code path, or trigger a bug that requires administrative access to execute and yields no further escalation of privilege. Therefore, a human engineer should be assigned to review and prioritize the ticket only if the sandbox registers a successful execution, validating environmental context, reachability, and true business impact as part of the review.

    This workflow reduces the volume of alerts, but it is important to understand that the security team's workload does not disappear. The engineer's primary job shifts from manually hunting for the initial vulnerability to auditing the LLM-generated proof to ensure it represents a meaningful risk rather than an unexploitable or contextually irrelevant finding. Leadership should properly staff and train teams for this new reality. Deploying LLM agents does not remove the need for skilled practitioners; it redirects their workload toward complex validation. Equally important is training teams to recognize the risk of false negatives. A hyper-focus on filtering AI-generated noise can create a false sense of security. If an exploit relies on a novel technique or a zero-day vulnerability that was not heavily weighted in the model's training data, the agent will likely scan right past it in silence. LLMs augment discovery, but they do not guarantee exhaustive coverage.

    When integrating LLMs into SAST triage pipelines, human engineers should also verify the broader architectural integrity. Prompting an LLM with specific SAST warnings can induce contextual narrowing, where the agent becomes hyper-fixated on resolving a localized syntax error and misses broader architectural flaws existing in the same file. Furthermore, if the agent's mandate extends beyond discovery to automated remediation (such as writing and proposing code fixes), this human-in-the-loop validation becomes critical to ensure the LLM does not inadvertently introduce new regressions or bypass intended business logic.

    Demistiying Image 6 New

    Figure 6: Flowchart outlining the targeted LLM deployment and triage workflow.

    Remediation and hardening

    LLM-assisted code remediation

    A primary goal of integrating large language models (LLMs) into the software development lifecycle is automated remediation. To achieve this, organizations are deploying these capabilities through two primary execution methods: directly within the integrated development environment (IDE) or as a centralized pipeline runner. Examples include CodeMender, although as of time of writing, it is not publicly available.

    IDE-integrated method 

    This method shifts remediation as far left as possible by operating as an active pair-programmer. Tools running continuous static analysis in the background of the IDE surface vulnerabilities directly to the developer via editor diagnostics like inline indicators or hover tooltips.

    • Localized scope: The developer can trigger the LLM agent to analyze the localized data flow and generate a targeted patch (such as implementing parameterized SQL queries). By constraining the LLM to localized, syntax-level fixes, the scope of the change remains contained. This prevents the agent from attempting sprawling, multi-file refactors that frequently break complex architectural logic.

    • Human-in-the-loop: The developer reviews the AI-generated patch before the code is committed.

    • Managing false positives: Local IDE agents allow developers to manage false positives dynamically. Suppressing alerts anchored to specific line text reduces alert fatigue and preserves developer trust.

    CI/CD runner method 

    The runner method executes asynchronously within the CI/CD pipeline to use an LLM to review committed code and automatically propose remediation.

    • Restricted execution and deterministic validation: Asking a centralized runner to automatically rewrite a complex, multi-file authorization flaw directly in the main branch introduces a high risk of breaking logic errors. To mitigate this, agents must be restricted to generating pull requests (PRs). Once a PR is generated, it must automatically execute standard regression suites alongside the deterministic test harness. By rerunning the initial PoC against the patched code, the workflow repurposes the exploit script as a validation oracle to prove the vulnerability has been remediated. A human engineer then reviews the PR to validate the architectural logic before merging.

    In all cases security teams should define a clear boundary between the two methods rather than rely on a single approach. IDE agents provide immediate, syntax-level support. They catch and resolve low-complexity errors locally before developers commit code. Centralized CI/CD runners handle broader organizational baselines. They propose complex, repository-wide fixes for vulnerabilities that bypass local environments.

    Post-deployment controls 

    Even with human review and deterministic test harnesses, AI-generated patches can still introduce logic regressions in production. Organizations should implement strict post-deployment controls:

    • Automated rollbacks: Treating LLM-generated code with the same post-deployment scrutiny as any major architectural change ensures that if an unforeseen regression traverses the CI/CD pipeline, the environment can revert to a known good state.

    • Mitigating model drift: Relying on managed AI services introduces the ongoing risk of model drift. To prevent silent weight updates from breaking test harnesses, organizations need to pin specific model API versions to frozen releases. When a pinned version reaches its end-of-life, organizations will face a forced migration. Mitigating this pipeline fragility requires combining model pinning with deterministic regression suites.

    • Compliance and auditability: If an AI agent automatically closes a security ticket or generates a patch in the CI/CD pipeline, organizations should maintain immutable audit logs to satisfy frameworks like SOC 2 ,PCI-DSS, FedRAMP, and CMMC. National security deployments must also account for data sovereignty requirements. This logging should record the specific model version that proposed the fix, the deterministic test results that validated it, and the human engineer who approved the merge. Furthermore, because emerging legislation like the EU AI Act emphasizes human oversight for high-risk applications, security teams should carefully evaluate how autonomous remediation workflows align with these evolving global regulatory standards.

    demistifying image 7

    Figure 7: Flowchart demonstrating the difference between local IDE AI remediation and centralized CI/CD pipeline remediation.

    Conclusion

    Leveraging LLMs in vulnerability management is a multi-layer solution: Integrating it requires separating workflows by layer. At the enterprise infrastructure level, Risk-Based Vulnerability Management (RBVM) and exposure management are necessary to process the volume of findings and configuration drift. At the product and code security level, LLM-enabled vulnerability assessment and remediation must operate alongside foundational deterministic controls, such as SAST and DAST, to audit custom, open-source, or third-party code.

    Although LLMs can help manage technical debt and accelerate vulnerability discovery, they do not replace secure-by-design principles. The fact that LLM agents are proving exceptionally capable at identifying and exploiting localized memory corruption in memory-unsafe codebases, alongside other primary vectors, should serve as a wake-up call. 

    As a long-term strategy aligned with NSA guidance on Software Memory Safety, organizations need to phase memory-safe languages into new internal development. LLMs are beginning to expand what is possible here by reducing the manual labor required for code migration. Converting existing C or C++ codebases to Rust has historically been unrealistic due to the large volume of engineering hours needed. While fully automated translation is not a turn-key solution, using LLMs to assist engineers with the bulk of the conversion can make these long-term migrations operationally viable. Beyond internal efforts, organizations should use procurement requirements to incentivize vendors to reduce their reliance on memory-unsafe languages and establish secure configuration defaults over time. Bridging the gap between AI velocity and enterprise defense means building an automated pipeline to manage the current backlog, while architecting systems where entire classes of vulnerabilities and misconfigurations are eliminated by design.

    Acknowledgements

    This analysis would not have been possible without the assistance of Google Threat Intelligence Group (GTIG) and other broader Google teams.

    ]]>         <![CDATA[Apple Maps Ads Will Ban Home Services, Crypto ATMs, and Bail Bonds]]> https://tsecurity.de/de/3673435/ios-mac-os/apple-maps-ads-will-ban-home-services-crypto-atms-and-bail-bonds/ https://tsecurity.de/de/3673435/ios-mac-os/apple-maps-ads-will-ban-home-services-crypto-atms-and-bail-bonds/ Thu, 16 Jul 2026 14:25:53 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[New agentic compute patterns]]> https://tsecurity.de/de/3672922/ai-nachrichten/new-agentic-compute-patterns/ https://tsecurity.de/de/3672922/ai-nachrichten/new-agentic-compute-patterns/ Thu, 16 Jul 2026 11:19:03 +0200 🔧 AI Nachrichten tsecurity.de

    For a decade, Kubernetes was the right answer. It organized containers, scaled services horizontally and gave platform teams a shared vocabulary for running software in production. It abstracted away enough of the underlying complexity that engineers could stop thinking about servers and start thinking about services. Most cloud-native infrastructure today is built on top of it, directly or in spirit, and EKS made that model the default for the majority of enterprise teams running workloads on AWS.

    The workload that defined that era was the stateless HTTP request, fast in, fast out, disposable. A user action triggers a request, the request hits a service, the service returns a response and the container is done. Kubernetes was optimized for that pattern down to the scheduler internals: Bin-pack containers onto nodes, autoscale on CPU and memory, evict and reschedule when something goes wrong. The whole system is tuned around the assumption that individual units of work are short, stateless and interchangeable.

    That assumption no longer holds for the workloads that matter most right now.

    The agent workload is structurally different

    Agents are long-running, stateful processes. They reason across time, call external tools, spawn subprocesses, write and execute code, and make decisions that depend on what happened five steps earlier in the same task. A single-agent workflow might run for minutes or hours, touching a dozen external systems and generating intermediate outputs that subsequent steps depend on. The compute layer for that kind of work needs to do things the old model was never asked to do. That is the new pattern: Execution infrastructure designed around agent semantics rather than request semantics.

    The Kubernetes community itself has acknowledged this mismatch. In March 2026, Kubernetes SIG Apps published an introduction to Agent Sandbox, a new CRD-based abstraction designed specifically for singleton, stateful agent workloads. The framing is direct: The ecosystem is moving from short-lived, isolated tasks to deploying multiple, coordinated AI agents that run continuously, and mapping those workloads to traditional Kubernetes primitives requires an entirely new abstraction. The fact that the Kubernetes maintainers built a dedicated primitive for this, rather than recommending teams compose one from existing resources, is itself the clearest signal that agent execution does not fit the old model.

    What agent execution actually requires

    Concretely, it requires four things. First, isolated execution environments that provision in milliseconds, not minutes, so each agent task gets its own sandbox for code execution and tool calls without blocking the reasoning loop. The difference between a two-second environment and a two-minute environment is not a performance optimization; it determines whether the architecture is viable at all. Second, durable state management across the full task lifecycle, so an agent can pause, hand off or resume without re-initializing from scratch and burning tokens to reconstruct context it already built. Third, coordination primitives for multi-agent work: The ability to spawn subagents, pass structured outputs between them and track task dependencies across a graph of concurrent processes. Production agent systems are rarely single agents; they are pipelines of specialized agents with handoffs that need to be reliable and inspectable. Fourth, credentials and secrets management that travel with the execution context, so agents can authenticate to external services securely without exposing credentials in the task definition, logs or the environment variables of a shared container.

    The mismatch shows up fast in production

    Kubernetes and EKS expose the mismatch quickly in practice. Pod eviction terminates an agent mid-task with no clean recovery path. Autoscaling reads CPU utilization as the load signal, but an agent holding a long inference connection looks idle to the scheduler even when it is doing the most consequential work in the pipeline. Provisioning a new environment takes 45 seconds to two minutes on a well-tuned cluster; agent workloads need that in under two seconds or the reasoning loop stalls and the user experience degrades visibly. These are not edge cases or misconfigurations. They are the normal operating conditions for production agent workloads running on infrastructure that was not designed for them.

    The utilization data makes the broader cost picture even starker. The 2026 State of Kubernetes Optimization Report from CAST AI, drawn from analysis of over 23,000 production clusters across AWS, Azure and GCP, found average CPU utilization at 8 percent, down from 10 percent the year prior. Memory utilization fell from 23 to 20 percent. CPU overprovisioning jumped from 40 to 69 percent year over year. These numbers reflect clusters running traditional workloads, and the pattern is worsening, not improving, as environments scale. Agent workloads compound this problem further. An agent holding an open inference connection or waiting on a tool call registers as idle to a scheduler that reads CPU and memory as the only meaningful load signals. The infrastructure responds to the wrong metric, overprovisioning capacity for demand it cannot measure, while the actual bottleneck, environment provisioning latency and state continuity, goes unaddressed.

    Security is not the same problem it was before

    Agent workloads change the threat model at the infrastructure level. A compromised stateless service exposes a narrow surface defined by its API contracts. A compromised agent exposes every system it can reach, every credential it holds and every action it is authorized to take on behalf of the user. Agents generate and execute their own code, make non-deterministic tool-call decisions and accumulate context across long-running sessions. Standard container namespacing does not contain that kind of risk. Kernel-level isolation, default-deny network egress, scoped credentials per session and agent-aware observability are not optional hardening steps. They are baseline requirements for running agents in production.

    What teams that ship agents have already figured out

    Some of the clearest evidence for this shift comes not from infrastructure vendors but from product engineering teams running agents at scale on their own code. In late 2025, Ramp’s engineering team published a detailed account of building Inspect, their internal background coding agent. Each Inspect session runs in a sandboxed VM with a full-stack development environment and deep integrations across their observability, CI, and deployment tooling. The architecture requirements map almost exactly to the four primitives above. Filesystem snapshots keep sessions starting in seconds rather than minutes. Sessions are isolated and stateful. The agent can run tests, review telemetry, query feature flags and visually verify frontend changes in a real browser. And the whole system supports unlimited concurrency, so engineers can spin up ten parallel sessions exploring different approaches to the same problem without contention.

    The results speak for themselves. Within months of launch, roughly 30 percent of all pull requests merged to Ramp’s frontend and backend repositories were written by Inspect. That level of adoption was not mandated. It happened because the execution environment was fast enough, capable enough and well-integrated enough that the agent was strictly better than a local workflow for a meaningful share of tasks. The key insight from the Ramp case is not about the model. It is about the execution layer. As their team put it, session speed should only be limited by model-provider time-to-first-token; everything else, like cloning and installing, needs to be done before the session starts. That is a statement about infrastructure, not intelligence.

    The ecosystem is catching up, but defaults are sticky

    None of that is a criticism of the tools. Kubernetes solved exactly the problem it was designed for, and it solved it well. The issue is that infrastructure defaults are sticky. Teams inherit them, build on top of them and optimize within their constraints long after the underlying workload has changed. The Kubernetes community’s own response, the Agent Sandbox project under SIG Apps, validates the thesis that a new abstraction is necessary. The new primitives the community is building include warm pools for near-zero cold starts, lifecycle management for suspending and resuming idle agents without losing state, and pluggable kernel isolation for secure execution of untrusted code. These are not incremental improvements to existing resources. They are net-new abstractions that acknowledge the old model does not stretch to fit.

    But adoption of purpose-built agent infrastructure remains early. Enterprises building agent pipelines today are largely running a request-oriented orchestration model against an execution-oriented workload, and the mismatch shows up in task failure rates, runaway costs and debugging cycles that have no good tooling because the observability layer was also designed for stateless services.

    The structural advantage is available now

    The infrastructure to close that gap exists now. The prerequisite is recognizing that agent execution is a first-class compute pattern with its own primitives and its own requirements, not a variant of the stateless service model that defined the last decade. Teams that make that shift early will have a meaningful structural advantage. The ones that do not will spend the next two years wondering why their agent systems are unreliable at a scale that should be tractable.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[What next-generation IT leadership looks like]]> https://tsecurity.de/de/3672917/it-nachrichten/what-next-generation-it-leadership-looks-like/ https://tsecurity.de/de/3672917/it-nachrichten/what-next-generation-it-leadership-looks-like/ Thu, 16 Jul 2026 11:18:14 +0200 📰 IT Nachrichten tsecurity.de

    Today’s CIOs must master a complex balancing act of maintaining operational excellence while enabling AI experimentation, modernizing legacy environments while accelerating innovation, leading workforce transformation while maintaining culture, and communicating fluently across boards, business units, customers, and technical teams alike.

    Few leaders understand this balancing act better than former Verizon CIO Jane Connell. Over her career, Connell has helped some of the world’s largest enterprises modernize operations, reduce complexity, and transform how technology enables business value at scale. As a 2026 CIO Hall of Fame inductee, she is widely respected not only for operational excellence and strategic vision but also for her commitment to mentoring, workforce transformation, and preparing the next generation of leaders for a rapidly changing future.

    On a recent episode of the Tech Whisperers podcast, we unpacked Connell’s unconventional leadership story and the playbook that has shaped one of technology’s most impactful leaders. In this exclusive interview after the show, edited for length and clarity, Connell shares more lessons from her Hall of Fame journey and why she believes the future of technology leadership will depend less on org charts and more on curiosity, credibility, and human connection.

    Dan Roberts: When you think about preparing the next generation of technology leaders, what capabilities or mindsets do you believe will matter most in this next era?

    Jane Connell: One is curiosity, or what I call the “why” factor: What do we need to do and why do we need to do it? It’s having a mindset of unlocking the art of the possible. You must be comfortable with what you know, what you don’t know, and asking the question why, because in this era of AI and where technology is going, it’s not about automating things you know; it’s about what you don’t already know, and what that unlocks. AI creates patterns and opportunities and re-engineers through its own intelligence, so there has to be a lot of instinct involved, and you’re going to have to understand and learn what it’s telling you.

    I’m on the board of Rutgers, and one of the conversations we’re in with future leaders in education is that you don’t have those entry-level jobs anymore. They’re going to be AI. But those were building blocks for us. We came up the ranks and did those jobs, and that created the knowledge. [Future leaders are] not going to have that, so how do you create the foundation of knowledge — which is that art of asking why or what — to question if the bots or the patterns are biased or wrong. You’re not going to have the experience to rely on and say, “That’s wrong; I know that’s wrong because I did those. I know how this operates.”

    Second is having humility and being comfortable in your skin — that you don’t know everything, but you’re going to learn it. You’re going to involve yourself with people. It’s about workforce structure, not organizational structure. Who do you need to talk to, and what do you have to find out?

    I also believe followership is going to be huge, because the way work gets done is not hierarchical. It’s going to be engineered based on the process and AI. You have to create followership of people working together, and they’ve got to want to work with you. This isn’t going be “you work for me, do as I say.” Followership is going to be a key skill for influencing and organically having that kind of impact, versus someone with authority.

    With that is the accountability to have high integrity, be credible, and be a person someone would trust. Because all this is going to break down the hierarchy of authority, you have to bring that human side and be a really good leader, which means people want to follow you, they trust you, they want to work with you, and they know you’re going to take them to a better place.

    One recurring theme throughout your career has been your ability to bridge deep technology expertise with strong business acumen. Why is that combination becoming even more critical in the age of AI and digital transformation?

    You can’t impact anything tech-alone. It all resides on having business acumen and then having the technical ability to know how to use tech to solve the problem, not the other way around.

    At the root of all this is every company’s Achilles’ heel: the data. Access to data has been a privilege — those who have it, those who don’t. Now you’re bringing structured and unstructured [data] together for these AI models to work, and that’s a new skill set that requires you to know the business inside and outside.

    You also have to stay externally relevant and know where innovation is coming from. And you’re going to need to know how to architect that into the way your company goes to market, which requires you to know the business processes, how it runs, and how it could run.

    That’s the role of leaders moving forward, immersing yourself in the problems the business needs to solve. There’s no boundaries there. It’s not what department you report in and what process you own. It’s seamless. That’s the duality people need to command and grow into.

    Looking back on a career that spans multiple industries with different operating models, cultures, and regulatory environments, what were some of the most important calculated risks you took in terms of your growth?

    There were two pivotal moments in my career that were the biggest risks but probably my biggest gains in growth. One was when I went into a full-time tech role and ran infrastructure. I was a fish out of water, and not the likely successor. Part of the reason I did it goes back to a something we talked about on the podcast: Well, why not me? And I want more. That’s just my tenacity.

    It was during the dot-com days of the late 90s, early 2000s. It didn’t matter if you were the CEO or a board director, if you didn’t know tech and you didn’t understand how to wield it, you were never going to be successful. I knew that no matter what job I may want in the future, I had to know tech. So it was a calculated decision: I’m going to jump into tech.

    Some very senior supply chain leaders who controlled my career told me, “You’re going to fail, and I’ll have a safety net for you when you come back.” Well, I didn’t fail and I never went back. That pressure was there, but I knew why I was doing it. This wasn’t just a job for ego’s sake. This was, I have to know tech. The future is tech. It’s kind of like AI now.

    The other pivotal moment was changing industries. I left Johnson & Johnson at a great time. We had gone through a huge transformation, started our global services organization, and the perfect moment happened for me to retire early there. I didn’t know what I wanted to do. It was the first time I took a break in my career to let the world come to me instead of me planning it. Do I want to open a business? Do I want to consult? Do I want to stay retired? I was fortunate enough that I could, but I got bored.

    The financial industry wasn’t on my radar. Coming out of healthcare, with the purpose and the connection with saving lives, helping people, it’s easy to connect to. Financial wasn’t, for me. But one of the executive search firms said to me, when you interview, the biggest question hanging over your head is going to be, could you be successful elsewhere because you grew up in J&J. You had advocates, you had influence, you knew the industry. It’s like your deck was stacked for you. Could you do all that when you’re a nobody coming off the street?

    So when the CIO role opened at State Street, I interviewed — and talk about being your authentic self. I had already done all this transformation, I already knew the outcomes, I knew everything I did was always enterprise and always end-to-end transformation. And because I wasn’t really vying for the job, I was having this conversation with the CFO and saying, “Here’s what your organization is lacking, here’s the noise you’re going to hear, do you really have the appetite for it?” And “I’d like talk to the COO and see if they’re ready to hear this about the value chain. I may not know your problem yet, but I guarantee it’s one of these three things.”

    I was testing their advocacy of, do you really want to transform? Are you ready? Because you have to own this. I can’t take accountabilities for your organizations. I can help you get there. I’m an enabler for you, but you have to own it. And it was a very different interview. By the end of it, I loved Ron [O’Hanley, State Street Chairman and CEO] and his whole team. I took the job on the leadership and the person more than the industry, and it was very successful.

    I followed the same recipe when I went to Verizon. Those were big growing moments. They were risky, they were very uncomfortable, but it was the biggest growth that I’ve ever had.

    Whether it’s a tough message to the C-suite, a difficult conversation with peers, or helping teams make sense of uncertainty and change, you tell people the truth in a way they can hear it. How can other leaders develop that ability to take people on the journey, especially when the message isn’t easy?

    Skirting a problem is not the way to solve it. I’ve never been the person to say what you want to hear. I’ll tell you how you get there, and I’ll get you the results you want, but I’m going to be super honest because I want to manage the expectations of what we have to achieve.

    What I’ve learned as a leader is to take accountability. Say what you’re going to do, then do it, and if you hit a roadblock, be the first to call it. That gets you access, because people see it as a calculated risk. Anybody in the C-suite has resources and budget, but the earlier you signal and don’t waste money and resources, the more access to people and resources you will have.

    The greatest lesson I learned from one of the leaders in my path was: If you can’t say it in an elevator, and you can’t say it on one slide, you’re talking too much. So, think about it as one slide: What is it you need? What are you going to achieve? What are the risks? What are you taking accountability for? How will you measure it? It doesn’t matter what the message is when you can be that succinct. You’ve got them laser-focused on what it is. You gave them just enough of the periphery to know how you got there, and then it’s their belief in you that you can do it if they give you the money and resources, because that’s what you’re looking for.

    It sounds so simple but putting things together succinctly is hard work. You have to take all the unnecessary noise out, and keep the conversation focused. You don’t want their mind wandering, wondering where is she going, or what are they doing? Give it to them upfront and tell them what you need.

    You’ve spoken about entering corporate environments early in your career feeling intimidated by people with more traditional credentials or educational backgrounds. What advice can you give rising leaders about battling imposter syndrome?

    Take the time to figure out what makes you uncomfortable, what makes you feel like an imposter, or what in that meeting you dread going in where you’re not acting like yourself. Are you more quiet than usual? Are you not asking the question you’d normally ask? Figure out what those issues are, and then address the things that make you uncomfortable. I went to college later because that bothered me. Those credentials do matter. So I addressed it and got my degrees and certifications.

    The other thing is to find people you trust, people whose opinion you respect, and bring them on the inside of what you’re working on. Maybe it’s dealing with a difficult business partner. You may not particularly want to be friends with them, but you’re going to have to work with them. Find the people that work effectively with them. You do this with high integrity — this is not about talking about that person — but find the allies that work with them. Nine times out of ten, they feel the way you do, but they found a way to work with the person. Pick their brain. Bring them in the fold and say, “I need this alliance. I can’t get there, and quite frankly, I know I’m resisting because maybe I just don’t like them. How did you get there?”

    People are generous. Ask their opinion, ask how they’re showing up. “Am I creating the trigger? Is there something I’m doing in that meeting or in that room that I’m not coming out with a decision or whatever I needed?”

    The greatest gift is feedback. There’s feedback you do something with, and there’s feedback you don’t, but either way, it’s a gift. Somebody’s giving it to you. It’s not personal; it’s business. And those things really help build your confidence and leadership style.

    In an era increasingly shaped by automation and disruption, Jane Connell believes the most enduring competitive advantage may come from something deeply human: the ability to inspire confidence, curiosity, resilience, and possibility in others. For more advice from this Hall of Fame CIO, tune in to the Tech Whisperers podcast.

    See also:

    ]]>         <![CDATA[What the World Cup reveals about the operating models CIOs need next]]> https://tsecurity.de/de/3672915/it-nachrichten/what-the-world-cup-reveals-about-the-operating-models-cios-need-next/ https://tsecurity.de/de/3672915/it-nachrichten/what-the-world-cup-reveals-about-the-operating-models-cios-need-next/ Thu, 16 Jul 2026 11:18:11 +0200 📰 IT Nachrichten tsecurity.de

    Every major sporting and pop culture event creates a familiar conversation among employers: How much productivity will be lost?

    This year’s FIFA World Cup was no exception. Before the tournament began, UKG research found that 37% of employees globally planned to adjust their work schedules during the tournament. Some intended to take time off. Others expected to arrive late, leave early, or otherwise alter their work patterns. The estimated global productivity loss from presentism and absenteeism ranged from $17 billion (UKG) to an astonishing $30.2B (Challenger, Gray & Christmas).

    As tournament play began, viewership surged across broadcast and streaming platforms: FOX Sports reported record audiences, while Peacock and Telemundo viewership increased more than 230% compared to the 2022 tournament through the first 12 matches.

    Those numbers are interesting, but, as a CIO, I think they point to a more important question: Why do events like this still disrupt organizations in the first place?

    The World Cup is unique because it is one of the few workforce disruptions we can see coming years in advance, and the tournament game schedule is a blend of predictable (pool play) and unpredictable (knockout stage). We know employees will modify schedules. We know customer-demand patterns will shift. We know some industries will experience staffing challenges while others see increased activity.

    None of this is a surprise.

    That is what makes the UKG survey results so interesting. They reveal a broader truth: Even when change is predictable, many organizations still struggle to prepare for it effectively.

    The issue is rarely a lack of data. Most organizations have access to workforce, operational, financial and customer information. The challenge is that those signals often live in disconnected systems, making it difficult to translate information into action before problems emerge.

    In my experience, this is where many operating models begin to break down.

    Organizations need to optimize operations for adaptability

    For years, organizations optimized for efficiency, standardization and predictability. Those priorities helped businesses scale, but they also created processes that can struggle when conditions change. Increasingly, the ability to adapt is becoming just as important as the ability to execute efficiently.

    Adaptability is often discussed in the context of unexpected events, but many operational challenges are highly predictable. Major sporting events, seasonal demand fluctuations, weather patterns, holiday periods and workforce trends all generate signals organizations can anticipate.

    The question is not whether the information exists. The question is whether organizations can connect workforce, operational, financial and customer data in a way that allows leaders to act on those signals before they become problems.

    This is where technology leaders have an important role to play.

    Access to real-time insights leads to agile decision making

    As CIOs, we are increasingly responsible for creating the conditions that allow organizations to sense changes, make decisions and respond quickly. That requires more than modern technology. It requires connected data, simplified processes and operating models designed to support faster decision making across the business.

    When workforce planning, scheduling, labor costs, customer demand and operational performance exist in separate systems, organizations spend their time reconciling information. When those signals are connected, they can spend their time making decisions.

    This is also where AI has the potential to create significant value. Much of today’s conversation focuses on productivity gains, but I believe the larger opportunity is responsiveness.

    Organizations generate millions of operational signals every day. AI can help process those signals, identify patterns, surface risks and recommend actions faster than traditional approaches. The value is not simply producing more insights. The value is helping organizations shorten the distance between awareness and action.

    When AI is combined with connected data and embedded into operational workflows, it can help leaders respond to changing conditions with greater speed and confidence. That is ultimately what organizations need: not perfect predictions, but the ability to make better decisions faster.

    Three questions to ask right now to test operational effectiveness

    For CIOs, the World Cup offers an interesting stress test. It creates a visible, measurable change in workforce behavior, but the lessons extend far beyond a sporting event. I think there are three questions every technology leader should consider:

    1. Can we identify operational changes as they happen, or only after they appear in reports?
    2. Can our teams make decisions quickly when conditions change?
    3. Are our systems helping employees adapt, or creating additional complexity when flexibility is required?

    The answers often reveal more about organizational readiness than any technology roadmap.

    Operational excellence means moving from information to action

    Eventually, the tournament will end. The broader challenge it exposes will remain. Workforce expectations will continue to evolve. Economic conditions will continue to change. New technologies will continue to reshape how organizations operate.

    Organizations cannot predict every disruption. But they should be able to prepare for the ones they can see coming.

    The World Cup is a reminder that operational excellence is not just about responding to change. It is about recognizing signals early, connecting information across the business, and acting before predictable challenges become operational problems.

    In my experience, the companies that do this well are not necessarily the ones with the most detailed plans. They are the ones with the clearest visibility, the simplest operating models and the ability to turn information into action quickly. Increasingly, that is what modern operational excellence looks like.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[CVE-2024-58340 | langchain-ai LangChain up to 0.3.1 output_parser.py MRKLOutputparser.parse redos (EUVD-2026-2399)]]> https://tsecurity.de/de/3672123/sicherheitsluecken/cve-2024-58340-langchain-ai-langchain-up-to-031-outputparserpy-mrkloutputparserparse-redos-euvd-2026-2399/ https://tsecurity.de/de/3672123/sicherheitsluecken/cve-2024-58340-langchain-ai-langchain-up-to-031-outputparserpy-mrkloutputparserparse-redos-euvd-2026-2399/ Thu, 16 Jul 2026 02:37:53 +0200 🕵️ Sicherheitslücken tsecurity.de problematic has been identified in langchain-ai LangChain up to 0.3.1. The impacted element is the function MRKLOutputparser.parse in the library libs/LangChain/LangChain/agents/mrkl/output_parser.py. Executing a manipulation can lead to inefficient regular expression complexity. The identification of this vulnerability is CVE-2024-58340. The attack may be launched remotely. There is no exploit available.]]> <![CDATA[Security researchers find stalkers abusing Chrome’s sync feature]]> https://tsecurity.de/de/3671871/it-security-nachrichten/security-researchers-find-stalkers-abusing-chromes-sync-feature/ https://tsecurity.de/de/3671871/it-security-nachrichten/security-researchers-find-stalkers-abusing-chromes-sync-feature/ Wed, 15 Jul 2026 23:07:28 +0200 📰 IT Security Nachrichten tsecurity.de Certo Software warns that the capability, designed for convenience, can easily be used to spy on online activity.

    The post Security researchers find stalkers abusing Chrome’s sync feature appeared first on CyberScoop.

    ]]>         <![CDATA[NPM ecosystem hit with two new supply chain compromises]]> https://tsecurity.de/de/3671823/it-security-nachrichten/npm-ecosystem-hit-with-two-new-supply-chain-compromises/ https://tsecurity.de/de/3671823/it-security-nachrichten/npm-ecosystem-hit-with-two-new-supply-chain-compromises/ Wed, 15 Jul 2026 22:38:14 +0200 📰 IT Security Nachrichten tsecurity.de

    Attacks targeting developer ecosystems are increasing in frequency and sophistication, with Node.js developers firmly in this week’s crosshairs, as multiple npm packages belonging to the open-source AsyncAPI and Jscrambler Code Integrity were poisoned with malware following compromised development credentials.

    The incidents highlight the cascading effect of software supply chain attacks in which stolen credentials are then used to perpetrate additional compromises. Security researchers advise organizations to completely rebuild from clean images any developer machines that have installed a poisoned package — and to rotate all npm tokens, source control access, cloud credentials, CI/CD secrets, SSH keys, signing keys, and browser sessions.

    Affected packages include: jscrambler@8.14.0, jscrambler@8.16.0, jscrambler@8.17.0, jscrambler@8.18.0, jscrambler@8.20.0, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, @asyncapi/specs@6.11.2 and @asyncapi/specs@6.11.2-alpha.1.

    However, packages that list any of the above poisoned packages as dependencies may also be impacted, including those from the same projects, such as jscrambler-webpack-plugin 8.6.2, gulp-jscrambler 8.6.2, grunt-jscrambler 8.5.2, and jscrambler-metro-plugin 9.0.2.

    Vulnerable GitHub Actions workflow used as entry point

    The attack against AsyncAPI, an open-source reference specification and toolset for implementing event-driven architectures and asynchronous APIs, occurred on Tuesday and was independently detected by multiple security companies monitoring the npm registry, including Upwind, Socket.dev, Wiz, StepSecurity, and Aikido Security.

    According to the researchers’ analysis, attackers took advantage of a known configuration vulnerability in a GitHub Actions CI/CD workflow that had been reported in April. The flaw involves the pull_request_target event, which executes whenever a new pull request is made. When triggered, the workflow automatically checks out and executes the developer’s submitted pull request code in the Actions container, but this is done in the context of the base repository with full access to secrets.

    The AsyncAPI project had a proposed fix since May 17, but the fix had not yet gone through the full review and was not merged into the main branch.

    “At 05:08 UTC, the attacker opened PR #2155 containing a markdown file with obfuscated JavaScript hidden after approximately 1,000 bytes of whitespace,” researchers from Wiz explained in their report. “The payload was designed to scan the GitHub Actions runner’s environment for secrets and exfiltrate them to a dead-drop URL on the rentry.co pastebin.”

    When a GitHub Actions workflow is triggered and is executed in an environment, a temporary GITHUB_TOKEN is generated to allow for authenticated git commands against the repository. Other tokens might also be included.

    In this case, the attackers managed to obtain a token associated with asyncapi-bot, a service account that had access across the entire AsyncAPI organization on GitHub. This allowed them to perform malicious code commits in two separate repositories. Those commits then triggered automated build workflows that generated and published the npm packages.

    The payload bundled in the packages shares some similarities with a malware framework called Miasma that was used in previous supply chain compromises. However, the malware code appears to be significantly different from previously documented variants.

    The first-stage code downloads a secondary trojan payload that has variants for Linux, Windows, and macOS. This is a modular malware framework with credential theft capabilities that targets passwords and cookies saved inside browsers, SSH keys, npm and GitHub tokens, AWS credentials, macOS Keychain, and cryptocurrency wallets.

    The trojan communicated with a command-and-control server and can accept remote commands to perform file operations, list directories, and exfiltrate data.

    Jscrambler compromised via leaked npm credential

    The Jscrambler attack happened over the weekend on July 11 with attackers publishing multiple trojanized versions in two waves. Jscrambler Code Integrity is a client-side security library designed to protect JavaScript-based web and mobile applications against tampering and reverse engineering.

    Jscrambler published an advisory in response to the incident in which it clarified that the attackers published malicious versions of the package using a npm publishing credential. However, unlike the AsyncAPI case, how that credential was leaked in the first place is not clear.

    Initially the attackers released new package versions with two malicious scripts that get executed at install time using a preinstall hook in the configuration script. The scripts also execute platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated container.

    Because preinstall or postinstall hooks are common ways to deliver malware in npm packages, they are automatically checked by security tools. To avoid detection, the attackers pivoted to a method that involved injecting the malicious code directly in the dist/index.js and dist/bin/jscrambler.js files. This changed the malware execution from package installation time to when the package gets imported into other projects or the Jscrambler CLI is invoked.

    The embedded malware executables for different platforms are written in Rust and, according to Socket.dev’s analysis, were “a broad, developer-focused credential and secret harvester” that targeted browser-extension crypto wallets, API keys from AI coding assistants and MCP servers, cloud credentials for AWS, Azure and GCP, authentication tokens for messaging applications (such as Discord, Slack, and Telegram), password stores from browsers, Steam, and KDE.


    ]]>         <![CDATA[Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010]]> https://tsecurity.de/de/3671779/it-security-nachrichten/drupal-core-moderately-critical-information-disclosure-sa-core-2026-010/ https://tsecurity.de/de/3671779/it-security-nachrichten/drupal-core-moderately-critical-information-disclosure-sa-core-2026-010/ Wed, 15 Jul 2026 22:08:39 +0200 📰 IT Security Nachrichten tsecurity.de
    Project: 
    Drupal core
    Date: 
    2026-July-15
    Security risk: 
    Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon
    Vulnerability: 
    Information disclosure
    Affected versions: 
    <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*
    CVE IDs: 
    CVE-2026-15916
    Description: 

    The Image module allows you to define and configure image fields.

    The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

    This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

    Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.

    Solution: 

    Install the latest version:

    Drupal 11

    • If you use Drupal 11.4.x, update to Drupal 11.4.4.
    • If you use Drupal 11.3.x, update to Drupal 11.3.14.
    • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

    Drupal 10

    • If you use Drupal 10.6.x, update to Drupal 10.6.13.
    • Drupal 10.5.x and below are end-of-life and do not receive security coverage.

    Drupal 8 and Drupal 9 have both reached end-of-life.

    Reported By: 
    Fixed By: 
    Coordinated By: 
    ]]>         <![CDATA[Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011]]> =11.3.0 =11.4.0]]> https://tsecurity.de/de/3671778/it-security-nachrichten/drupal-core-moderately-critical-cross-site-scripting-sa-core-2026-011/ https://tsecurity.de/de/3671778/it-security-nachrichten/drupal-core-moderately-critical-cross-site-scripting-sa-core-2026-011/ Wed, 15 Jul 2026 22:08:38 +0200 📰 IT Security Nachrichten tsecurity.de
    Project: 
    Drupal core
    Date: 
    2026-July-15
    Security risk: 
    Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
    Vulnerability: 
    Cross-site scripting
    Affected versions: 
    >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*
    CVE IDs: 
    CVE-2026-15917
    Description: 

    Drupal core 11.2 and above integrate the HTMX JavaScript library.

    Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

    The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

    Solution: 

    Install the latest version:

    Drupal 11

    • If you use Drupal 11.4.x, update to Drupal 11.4.4.
    • If you use Drupal 11.3.x, update to Drupal 11.3.14.
    • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

    Drupal 10

    • Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.

    Drupal 8 and Drupal 9 have both reached end-of-life.

    Reported By: 
    Fixed By: 
    Coordinated By: 
    ]]>         <![CDATA[Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012]]> https://tsecurity.de/de/3671754/it-security-nachrichten/drupal-core-moderately-critical-cross-site-scripting-sa-core-2026-012/ https://tsecurity.de/de/3671754/it-security-nachrichten/drupal-core-moderately-critical-cross-site-scripting-sa-core-2026-012/ Wed, 15 Jul 2026 21:53:08 +0200 📰 IT Security Nachrichten tsecurity.de
    Project: 
    Drupal core
    Date: 
    2026-July-14
    Security risk: 
    Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
    Vulnerability: 
    Cross-site scripting
    Affected versions: 
    <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*
    CVE IDs: 
    CVE-2026-55805
    Description: 

    The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.

    This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

    Solution: 

    Install the latest version:

    Drupal 11

    • If you use Drupal 11.4.x, update to Drupal 11.4.4.
    • If you use Drupal 11.3.x, update to Drupal 11.3.14.
    • Drupal 11.2.x and below are end-of-life and do not receive security coverage.

    Drupal 10

    • If you use Drupal 10.6.x, update to Drupal 10.6.13.
    • Drupal 10.5.x and below are end-of-life and do not receive security coverage.

    Drupal 8 and Drupal 9 have both reached end-of-life.

    Reported By: 
    Fixed By: 
    Coordinated By: 
    ]]>         <![CDATA[IBM targets AI edge with Power server, software upgrades]]> https://tsecurity.de/de/3671628/it-security-nachrichten/ibm-targets-ai-edge-with-power-server-software-upgrades/ https://tsecurity.de/de/3671628/it-security-nachrichten/ibm-targets-ai-edge-with-power-server-software-upgrades/ Wed, 15 Jul 2026 20:37:53 +0200 📰 IT Security Nachrichten tsecurity.de

    IBM has bolstered its Power server portfolio with a new edge S1112 server and announced IBM Power Autonomous Operations, an AI agent that helps customers monitor Power systems and autonomously resolve issues to keep operations running smoothly. Additional software upgrades are aimed at helping customers deploy and manage AI infrastructure components. 

    “Each announcement addresses a different layer of the enterprise technology stack, from how infrastructure is deployed and managed to how applications are developed, modernized, and optimized,” wrote Brandon Pederson, senior IBM i product manager, in a blog post about the new products. “Together, they reinforce a broader direction for IBM Power of helping clients move from manually operated infrastructure toward intelligent, resilient, and AI-assisted systems that are easier to manage, easier to modernize, and ready for new workloads.” 

    The new IBM Power S1112 is a one‑socket Power11 server engineered for IBM i, AIX, and Linux. Aimed at distributed and edge locations, it is Big Blue’s new entry-level i server and is AI‑ready by design, integrating on‑chip Matrix Math Acceleration (MMA) for fast inferencing and other AI‑driven use cases, such as support for AI-assisted decisions, automation, and analytics close to where data is generated and consumed, Pederson stated.

    The server supports two configurations: a 10-core 3.05 to 4.0 Ghz Power11 Processor in a rack version only, and a 4-core 3.60 to 4.0 Ghz Power11 in rack and tower form factors, IBM stated.

    “For IBM i clients, Power S1112 is especially important because it expands what entry IBM i environments can do. IBM i P05 clients can run IBM i partitions within the P05 software tier while also using additional system resources for AIX, Linux, VIOS, AI, or open-source workloads on the same server,” Pederson wrote. “This creates a flexible path to consolidate workloads, improve utilization, and support modernization without forcing clients into a larger platform than they need.”

    width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

    Thomas Prior for IBM

    Announced: IBM Power Autonomous Operations

    On the software side, IBM Power Autonomous Operations offers automation capabilities via an embedded AI agent that offers natural language interactions designed to help customers manage, tune, and streamline their environments without relying on deep domain expertise for every task, Pederson stated.

    “IBM Power Autonomous Operations is designed to continuously monitor, optimize, protect, and manage Power environments. It combines Power telemetry, AI-powered analytics, automation, and operational workflows into a unified experience that helps IT teams reduce complexity, improve resiliency, and increase productivity,” Pederson wrote. 

    “Rather than simply showing operators what is happening, Power Autonomous Operations is designed to help teams decide what to do next. The platform analyzes system telemetry, identifies risks and optimization opportunities, and provides intelligent recommendations or automated actions to improve performance, resiliency, and operational efficiency,” Pederson wrote.

    Agentic Engine for IBM i

    IBM also issued a preview of the Agentic Engine for IBM i, which is aimed at providing greater AI support for Power systems. 

    IBM described the Agentic Engine as a new enablement layer designed to make it easier to adopt native and integrated AI agents into IBM i workloads and business processes. The engine provides the runtime, IBM i Knowledge Pack, observability, extensibility, MCP server, and foundational agents that help teams build trusted agents for IBM i without starting from scratch. Developers can build agents using their preferred coding tools, run them close to Db2 for i data under native IBM i object-level authority, and extend them into broader enterprise workflows through APIs and agent-to-agent integration.

    With security, governance, and instrumentation built in, the Agentic Engine for IBM i helps organizations manage agent behavior, monitor activity, and support responsible adoption across mission-critical environments, Pederson stated.

    IBM Bob Premium Package for i

    Also in the AI agent vein, IBM announced support for its Bob AI application development environment for the i system. The idea here is to help customers quickly modernize applications built on RPG and COBOL.

    “These capabilities help developers explain complex RPG and COBOL programs, convert Fixed-Format RPG to modern Free-Format RPG, refactor monolithic applications into modular structures, generate RPG, CL, COBOL and DDS code, create technical documentation, and produce unit tests to support validation,” Pederson wrote. “Rather than relying on generic prompts and inconsistent results, IBM i teams can use expert-built skills that deliver more predictable, repeatable and higher-quality outcomes. Agentic workflows help guide multi-step development tasks from understanding and planning through implementation and validation, allowing developers to modernize incrementally without losing control.”

    IBM also added new development features to the core operating system for i with IBM i 7.6 Technology Refresh 2 and i 7.5 Technology Refresh 8 that include a variety of features designed to enhance RPG and COBOL development, security, and hybrid cloud integration.

    IBM Power S1112 is expected to be generally available on July 24, IBM Power Autonomous Operations is expected to be generally available on September 23, 2026, and IBM Bob Premium Package for i was made generally available on June 24, 2026.

    ]]>         <![CDATA[Google Health is Down, So Your Fitbit Won’t Sync]]> https://tsecurity.de/de/3671338/it-nachrichten/google-health-is-down-so-your-fitbit-wont-sync/ https://tsecurity.de/de/3671338/it-nachrichten/google-health-is-down-so-your-fitbit-wont-sync/ Wed, 15 Jul 2026 18:33:49 +0200 📰 IT Nachrichten tsecurity.de Google Health is currently experiencing an outage, so if you have a Fitbit device or Pixel Watch and are wondering why it hasn’t synced or given you summaries, a Sleep Score, Readiness, or anything from the Google Health Coach, that would be why. The Google Health outage started this morning (July 15) and was confirmed...

    Read the original post: Google Health is Down, So Your Fitbit Won’t Sync

    ]]>         <![CDATA[OpenClaw becomes a nonprofit foundation as it seeks to be ‘the Switzerland of AI’]]> https://tsecurity.de/de/3671162/ai-nachrichten/openclaw-becomes-a-nonprofit-foundation-as-it-seeks-to-be-the-switzerland-of-ai/ https://tsecurity.de/de/3671162/ai-nachrichten/openclaw-becomes-a-nonprofit-foundation-as-it-seeks-to-be-the-switzerland-of-ai/ Wed, 15 Jul 2026 17:19:35 +0200 🔧 AI Nachrichten tsecurity.de

    OpenClaw’s announcement that it has become a nonprofit foundation is generating IT excitement because of the potential for governance and development consistency that the popular platform has thus far lacked. Still, some worry about the risks created by the move. 

    “Our ambition is for OpenClaw to be the Switzerland of AI. Neutral ground where every model and every lab can plug into the technology and collaborate on standards in the era of agents,” OpenClaw said in a post. “That work is already underway in Foundation-convened councils on agent identity, agent profiles, evals, and enterprise deployment.”

    The statement, co-authored by OpenClaw creator Peter Steinberger, pointed out, “the great open source projects of our time — Linux, Apache, Mozilla — endure because a neutral steward stands behind them. That is the role we are taking on to keep OpenClaw MIT licensed, open, and independent so that everyone building on it can trust it will be here for the long term.”

    But it reassured users that the original OpenClaw leadership is still in charge.

    “Peter built this thing and Peter keeps making the calls, especially the technical ones. Since joining OpenAI earlier this year, he has continued to steward OpenClaw as an open and independent project, and OpenAI has made a commitment to keep it that way,” the post said. “The foundation is here to serve: good governance, stable funding, and paying the people who keep the claws alive.”

    However, some analysts and consultants were skeptical about how much true independence Steinberger would have, given his salaried role with OpenAI. 

    Neutrality claim in question

    “The Switzerland of AI neutrality claim collapses under its own announcement,” said Noah Kenney, principal consultant at Digital 520. “OpenAI runs a team [at OpenAI] called Claw Labs that Peter leads and OpenAI is a major donor to OpenClaw. The ‘neutral steward’s’ chief technical decision maker is employed by one of the competing labs it is supposed to be neutral with.” To OpenAI, he said, OpenClaw is closer to a tax-exempt nonprofit subsidiary than it is to a neutral ‘Switzerland of AI.’

    He pointed out that, in addition, Microsoft is shipping the enterprise version of OpenClaw, and Nvidia is shipping the hardware bundle. “This is being called the Switzerland of AI, but Switzerland does not have its central bank run by France,” he observed.

    Kenney said that what the new OpenClaw has actually built is “a shared dependency that several competitors fund, staff, and steer, wrapped in a nonprofit structure. Enterprise IT should understand that structure, because treating OpenClaw as neutral is a mistake,” adding that CIOs need to look at this development devoid of the emotional component. 

    “There is a strategic irony here that CIOs should sit with,” Kenney said. “If OpenClaw succeeds at becoming the universal agent substrate, then every model plugs into the same identity layer, the same profiles, and the same deployment plumbing. The thing every vendor is racing to own becomes a commodity that nobody owns.” He pointed out that, in the short term, that is genuinely good news for buyers because it means less lock-in and more portability.

    “But,” he said, “when the connective tissue is free and natural, the only labs that benefit are the ones with the best models and the deepest distribution. Commoditize the layer below you and you compete on the layer where you are already strongest. The foundation is not a charity. It is the biggest players agreeing to stop fighting over the plumbing so they can fight over the water, and the enterprise is the one paying the water bill either way.”

    Good news, bad news

    Jason Andersen, principal analyst at Moor Insights & Strategy, liked the potential consistency that could emerge from the structural change, given the complexity of agent development today. 

    “We are seeing a lot of OpenClaw variants hit the market, such as those from Nvidia as well as competing products from cloud and SaaS vendors. A common base helps solidify the common parts,” Andersen noted. “That said, a common challenge is the sustainability of these open source foundations over time. In addition to releasing code, these foundations need funding to evolve and grow. And that funding needs to come from continued momentum to incentivize existing members to increase investment and recruit new members to join.”

    Andersen stressed that IT buyers need to keep an eye on the roadmap for any OpenClaw variant they choose to deploy, “as that will directly impact the foundation, and the momentum of the foundation and common base. If the common base loses momentum, it can lead to forks, or just a loss of innovation. When that happens, members tend to back away, which puts customers in limbo.”

    But not everyone sees the promised structure as entirely good for IT.

    Ishraq Khan, CEO at coding productivity tool vendor Kodezi, said, “most CIOs do not want to bet their future entirely on a single model vendor. They want Claude for some workloads, GPT for others, open models for sensitive environments, and potentially internally fine-tuned systems for specific use cases. The problem is that every vendor currently brings its own identity system, tool interfaces, permissions model, and operational assumptions. That fragmentation does not scale.”

    He said, “the risk if standards fail is straightforward: every vendor builds its own closed ecosystem, enterprises become locked into individual stacks, and security becomes dramatically harder. The opportunity if OpenClaw succeeds is equally significant: enterprises get portable agents, common identity standards, interoperable tooling, and a healthier competitive market around models rather than ecosystems.”

    Will it remain a nonprofit?

    However, said Justin Greis, CEO of consulting firm Acceligence, one of the key details that IT executives will want to keep in mind is that OpenAI also began as a nonprofit, but it was quickly seen as not adhering to nonprofit objectives. 

    “OpenAI’s transition from a nonprofit research organization into a more complex structure highlighted the challenge of maintaining mission alignment while scaling technology, capital, partnerships, and commercial operations,” Greis said. “OpenClaw has the opportunity to address some of those governance questions earlier by establishing clear principles around neutrality, transparency, and decision-making before the ecosystem becomes even larger and more valuable.”

    He noted, “we have seen this pattern before with technologies like Linux and Kubernetes. The strongest open ecosystems succeeded because they created trusted foundations that enterprises could build upon. The technology was important, but the governance model that underpinned it was equally critical.”

    Risks are ‘squarely in IT’s lap’

    Consultant Brian Levine, executive director of FormerGov, echoed Greis’ concerns. 

    “CIOs shouldn’t assume that this nonprofit will always be a nonprofit, or confuse being a nonprofit with actually being neutral or unbiased,” he said. “The risks are squarely in IT’s lap: autonomous agents ‘with their own identity’ acting on a user’s behalf blow straight through traditional IAM assumptions. Issues, such as agent identity, auditability, secret handling. Identity boundaries have not yet been reliably solved. Until they are, enterprises should treat OpenClaw agents like privileged service accounts, not like a browser plugin.”

    Independent cybersecurity and risk advisor Steven Eric Fisher pointed to another IT exposure that might come from this OpenClaw transition: Cost.

    “OpenClaw currently has a very high token burn rate in usage, which presents a significant cost consideration for large-scale enterprise adoption,” he said. “The skills marketplace introduces a new supply chain threat that enterprises will need to manage. Threat management, and specifically handling external marketplace elements, can be highly challenging for open-source operations. Ultimately, at scale, enterprise adoption could become a difficult balancing act between managing high operational costs and securing an expanded security surface.”

    This article originally appeared on Computerworld.

    ]]>         <![CDATA[From story points to tokenmaxxing: Why engineering keeps measuring the wrong things]]> https://tsecurity.de/de/3671158/ai-nachrichten/from-story-points-to-tokenmaxxing-why-engineering-keeps-measuring-the-wrong-things/ https://tsecurity.de/de/3671158/ai-nachrichten/from-story-points-to-tokenmaxxing-why-engineering-keeps-measuring-the-wrong-things/ Wed, 15 Jul 2026 17:19:30 +0200 🔧 AI Nachrichten tsecurity.de

    For decades, software engineering has been plagued by “productivity theater.” Every few years, the industry aligns around a new vanity metric — usually one that latches onto whatever technology happens to be in vogue at the time. For a discipline rooted in creativity and problem-solving, this is a poor way to demonstrate progress. Yet, we find ourselves in this position once again. The pattern is often the same: reach for something we can easily count, and in doing so, lose sight of what we are actually trying to achieve.

    Quantity over quality: the wrong measurement, every time

    I recall when I was coming up as a software engineer in the 1990s, a small number of companies took up the practice of paying their engineers by each line of code. This may have been productivity theater at its worst, leading to negative incentives, inefficient processes, and just generally bad engineering. Developers were rewarded for writing far more code than the problems they were facing required — classic “quantity over quality” — and the result was bloated, brittle codebases that were all but impossible to maintain. The goal — to create reliable software that solved real user problems — got buried under the incentive to produce.

    Then in the 2000s, the rise of Agile brought us story points, an abstract way to estimate task complexity, effort, and risk relative to other work. Rather than answering “How long will this take?,” story points were meant to answer, “How big is this compared to what we’ve done before?” This approach sounds good in theory, but in practice, some development teams learned to game the system by inflating estimates, over-engineering solutions to look productive, and losing sight of whether the work they produced actually created value. Once again, the metric became the goal, and the actual goal — delivering outcomes that mattered to the business — became secondary.

    Every one of these metrics failed for the same reason: they measured effort instead of value.

    Quantity in the age of AI

    Today, “tokenmaxxing,” a trend in which developers and teams optimize for consuming as many AI model tokens as possible, treats raw consumption as an equivalent for output. As I see it, this is the latest flawed productivity metric to make its way into the world of software engineering. Tokenmaxxing is nothing more than another vanity metric, and is just as useless as using “lines of code” or inflated “story points” as a benchmark.

    Tokenmaxxing is the result of a few different behaviors, including:

    • Prompt flooding: stuffing massive codebases, documentation, and context into every prompt, burning tokens on context the model doesn’t actually need.
    • Agent swarms: running multiple AI agents in parallel to maximize code output, regardless of whether the work is coordinated or coherent.
    • Background loops: keeping AI sessions or agents running continuously in the background, racking up token spend without clear ownership of what is being produced — or why.


    Now, it is no secret that AI is reshaping how software is developed, and these behaviors are the result of that reshaping. Providing AI with codebases, running multiple agents at once, and even relying on coding assistants for help all have their uses. But when we lose control of the changes we are making and why we are making them, we find ourselves facing a new version of the same old problem: measuring engineering productivity with the wrong metrics.

    A more useful question to ask isn’t, “How many tokens did we spend?” but rather, “What problem did we actually solve, and for whom?”

    Spending resources without goals

    Yes, AI is giving software engineers the ability to do more with less, to move quickly, and to experiment in ways that were previously out of reach. But leaning on AI to perform productivity, rather than deliver it, is a trap that will cost us in code quality, team capability, and business credibility.

    As a CTO, I am all for experimenting with AI. I want to use it to make our programs better, stronger, and future-proof. What I don’t want is for it to drive us toward excess while leaving us with little to show for it.

    The test I keep coming back to is simple: does this AI-generated output help us ship something that matters? Does it reduce friction for a user, close a gap in a workflow, or improve reliability for a customer? If the answer isn’t clear, then we are spending resources — both human and computational — without a defined goal. And that is not engineering. That is activity.

    Spec-driven development: where value gets defined

    It is time to adopt newer approaches like spec-driven development, a method where engineers write detailed specifications first and AI generates code against them. Rather than relying on prompt flooding and agent swarms and hoping AI produces the best result, we need to shift toward defining requirements, reviewing AI-generated output, and orchestrating systems with intent.

    But spec-driven development is more than a methodology. It is the place where engineering intent and business value get defined together. The spec is where you answer, “Why does this matter, and what problem are we solving?” before a single token gets spent.

    Software engineers have long taken pride in writing elegant code, and I would hate to see AI cheapen that pride rather than elevate it. In an AI-first world, the craft shouldn’t disappear; it should simply move upstream. The spec is where elegance lives now, and it deserves the same attention to detail we once reserved for the code itself.

    At its core, software engineering is about defining, analyzing, and resolving technical challenges. If we are willingly giving all of that up to AI, we will lose the integrity of our discipline and the ability to prove our value. Using the maximum number of tokens to produce code isn’t impressive. Using a well-crafted, intentional prompt to solve a specific problem? That’s the work worth celebrating.

    Stop performing productivity and start delivering it

    We are at an inflection point. Many organizations are defaulting to activity-based metrics, measuring how much AI is being used rather than whether it is improving delivery, product quality, or business outcomes.

    The question worth asking is not, “How much AI did we use this sprint?” It is “What value did we deliver for our users, our team, or our business?” Was it the ability to resolve a critical bug more quickly? Reduced cycle time on a high-value feature? A customer workflow that now takes minutes instead of hours? Those are outcomes. Those are the things worth measuring.

    AI can help us deliver meaningful outcomes faster, but only if we use it with the same rigor and intent we expect from every other engineering or business decision. Don’t let it become another form of productivity theater. The most successful engineering organizations in the age of AI won’t be the ones that consumed the most tokens, they’ll be the organizations that never lost sight of why they were building in the first place.

    —

    New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

    ]]>         <![CDATA[LankeOS — A fully independent Linux distro built from scratch with a custom C++20 atomic package manager, Linux 7.1.1, and pure Wayland. Come vote for it on DistroWatch!]]> https://tsecurity.de/de/3670775/linux-tipps/lankeos-a-fully-independent-linux-distro-built-from-scratch-with-a-custom-c-20-atomic-package-manager-linux-711-and-pure-wayland-come-vote-for-it-on-distrowatch/ https://tsecurity.de/de/3670775/linux-tipps/lankeos-a-fully-independent-linux-distro-built-from-scratch-with-a-custom-c-20-atomic-package-manager-linux-711-and-pure-wayland-come-vote-for-it-on-distrowatch/ Wed, 15 Jul 2026 15:11:50 +0200 🐧 Linux Tipps tsecurity.de

    Hi everyone,

    I’ve been working on a fully independent Linux distribution for the past 5 months – no Debian/Arch/Fedora base, everything built from upstream source using my own toolchain.

    Now I think it brings something genuinely new to the table.

    Here is LankeOS, a fully independent Linux distribution built from scratch by a solo developer. If you're tired of "just another Ubuntu/Debian/Arch derivative," this one is genuinely different.

    What makes LankeOS special

    1. Custom package manager — lpkg (written in C++20)

    This is the centerpiece. lpkg is a from-scratch package manager with a WAL atomic transaction system — meaning it can survive power loss mid-install without breaking your system. It includes:

    - ELF DT_NEEDED verification — validates every shared library dependency against the repo before installing. No "missing .so" surprises.

    - Ctrl+C handling — the signal waits for current operation + rollback.

    - 410+ regression tests — including simulated power-loss recovery scenarios.

    - Aggregated index format — compact single-file index with all version/hash/dep info per package.

    - Static build support — one binary, runs anywhere.

    - Package transaction system with WAL-based logging, atomic commit, and rollback support — bringing database-style reliability to traditional mutable Linux package management.

    - .lpkg format = tar.zst + embedded metadata.json + content/ + hooks/

    1. Not a derivative — built from LFS methodology

    LankeOS is not based on Debian, Arch, Fedora, or any existing distro. Every one of its 284 packages is built from upstream source using its own LankeBUILD system. This is a true independent distribution.

    It supports modern hardware and runs perfectly on my Dell OptiPlex 5000 Micro.

    1. Modern (bleeding edge) software stack

    - Linux Kernel 7.1.1

    - GCC 16.1.1, LLVM/Clang 22.1, glibc 2.42

    - systemd 257.8

    - Wayland desktop via niri

    - PipeWire audio stack, Mesa graphics

    - Firefox, WebKitGTK, GTK3/4

    - OpenJDK 25, Node.js, Go, Rust 1.96, Ruby 4.0, Python 3 out of the box

    - mihomo proxy, fcitx5 Chinese input with CJK fonts

    1. Incredibly lean and fast

    - ~4 second boot from power-on to desktop in qemu

    - Runs on as little as 400-500 MiB RAM

    - toram kernel parameter copies the entire system to RAM for fully disk-less operation

    - OverlayFS-based persistent storage via LABEL=LANKE_DATA partition

    1. Smart initramfs with version-aware upgrades

    The init script detects version mismatches between the base file and the upper paritition, automatically enters a "live upgrade mode," and notifies the user. Built-in installer (lanke_install) handles GPT formatting, copying, and GRUB setup in one guided flow.

    Why LankeOS?

    LankeOS is built around three principles:

    ### 1. Engineering first

    Instead of focusing on visual customization or superficial changes, LankeOS focuses on the underlying engineering of a Linux distribution.

    It provides its own:

    - build system (LankeBUILD)

    - package manager (lpkg)

    - package format

    - repository infrastructure

    - init and upgrade logic

    Every component exists because it solves a real system engineering problem.

    ### 2. High technical density

    LankeOS aims to provide a complete development and daily-use environment while keeping the system lightweight.

    A single installation image includes:

    - complete C/C++/Rust/Python/Go/Java development toolchains

    - modern graphics stack (Wayland, Mesa, Vulkan)

    - multimedia support (PipeWire, FFmpeg)

    - desktop applications (Firefox, mpv, etc.)

    - package management and system development tools

    The goal is not to minimize the number of packages, but to maximize the amount of usable capability per byte.

    ### 3. Stability through controlled complexity

    Although LankeOS follows a rolling-release model and uses recent upstream software, stability is achieved through strict integration testing.

    Every release is tested on real hardware, not only virtual machines.

    The development process includes:

    - reproducible package builds

    - dependency verification

    - regression tests

    - transaction-safe package operations

    - real hardware validation

    LankeOS is designed for users who want the flexibility of a lightweight distribution without sacrificing reliability.

    It is not another customized Linux image.

    It is an experiment in building a complete Linux distribution from the foundations up:

    a system where every layer can be understood, rebuilt, and improved.

    Links

    - GitHub: github.com/Wtada233/LankeOS

    - Package repo: lankerepo.wtada233.top/x86_64

    - Official site: lankeos.wtada233.top

    - DistroWatch: https://distrowatch.com/dwres.php?waitingdistro=1104&resource=links#new

    TL;DR: LankeOS is what happens when someone reads LFS anre distro around this" — with a crash-proof C++20 package

    manager, Linux 7.1.1, Wayland+Xwayland, 284 hand-built packages and a size of 1.24GiB. Go give it a vote on DistroWatch.

    submitted by /u/Wtada233
    [link] [comments]]]>         <![CDATA[CVE-2024-23684 | com.upokecenter.cbor up to 4.5.1 DecodeFromBytes algorithmic complexity (GHSA-fj2w-wfgv-mwq6 / EUVD-2024-0367)]]> https://tsecurity.de/de/3670625/sicherheitsluecken/cve-2024-23684-comupokecentercbor-up-to-451-decodefrombytes-algorithmic-complexity-ghsa-fj2w-wfgv-mwq6-euvd-2024-0367/ https://tsecurity.de/de/3670625/sicherheitsluecken/cve-2024-23684-comupokecentercbor-up-to-451-decodefrombytes-algorithmic-complexity-ghsa-fj2w-wfgv-mwq6-euvd-2024-0367/ Wed, 15 Jul 2026 14:24:43 +0200 🕵️ Sicherheitslücken tsecurity.de problematic, was found in com.upokecenter.cbor up to 4.5.1. This affects the function DecodeFromBytes. Executing a manipulation can lead to inefficient algorithmic complexity. This vulnerability appears as CVE-2024-23684. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.]]> <![CDATA[Chrome Sync increasingly abused to stalk unsuspecting victims]]> https://tsecurity.de/de/3670343/it-security-nachrichten/chrome-sync-increasingly-abused-to-stalk-unsuspecting-victims/ https://tsecurity.de/de/3670343/it-security-nachrichten/chrome-sync-increasingly-abused-to-stalk-unsuspecting-victims/ Wed, 15 Jul 2026 12:39:10 +0200 📰 IT Security Nachrichten tsecurity.de Cyberstalkers are increasingly exploiting Google Chrome's built-in synchronization feature to secretly monitor victims' web activity without installing spyware or compromising their devices. Security firm Certo says it has received a growing number of reports involving the tactic, which relies on briefly accessing a victim's device and signing in to Chrome with an attacker-controlled Google account. …

    The post Chrome Sync increasingly abused to stalk unsuspecting victims appeared first on CyberInsider.

    ]]>         <![CDATA[Apple Drops New AirPods Public Beta Just One Day After iOS 27]]> https://tsecurity.de/de/3670267/ios-mac-os/apple-drops-new-airpods-public-beta-just-one-day-after-ios-27/ https://tsecurity.de/de/3670267/ios-mac-os/apple-drops-new-airpods-public-beta-just-one-day-after-ios-27/ Wed, 15 Jul 2026 12:10:01 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[5 ways for CIOs to avoid AI bill shock]]> https://tsecurity.de/de/3670246/it-security-nachrichten/5-ways-for-cios-to-avoid-ai-bill-shock/ https://tsecurity.de/de/3670246/it-security-nachrichten/5-ways-for-cios-to-avoid-ai-bill-shock/ Wed, 15 Jul 2026 12:08:37 +0200 📰 IT Security Nachrichten tsecurity.de

    Gen AI spending is moving beyond the familiar software model of seats, licenses, and pilots. As AI shifts from copilots to embedded workflows and autonomous agents, one user request can trigger multiple model calls, retrieval steps, retries, orchestration layers, and infrastructure events. A tool that looks affordable in pilot may behave very differently once connected to production systems or allowed to act with less human supervision.

    According to Michael Corrigan, CIO of World Insurance Associates, AI introduces a fundamentally different cost model — one that’s usage driven, non-linear, and tightly coupled to business activity. “Success requires shifting from traditional IT budgeting to FinOps-style discipline where consumption, value, and governance are actively managed in real time,” he says.

    Here are five ways CIOs can build that discipline before AI costs spiral.

    Forecast AI by workflow, not by user

    At World, a top 25 insurance broker with about 3,000 employees across roughly 300 locations, AI use falls into three broad categories, Corrigan says. One is broad tools, such as copilots. Another is embedded AI inside SaaS platforms. And the third is bespoke AI built around specific workflows and manual processes.

    “The bespoke is the area that’s growing the most right now,” he says. “And that’s where the model, from a cost perspective, has really been shifting from a license seat cost to a token consumption or token burn cost, or even a hybrid.”

    width="1240" height="827" sizes="auto, (max-width: 1240px) 100vw, 1240px">

    Michael Corrigan, CIO, World Insurance Associates

    WIA

    Seat-based pricing is relatively easy to forecast whereas consumption-based AI isn’t. Costs may depend on prompt complexity, output length, model choice, workflow design, and whether the system calls a model once or many times in the background.

    World tries to manage that uncertainty by defining the business problem, success criteria, and expected operational improvement upfront. Pilots help estimate consumption before scaling, but Corrigan says they don’t remove the ambiguity.

    “We’ll try our best in the pilot to understand what the consumption rate is, what the token burn rate is,” he says. But once a consumption-based workflow goes into production, he adds, an estimate is put into place. That estimate is informed, but still rough.

    Elmer Morales, founder and CEO of koder.com, an agentic AI coding startup, says CIOs should think less about headcount and more about workflow mechanics. Agentic AI costs are driven by the number of decisions an agent makes, how often it retrieves external data, how much context it carries, and how many systems it touches.

    “CIOs should start by mapping workflows, not necessarily users,” he says. “The relevant variable isn’t going to be the headcount but how many decisions an agent makes per task.”

    Model the failure path, not just the happy path

    Pilots can mislead because they often test the cleanest version of an AI workflow. Morales says many enterprises model agentic AI costs around the happy path: the user gives a clear prompt, the system understands the request, the agent completes the task, and the process ends. Production is messier.

    “They generally don’t model for situations where the agent is going to need to go back and check its work and redo things,” Morales says. “A lot of times, agents are wrong, either because they hallucinate or they understood the problem incorrectly.”

    In an agentic workflow, the system may check its work, call another tool, retrieve more data, or redo a step. While that may improve quality, it also adds cost.

    width="1240" height="827" sizes="auto, (max-width: 1240px) 100vw, 1240px">

    Elmer Morales, founder and CEO, koder.com

    koder.com

    The difference between copilots and agents is central. A copilot interaction is often one prompt and one response. An agentic workflow may involve agents moving through a decision tree, executing tasks in sequence or in parallel, and calling sub-agents or external systems along the way. “By the time it’s achieved the original goal, the agent might have made 50 or 100 model calls, compared with a single call for a traditional copilot prompt,” Morales says.

    That’s why CIOs should require teams to model the failure path before production, like how many retries are allowed, how much context is resent, which tools can be called, when a human should intervene, and what happens when the agent can’t complete the task.

    Build cost controls into the architecture

    Traditional FinOps practices still matter, but AI requires more than retrospective dashboards and chargebacks.

    According to Pavan Madduri, senior cloud platform engineer at industrial supply company Graigner, looking backward at usage data, as traditional FinOps often does, can be too late. Costs are shaped by prompt design, model selection, agent behavior, orchestration choices, and runtime loops.

    “Dashboards or chargebacks, those are historical accounting,” he says. “The money’s already gone.” For AI, he argues, cost controls need to be embedded into the architecture. That includes hard token caps, retry-depth limits, maximum runtime limits, workload prioritization, background-job throttling, and cluster-level controls that prevent runaway consumption.

    “The real FinOps means you need to have the cost constraints embedded into your architecture framework,” Madduri says.

    Those controls also extend to infrastructure. Expensive GPUs may sit warm between jobs because systems need capacity available when inference demand arrives. Teams may pass huge schemas, databases, or thousands of lines of code into frontier models when a smaller or more focused prompt would do.

    width="1240" height="828" sizes="auto, (max-width: 1240px) 100vw, 1240px">

    Pavan Madduri, senior cloud platform engineer, Graigner

    Graigner

    Enterprises should also adopt event-driven autoscaling, Madduri says. “Use tools like KEDA to scale GPU nodes down to zero the moment inference demand drops, so teams only pay for the windows when the silicon is actively crunching tokens.”

    Corrigan says World uses rate limits, spend limits, alerts, and approval gateways for consumption-based tools. When users approach token consumption limits, automated alerts allow IT and the business to review whether the continued spend is justified.

    “If it’s not meeting the success criteria we expected, you have to have the control in place to say we’re going to move on or kill that process,” Corrigan says.

    Route work to the right model

    CIOs can also reduce AI bill shock by avoiding a default assumption that every task requires the most powerful model available. While some tasks need advanced reasoning, many others don’t. A simple support ticket, log-parsing task, or structured database transaction may be handled by a smaller or cheaper model. A complex architecture decision, legal analysis, or multi-step reasoning task may justify a more powerful one.

    “Choosing the right model for the right prompt and right question — that’s where you leverage the maximum from that model, and you can decrease the costing,” Madduri says. “If you default every single call to a frontier model, that’s architectural laziness.”

    Morales makes a similar point. Not every step in an agentic workflow requires a top-of-the-line model. Model routing, he says, is the discipline of determining the best model for the task, and providing the relevant context when the model needs it.

    According to Jim Olsen, CTO of enterprise software company ModelOp, CIOs should use the least expensive model that can accomplish the business goal. Using the biggest model for everything is easier, but expensive. “It’s like hiring the most expensive engineer to change a few colors in a website’s CSS, or visual styling,” he says. “You wouldn’t do that. You use the appropriate tools for the task.”

    Tie consumption to business value

    For Olsen, the deeper enterprise problem is AI value shock, not just bill shock. Spending $200,000 in a quarter on AI is justified if it produces $2 million in business value. The problem is spending heavily on use cases that don’t generate a meaningful return.

    “Are you actually getting that return on investment, or are you just blowing tokens for something that’s not delivering the value to your business?” Olsen asks. Tracking token usage by user or department may show who consumed AI, but not whether the consumption mattered.

    width="1240" height="827" sizes="auto, (max-width: 1240px) 100vw, 1240px">

    Jim Olsen, CTO, ModelOp

    ModelOp

    For most enterprise AI systems, Olsen says costs should be tied back to business use cases. A model may be used for HR document search, customer support, code review, problem resolution, or other functions. Each use case may draw on the same underlying models or agents, but the business value can be very different.

    That’s why he argues that companies need an AI inventory, a record of which business workflows use which models, agents, providers, workflows, and systems. Without that inventory, enterprises can’t connect consumption to value.

    Corrigan takes a similar approach from a governance perspective. At World, new AI ideas go through an intake process. Business users propose improvements, and IT, finance, operations, sales, and business stakeholders evaluate, prioritize, and monitor them from pilot through production.

    That may be where the next stage of AI FinOps is heading, toward a clearer understanding of which AI consumption deserves to scale, not just to lower bills. So the question, as Olsen puts it, isn’t whether someone used a million tokens. It’s what are they using them for.

    ]]>         <![CDATA[5 wild ways to make Android widgets more useful]]> https://tsecurity.de/de/3670233/it-nachrichten/5-wild-ways-to-make-android-widgets-more-useful/ https://tsecurity.de/de/3670233/it-nachrichten/5-wild-ways-to-make-android-widgets-more-useful/ Wed, 15 Jul 2026 12:03:24 +0200 📰 IT Nachrichten tsecurity.de

    Widgets, widgets, widgets. Has there ever been an Android feature so full of promise that went unloved by Google for so very long?

    Okay, so maybe there has been — erm, lots of times, actually. But even so, Android’s widgets system is a perfect example of an exceptional advantage that Google basically buried, abandoned, and left on the brink of extinction up until its overdue revival in 2021’s Android 12 update. (And that revival, by the way, happened for no apparent reason whatsoever. Just a totally random, unprompted change of heart after a decade of indifference. Riiiiiiiiight.)

    Google may have given up on widgets for a while, but the good news is that (a) they’re back, baby — still now, more than ever, even in our overly AI-obsessed 2026 timeline — and (b) the Android developer community keeps chuggin’ along and coming up with ever-more creative new ways to embrace widgets beyond what Google itself sees fit to give us. That means no matter what Android version your favorite phone is running, you can step up your own Android widget game and give yourself some fresh and fruitful paths to make the most of your phone’s framework.

    Here, my dear, are some fantastic beyond-the-basics ways to put your favorite Android widgets to use and change the way you get stuff done on your phone. 

    [Psst: Love learning new things? Get my free Android Intelligence newsletter to get a tasty new tip in your inbox every Friday.]

    Android widget enhancement #1: The on-demand home screen pop-up

    Widgets are a wonderful way to interact with all sorts of info without ever having to open up apps, but having too many widgets can quickly lead to a cluttered and overwhelming home screen.

    Well, here’s a neat way to give yourself the benefit of a widget while still maintaining a neat and minimal space for working: An excellent app called Popup Widget lets you create an on-demand pop-up widget (get it?!) that looks like a regular ol’ icon on your home screen but then loads any widget you want when tapped.

    See?

    Android widgets: Popup Widget (1)
    Any widget, anytime — with Popup Widget on Android.

    JR Raphael, Foundry

    You can even get really wild and set up a single icon that opens multiple widgets at the same time — like your inbox and your calendar together:

    Android widgets: Popup Widget (2)
    Popup Widget can even let you summon two widgets together with a single tap.

    JR Raphael, Foundry

    Not bad, right?

    Popup Widget costs two bucks and doesn’t require any special permissions or manners of access. And it’s pretty simple and self-explanatory to set up: Once you install and open the app, it’ll walk you through adding in whatever pop-up widgets you want. You can choose the name and even the icon associated with each one along with its precise placement on your screen and how much the screen behind it should dim when it’s loaded.

    The app will offer to add the shortcut directly onto your home screen for you then, or you can also find all of your Popup Widget creations by pressing and holding the main Popup Widget icon in your app drawer.

    Alternatively, if you’re already using a custom Android launcher like Smart Launcher or Niagara, you can find similar options for summoning widgets on demand within their settings — no separate apps even required.

    And that, my widget-loving wallaby, is but our first winning widget possibility.

    Android widget enhancement #2: The on-demand universal pop-up

    If you like the idea of having a widget on demand but would rather have it be available to summon from anywhere instead of just from your home screen, this next wacky widget option is just the thing for you.

    It comes from a spectacular app called Edge Gestures, which works in conjunction with Popup Widget to take that same concept and make it universally accessible. (I told ya it was wacky!)

    When you first install Edge Gestures, the app will prompt you to enable it as a system accessibility service and to grant it the ability to display over other apps. These permissions sound scary — and they should! — but in the case of this specific utility, they’re absolutely appropriate and necessary in order for it to operate. The former is the only way an app is able to create a custom system-wide gesture, which we need for this setup to work its magic, and the latter is how your widget is able to be shown on top of whatever else you’re doing.

    (If you’re at all worried, note that Edge Gestures doesn’t request any other significant system permissions. Beyond that, it’s reputable, it’s been around for quite a long while, and it has a large number of overwhelmingly positive reviews.)

    Where were we? Oh, right: Once you’re inside the Edge Gestures configuration area, you’ll be able to select exactly what gesture you want to use for pulling up your widget. I’d think carefully about finding something that won’t interfere with anything else, like the system-level Android gestures, and that’ll be convenient to access without being a command you’re likely to trigger by mistake.

    So, for instance, you might make the gesture a simple swipe downward along the left side of your screen. To do that, you’d find the “Swipe down” option within the app’s “Left” tab, and you’d set it to “Popup Widget” — and then create or select whatever Popup Widget item you want. And remember: You can select one widget or multiple widgets, too.

    Prepare yourself for some serious oohing and ahhing:

    Android widgets: Edge Gestures
    Your favorite widgets are never more than a swipe away with Edge Gestures on Android.

    JR Raphael, Foundry

    As you can see, this opens up a whole new world of mobile multitasking potential. I mean, really: How could you not love that?!

    The final thing worth doing is going into all the other gesture options in that same configuration area and tapping “Clear” for each of ’em to get rid of Edge Gestures’ default actions. I’d also go into whichever side of the screen you aren’t using — left or right — and tap the toggle to turn the gestures for that side off entirely. That way, you won’t inadvertently activate any gestures that you don’t actually want or need.

    Edge Gestures costs $2 to use.

    Android widget enhancement #3: The physical key call

    Next, here’s an interesting twist on that same on-demand Android widget idea: You can make any widget especially easy to access from anywhere without even having to mess around with any on-screen swiping by setting one of your phone’s physical keys as a trigger for the widget’s appearance.

    I’ll give you a second to catch your breath and process the sheer splendor of that sorcery.

    Back? Cool. So, the key to this feat (har har) is the combination of the aforementioned Popup Widget and a handy Android contraption called Key Mapper — which makes it easy to map your phone’s physical keys to all kinds of crazy custom actions.

    In this case, we’ll set it up so that pressing and holding one of your volume keys causes whatever widget you want to be summoned, like so:

    Floating Android widget
    Yes, your volume key can cause a widget to appear (whoa!).

    JR Raphael, Foundry

    Pretty nifty, no?

    I’ve got step-by-step instructions for making this happen in this separate guide.

    Android widget enhancement #4: The floating bubble

    If you like the notion of having a widget always available but aren’t so keen on the hidden gesture concept, an app called Overlays will let you create a small floating bubble that you can position anywhere on your screen and then tap to pull any widget up when you want it — just like with Android’s recently revived Bubbles multitasking system, only compatible with any Android device and version and with the simplicity of a widget instead of the complexity of an entire app.

    Check it out:

    Android widgets: Overlays
    Overlays puts a floating icon on your screen for easy ongoing widget access.

    JR Raphael, Foundry

    By default, Overlays gives you a bunch of its own little widgets to choose from, but the real power comes from adding in widgets from the Android apps you actually rely on. To do that, tap the “Triggers” tab at the bottom of the Overlays configuration area, then tap the red plus button in the lower-right corner of the screen. Select “Manual,” then type in whatever name you want for your widget and tap the icon to pick any icon you like.

    Tap “Save,” then select “Widget” and find the widget you want from the list. At that point, you’ll see a preview of the widget. Move or resize it if you like, then hit the arrow in the upper-left corner of the screen to exit out of that interface. Last but not least, tap the name of your newly made widget on the screen that comes up next to change its status to “Always on.”

    As soon as you head out of the app and back to your home screen, your fancy new widget should pop right up. All you’ve gotta do is tap the little downward-facing arrow in its corner to minimize it down to a bubble, which you can then press and hold to move anywhere your widget-worshipping heart desires.

    Overlays can also create widgets that automatically appear based on context — so you could have something show up every time you connect to a certain Bluetooth device or Wi-Fi network, for instance. To explore those options, just follow the same steps from above but pick “Event” instead of “Manual” when you reach the “Triggers” tab configuration.

    Overlays is free with an optional $4 in-app upgrade that removes some ads from the configuration tool and unlocks a handful of advanced features.

    Android widget enhancement #5: The widget stack

    Last but not least in our collection of wacky Android widget possibilities is one of my favorite widget wonders — and that’s the ability to stack multiple widgets and then swipe between ’em on your home screen without having ’em take up any extra space.

    Check it out:

    Android widgets: Smart Launcher stacked widgets
    The space-saving simplicity of stacked widgets, as seen in Smart Launcher.

    JR Raphael, Foundry

    This enhancement presents a bit of a choose-your-own-adventure-style path:

    First, if you’re using a reasonably recent Samsung Galaxy gizmo, the option is should already be present and available in your standard Samsung home screen setup. Just press and hold any open space on your home screen and then select the option to add a widget — then, once the widget is added, press and hold it and look for the “Create stack” command.

    With any other Android gadget — or even with a Samsung device, if you want extra options and flexibility — you can use a custom Android launcher like the aforementioned Smart Launcher or Niagara as well as the retro-geeky T9-themed Key Launcher I introduced to you earlier this summer.

    Those launchers replace your phone’s entire home screen environment and give you all sorts of interesting new possibilities for optimizing your interface and making it especially well-suited for you. And the stacked widget feature is just one small sliver of what they offer and how they’ll transform your Android experience.

    Android widgets: Smart Launcher stacked widgets setup
    The setup interface for a widget stack within Smart Launcher.

    JR Raphael, Foundry

    So there ya have it: five wacky, wild, wonderful ways to make widgets even more wow-inducing. Some days, you’ve just gotta love Android and the endless customization, control, and power it provides.

    Put even more Googley goodness in your noggin with my free Android Intelligence newsletter — one exceptional new thing to try every Friday!

    ]]>         <![CDATA[CVE-2024-21909 | CBOR up to 4.5.0 DecodeFromBytes algorithmic complexity (EUVD-2022-0486)]]> https://tsecurity.de/de/3670051/sicherheitsluecken/cve-2024-21909-cbor-up-to-450-decodefrombytes-algorithmic-complexity-euvd-2022-0486/ https://tsecurity.de/de/3670051/sicherheitsluecken/cve-2024-21909-cbor-up-to-450-decodefrombytes-algorithmic-complexity-euvd-2022-0486/ Wed, 15 Jul 2026 10:39:12 +0200 🕵️ Sicherheitslücken tsecurity.de problematic has been found in CBOR up to 4.5.0. The impacted element is the function DecodeFromBytes. This manipulation causes inefficient algorithmic complexity. The identification of this vulnerability is CVE-2024-21909. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.]]> <![CDATA[Patch Tuesday - July 2026]]> https://tsecurity.de/de/3669204/it-security-nachrichten/patch-tuesday-july-2026/ https://tsecurity.de/de/3669204/it-security-nachrichten/patch-tuesday-july-2026/ Wed, 15 Jul 2026 00:23:40 +0200 📰 IT Security Nachrichten tsecurity.de Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as public disclosure for one other. As usual, browser vulns are not included in the Patch Tuesday count above. Rapid7 noted last month that Microsoft no longer enumerates Chromium CVEs in the Security Update Guide. However, Microsoft has now taken the pursuit of minimalism much further, since today’s Security Update Guide no longer lists out even Microsoft vulnerabilities! Instead, we now receive a summary table of vulnerability counts by product family, as well as a new slimline “Notable CVEs” section. All of this only serves to illustrate the recent industry-wide trend of exploding vulnerability report counts, with an associated uptick in the publication of remediations as a trailing indicator.

    SharePoint: critical auth bypass by Rapid7

    Today sees the publication of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published today in coordination with Microsoft, this vulnerability is the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. As the full Rapid7 blog post sets out, the second vulnerability in the full RCE chain remains embargoed for now, with Microsoft expected to publish patches for that second vulnerability as part of Patch Tuesday August 2026. Microsoft noted: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”

    SharePoint: zero-day EoP

    It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low CVSS v3 base score (5.3) may be an imperfect signal concealing something much spicier, and Microsoft acknowledges that possibility by assigning a severity rating of Important. Microsoft certainly intended to list CVE-2026-56164 in the new Notable CVEs section of the Security Update Guide instead of erroneously listing CVE-2026-56155 twice, and it’s likely that this will be corrected shortly.

    What’s the opposite of coordinated disclosure?

    After years of relative stability, the Patch Tuesday process has experienced significant turbulence so far in 2026. As well as the AI-fuelled exponential growth of vulnerability reporting and discovery, Microsoft is grappling with the emergence of a series of vulnerabilities disclosed in such a way as to bring maximum discomfort for Redmond. Pseudonymous researcher Nightmare Eclipse dropped another Defender elevation of privilege vulnerability in the hours following Patch Tuesday June 2026, which Microsoft subsequently published and patched as CVE-2026-50656, along with a terse acknowledgement of the vulnerability’s celebrity nickname of RoguePlanet. Recently, Nightmare Eclipse has given conflicting estimates of what sort of surprises Microsoft can expect today, as well as claiming that the CVE-2026-50656 patches introduce a new avenue for a disk exhaustion attack. Today,  a new proof of concept for a further vulnerability nicknamed LegacyHive has emerged from the same source, which appears to allow a non-privileged user to mount another user’s user hive.

    Microsoft BitLocker receives patches today for a publicly-known security feature bypass vulnerability. The advisory for CVE-2026-50661 explains that an unauthorized attacker with physical access to the target machine can bypass Windows BitLocker. While Microsoft doesn’t confirm either way, it’s very probable that this is a patch for the GreatXML vulnerability which Nightmare Eclipse announced the day after Patch Tuesday June 2026.

    Active Directory Federation Services: zero-day EoP

    Active Directory administrators should note the emergence today of CVE-2026-56155, an exploited-in-the-wild elevation of privilege vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally. Eight other vulnerabilities are also published today in Active Directory Federation Services, all ranked as Important on Microsoft’s proprietary severity ranking scale. The advisory doesn’t explicitly describe the location of the attacker, but it’s likely that an attacker would need an existing toehold on the target system to chain together with the elevation of privilege opportunity on offer here.

    Age of Empires II: RCE

    Historically, Patch Tuesday hasn’t seen too many security patches for video games. However, Age of Empires II: Definitive Edition is a new entrant to the Microsoft CVE roster today. Veteran AoE2 players may well be familiar with dangerous opposition early game strategies such as the Persian Town Center nuisance or the Aztec monk rush, but anyone who opens a malicious game scenario file without applying the patch for CVE-2026-50663 might suffer a serious defeat. Successful exploitation allows an attacker to place malicious files in unexpected locations, potentially enabling code execution on the target system.

    Microsoft lifecycle update

    As Rapid7 noted last month, there are some significant Microsoft product lifecycle changes taking place in mid-July. SQL Server 2016 moves beyond regular extended support and into the pay-to-play Extended Security Updates (ESU) phase from July 15, 2026, and its older sibling SQL Server 2014 moves into the third and final year of ESU. Also on July 14, 2026, SharePoint Server 2016 and 2019 reach extended end date, and since there’s no ESU available, the only remaining option for fully-supported self-hosted SharePoint after today is SharePoint Subscription Edition. The July 2026 lifecycle casualties continue with Project Server 2016 and 2019, Dynamics GP 2016 and 2016 R2, InfoPath 2013, and SharePoint Designer 2013, which also all reach their Extended End Dates, ending their supported lifecycles. Visual Studio 2022 Version 17.12 Long-Term Servicing Channel (LTSC) reaches its release end date on July 14, leaving either the Visual Studio 2022 current channel or an upgrade to Visual Studio 2026 as supported options.

    Summary charts

    2026-07-vuln_count_impact.png

    2026-07-vuln_count_component.png

    2026-07-vuln_count_impact-component-heatmap.png

    Summary tables

    Apps vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-58617

    M365 Copilot for iOS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-58595

    Microsoft Bing App for IOS Spoofing Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-48561

    Microsoft Copilot Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.6

    CVE-2026-58636

    Microsoft PC Manager Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50438

    Microsoft PC Manager Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54124

    Windows Terminal Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    Azure vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-50652

    Azure Active Directory Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50653

    Azure Active Directory Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-57969

    Azure CycleCloud Elevation of Privilege Vulnerability

    N/A

    No

    8.8

    CVE-2026-58279

    Azure CycleCloud Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-47632

    Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50338

    Azure Spring Apps Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.2

    Developer Tools vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-47302

    .NET Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50525

    .NET Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50651

    .NET Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-57108

    .NET Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50524

    .NET Framework Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50527

    .NET Framework Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50648

    .NET Framework Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50650

    .NET Framework Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50646

    .NET Framework Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50649

    .NET Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-47304

    .NET Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-50528

    .NET Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    8.2

    CVE-2026-50659

    .NET Spoofing Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50526

    .NET Tampering Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-56170

    ASP.NET Core Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-47300

    ASP.NET Core Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-47303

    ASP.NET Core Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-47282

    GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-41109

    GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50506

    OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-45646

    OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50520

    Visual Studio Code Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-45496

    Visual Studio Code Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-57101

    Visual Studio Code Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-57102

    Visual Studio Code Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-47305

    Visual Studio Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    Device vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-48581

    Surface Broker SDMA Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    ESU vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-54121

    Active Directory Certificate Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50682

    Active Directory Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.1

    CVE-2026-50647

    Active Directory Federation Server Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50684

    Active Directory Federation Server Spoofing Vulnerability

    N/A

    No

    4.8

    CVE-2026-56155

    Active Directory Federation Services Elevation of Privilege Vulnerability

    Exploitation Detected

    No

    7.8

    CVE-2026-50491

    Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50381

    Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50427

    Content Delivery Manager Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50692

    Desktop Window Manager Elevation of Privilege Vulnerability

    N/A

    No

    8.8

    CVE-2026-48564

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50370

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-56159

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-50296

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50375

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    6.3

    CVE-2026-50493

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56643

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56644

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58629

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50382

    DirectX Graphics Kernel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-49174

    DNS Client Tampering Vulnerability

    Exploitation Unlikely

    No

    6.1

    CVE-2026-50495

    DNS Client Tampering Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-49787

    HTTP.sys Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-49788

    HTTP/2 Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50696

    Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50329

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58541

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55006

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55009

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55005

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-55008

    Microsoft Exchange Server Spoofing Vulnerability

    Exploitation More Likely

    No

    9.6

    CVE-2026-50343

    Microsoft Install Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54992

    Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.4

    CVE-2026-50439

    Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-42900

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-49784

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50356

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-49165

    Microsoft Windows App Store Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-54993

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58610

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50655

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-56189

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-57090

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57094

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57087

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57092

    Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    9.9

    CVE-2026-50359

    Microsoft XML Core Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-57097

    Microsoft XML Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    6.4

    CVE-2026-50346

    Netlogon RPC Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50402

    NTFS Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-54989

    Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50365

    Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.0

    CVE-2026-50474

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-58594

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56190

    Remote Desktop Protocol Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-49783

    Secure Boot Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-42990

    SQL Server ODBC driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-49168

    Storage Spaces Direct Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-49180

    Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50455

    Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58601

    Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49805

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50297

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50325

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50489

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-57095

    Win32k Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.2

    CVE-2026-56184

    Win32k Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5


    CVE-2026-50432

    Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-54119

    Windows Active Directory Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-57976

    Windows Active Directory Domain Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50366

    Windows Active Directory Domain Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-49164

    Windows Active Directory Domain Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-49178

    Windows Active Directory Domain Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-54983

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50695

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50304

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50368

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50324

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.9

    CVE-2026-50355

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50411

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50312

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-50462

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-57093

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-34346

    Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50400

    Windows App Package Installer Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50331

    Windows Application Model Core API Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49803

    Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50351

    Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-34328

    Windows Audio Service Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50406

    Windows Backup Engine Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50364

    Windows Backup Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50661

    Windows BitLocker Security Feature Bypass Vulnerability

    Exploitation Less Likely

    Yes

    6.1

    CVE-2026-42975

    Windows Bluetooth Port Driver Remote Code Execution

    Exploitation Less Likely

    No

    8.0

    CVE-2026-58538

    Windows Bluetooth Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58638

    Windows Boot Loader Security Feature Bypass Vulnerability

    Exploitation More Likely

    No

    6.0

    CVE-2026-58637

    Windows Client-Side Caching Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50384

    Windows Clip Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-49183

    Windows Clipboard Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50689

    Windows Clipboard Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50374

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.3

    CVE-2026-58536

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58613

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50401

    Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50697

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50667

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50421

    Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50352

    Windows Cryptographic Services Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50302

    Windows Cryptographic Services Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    4.2

    CVE-2026-50347

    Windows Data.dll Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49181

    Windows DHCP Client Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50683

    Windows DHCP Client Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.0

    CVE-2026-54128

    Windows DHCP Client Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.4

    CVE-2026-58627

    Windows DHCP Server Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50518

    Windows DHCP Server Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-50685

    Windows DHCP Server Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-49807

    Windows DirectX Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2

    CVE-2026-49175

    Windows DNS Client Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50426

    Windows DNS Server Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-50300

    Windows DWM Core Library Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50437

    Windows DWM Core Library Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-34348

    Windows Event Logging Service Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50502

    Windows Event Logging Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.0

    CVE-2026-33842

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-40422

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-41087

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50473

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50442

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50389

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50456

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-57084

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-57091

    Windows File History Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50405

    Windows Filtering Platform Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49172

    Windows FTP Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50387

    Windows GDI Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54122

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-49796

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50380

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.6


    CVE-2026-58609

    Windows Graphics Component Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50391

    Windows Group Policy Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50310

    Windows Human Interface Device Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-50485

    Windows Hyper-V Denial of Service Vulnerability

    Exploitation Less Likely

    No

    4.5

    CVE-2026-54129

    Windows Hyper-V Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50680

    Windows Hyper-V Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.2

    CVE-2026-58534

    Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50490

    Windows Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-58540

    Windows Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50425

    Windows Internal System User Profile Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50293

    Windows Internal Task Bar Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49167

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-54132

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-49795

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-49798

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    9.3

    CVE-2026-50354

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-50332

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50377

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50390

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50423

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50397

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50399

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50459

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50477

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50478

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50484

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50673

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58532

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50294

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2

    CVE-2026-50316

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50419

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    3.3

    CVE-2026-50463

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50475

    Windows Kernel Information Disclosure Vulnerability

    Exploitation More Likely

    No

    5.5

    CVE-2026-50429

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    8.2

    CVE-2026-58614

    Windows Kernel Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58545

    Windows Kernel Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50378

    Windows Key Guard Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50303

    Windows Key Guard Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-40378

    Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-49799

    Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50371

    Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50358

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50433

    Windows Media Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-34349

    Windows Media Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50394

    Windows Media Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50415

    Windows Media Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-57083

    Windows Media Photo Codec Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-54115

    Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50447

    Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50505

    Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-58635

    Windows Narrator Braille Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50500

    Windows Netlogon Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50476

    Windows Network Connections Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50450

    Windows Network Connections Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56650

    Windows Network File System Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56649

    Windows Network File System Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    5.9

    CVE-2026-50470

    Windows Network Policy Server SNMP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50496

    Windows Network Policy Server SNMP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-56194

    Windows NFS Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56648

    Windows NFS Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50337

    Windows Notification Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49789

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50412

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50422

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50672

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-56175

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56182

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50341

    Windows NTFS Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-58640

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-49184

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-49797

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50308

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50386

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50309

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50313

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50388

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50448

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50471

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50461

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50417

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50482

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50494

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50344

    Windows OLE Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50686

    Windows OLE Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-50335

    Windows Operating Systems Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54987

    Windows Overlay Filter Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50435

    Windows Overlay Filter Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50409

    Windows Overlay Filter Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-40400

    Windows PowerShell Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.0

    CVE-2026-55004

    Windows Print Configuration Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50499

    Windows Print Spooler Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50383

    Windows Print Spooler Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-57085

    Windows Print Spooler Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58608

    Windows Print Spooler Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50469

    Windows Projected File System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50434

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50339

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50430

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50334

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50363

    Windows Push Notifications Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50431

    Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50372

    Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-54982

    Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54995

    Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50666

    Windows Remote Access Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56647

    Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50330

    Windows Remote Desktop Client Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50376

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50504

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58533

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58535

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58546

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58539

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-55003

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-57979

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50445

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50497

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-54126

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-57982

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50369

    Windows Remote Desktop Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-58626

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-50318

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50407

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50357

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50441

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50668

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-54109

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49792

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49793

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50362

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50492

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-58530

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49791

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-50451

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-57096

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50452

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50348

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50410

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50449

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50460

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50457

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50486

    Windows Runtime Elevation of Privilege Vulnerability

    N/A

    No

    7.8

    CVE-2026-54125

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50373

    Windows Search Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-44806

    Windows Secure Channel Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-50681

    Windows Secure Channel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-56186

    Windows Secure Channel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-42982

    Windows Secure Kernel Mode Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50694

    Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50367

    Windows Sensor Data Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58619

    Windows Sensor Data Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50311

    Windows Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56188

    Windows Server Network driver Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8


    CVE-2026-50444

    Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50328

    Windows Server Update Service (WSUS) Tampering Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-58531

    Windows SMB Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.5

    CVE-2026-54997

    Windows SMB Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-49801

    Windows SMB Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50690

    Windows SMB Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-56168

    Windows SMB Server Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50360

    Windows SMB Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-57089

    Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50333

    Windows Spaceport.sys Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50298

    Windows Spaceport.sys Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-49171

    Windows Speech Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-49170

    Windows StateRepository API Server file Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58526

    Windows Storage Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50299

    Windows Storage Spaces Direct Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-50306

    Windows TCP/IP Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50307

    Windows TCP/IP Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-49177

    Windows TCP/IP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-54999

    Windows TCP/IP Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50669

    Windows Telephony Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-54124

    Windows Terminal Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50350

    Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50326

    Windows Unified Consent System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49790

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50498

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58547

    Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-49794

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    4.6

    CVE-2026-50453

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-58528

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-50321

    Windows USB Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50479

    Windows USB Hub Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49804

    Windows USB Video Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.6

    CVE-2026-49176

    Windows WalletService Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49800

    Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50480

    Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56173

    Windows WebView Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-58632

    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54107

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54986

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54112

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-54114

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50670

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50688

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-56176

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58628

    Windows Wireless Network Manager Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50509

    Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    Microsoft Dynamics vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-55944

    Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    Microsoft Office vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-50678

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.6

    CVE-2026-54988

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.1

    CVE-2026-48580

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50408

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55046

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55138

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55054

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-55122

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-55898

    Microsoft Excel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.1

    CVE-2026-50675

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55899

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55948

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-58618

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-47642

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55024

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55025

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55031

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55048

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55029

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55039

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55041

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55136

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55141

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55036

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55044

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55037

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55058

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55137

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55053

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55131

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54131

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55947

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55949

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56156

    Microsoft Excel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56193

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-55023

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-55026

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2

    CVE-2026-55027

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55028

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55047

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55035

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55057

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55042

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-55139

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50665

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56192

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-56195

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55121

    Microsoft Office Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-47290

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50301

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50314

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50467

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55017

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55018

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55022

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55125

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55045

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-55049

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55129

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55056

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55140

    Microsoft Office Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55133

    Microsoft OneNote Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55043

    Microsoft PowerPoint Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55123

    Microsoft PowerPoint Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55120

    Microsoft PowerPoint Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55052

    Microsoft SharePoint Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-58277

    Microsoft SharePoint Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50522

    Microsoft SharePoint Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-58644

    Microsoft SharePoint Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-56164

    Microsoft SharePoint Server Elevation of Privilege Vulnerability

    Exploitation Detected

    No

    5.3

    CVE-2026-55051

    Microsoft SharePoint Server Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-55040

    Microsoft SharePoint Server Security Feature Bypass Vulnerability

    Exploitation More Likely

    No

    9.1

    CVE-2026-54108

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-55016

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    4.6

    CVE-2026-55019

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Unlikely

    No

    4.6

    CVE-2026-55020

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Unlikely

    No

    4.6

    CVE-2026-55021

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Unlikely

    No

    7.3

    CVE-2026-55030

    Microsoft SharePoint Server Spoofing Vulnerability

    N/A

    No

    4.6

    CVE-2026-55034

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-55126

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-55135

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    4.6

    CVE-2026-56157

    Microsoft SharePoint Server Spoofing Vulnerability

    Exploitation Less Likely

    No

    5.4

    CVE-2026-55050

    Microsoft Word Information Disclosure Vulnerability

    N/A

    No

    5.5

    CVE-2026-55124

    Microsoft Word Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55142

    Microsoft Word Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-55032

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55033

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55127

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55055

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55038

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55132

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55134

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55128

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55130

    Microsoft Word Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50387

    Windows GDI Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    Open Source Software vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-40553

    Stack-based buffer overflow in gawk

    n/a

    No

    CVE-2026-40469

    Heap buffer overflow in gawk

    n/a

    No

    CVE-2026-40468

    Heap buffer overflow in gawk

    n/a

    No

    CVE-2026-40467

    Use after free in gawk

    n/a

    No

    CVE-2026-57968

    Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-57973

    Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

    Exploitation Less Likely

    No

    6.3

    Other vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-50663

    Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50510

    GitHub Copilot Remote Code Execution Vulnerability

    N/A

    No

    7.8

    CVE-2026-55010

    Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-55145

    Outlook Copilot Tampering Vulnerability

    N/A

    No

    6.3

    Server Software vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-55006

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55009

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-55005

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-55008

    Microsoft Exchange Server Spoofing Vulnerability

    Exploitation More Likely

    No

    9.6

    SQL Server vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-56642

    Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-58647

    Microsoft PowerBI Report Server Spoofing Vulnerability

    Exploitation Unlikely

    No

    8.0

    CVE-2026-47296

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55002

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-47295

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50468

    Microsoft SQL Server Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-54116

    Microsoft SQL Server Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-54117

    Microsoft SQL Server Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54118

    Microsoft SQL Server Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    System Center vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-50658

    Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-56178

    Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50657

    Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-55011

    Microsoft Defender Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55012

    Microsoft Defender Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    Windows vulnerabilities

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-54121

    Active Directory Certificate Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50682

    Active Directory Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.1

    CVE-2026-55001

    Active Directory Domain Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50647

    Active Directory Federation Server Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50684

    Active Directory Federation Server Spoofing Vulnerability

    N/A

    No

    4.8

    CVE-2026-56155

    Active Directory Federation Services Elevation of Privilege Vulnerability

    Exploitation Detected

    No

    7.8

    CVE-2026-50488

    Clipboard User Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50491

    Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50381

    Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50427

    Content Delivery Manager Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50692

    Desktop Window Manager Elevation of Privilege Vulnerability

    N/A

    No

    8.8

    CVE-2026-58633

    Desktop Window Manager Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58634

    Desktop Window Manager Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-48564

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50370

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-56159

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-50296

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50375

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    6.3

    CVE-2026-50353

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50493

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56643

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56644

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58629

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50382

    DirectX Graphics Kernel Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-49174

    DNS Client Tampering Vulnerability

    Exploitation Unlikely

    No

    6.1

    CVE-2026-50495

    DNS Client Tampering Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-57088

    Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49787

    HTTP.sys Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50420

    HTTP.sys Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2

    CVE-2026-49788

    HTTP/2 Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50696

    Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-49162

    Microsoft Brokering File System Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50305

    Microsoft Brokering File System Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50361

    Microsoft Brokering File System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50466

    Microsoft Brokering File System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50458

    Microsoft Brokering File System Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50329

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58541

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50343

    Microsoft Install Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54992

    Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.4

    CVE-2026-50439

    Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-58537

    Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-42900

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-49784

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50356

    Microsoft Windows App Store Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-49165

    Microsoft Windows App Store Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-54993

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58610

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50655

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-56189

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-57090

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57094

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57087

    Microsoft Windows Media Foundation Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-57092

    Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    9.9

    CVE-2026-50359

    Microsoft XML Core Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-57097

    Microsoft XML Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    6.4

    CVE-2026-50346

    Netlogon RPC Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50402

    NTFS Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-54989

    Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50365

    Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.0

    CVE-2026-54990

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50474

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-58594

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56190

    Remote Desktop Protocol Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-49783

    Secure Boot Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-42990

    SQL Server ODBC driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-49168

    Storage Spaces Direct Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-49180

    Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50455

    Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-54111

    Universal Print Management Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-58543

    Universal Print Management Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.3

    CVE-2026-58601

    Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49805

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50297

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50325

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50489

    Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-57095

    Win32k Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.2

    CVE-2026-50416

    Win32k Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    3.3

    CVE-2026-56184

    Win32k Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5


    CVE-2026-50432

    Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-54119

    Windows Active Directory Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-57976

    Windows Active Directory Domain Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50366

    Windows Active Directory Domain Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-49164

    Windows Active Directory Domain Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-49178

    Windows Active Directory Domain Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-58529

    Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-54983

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50695

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50304

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50368

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50324

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.9

    CVE-2026-50355

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50411

    Windows Active Directory Federation Services Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-58631

    Windows Admin Center (WAC) Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-56196

    Windows Admin Center (WAC) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56197

    Windows Admin Center (WAC) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56169

    Windows Admin Center Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-57107

    Windows Admin Center Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56185

    Windows Admin Center Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50312

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-50462

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-57093

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-34346

    Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-48572

    Windows App Package Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-48571

    Windows App Package Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50400

    Windows App Package Installer Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50331

    Windows Application Model Core API Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49803

    Windows AppX Deployment Extensions Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50351

    Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50440

    Windows Audio Service Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-34328

    Windows Audio Service Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50406

    Windows Backup Engine Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50364

    Windows Backup Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50661

    Windows BitLocker Security Feature Bypass Vulnerability

    Exploitation Less Likely

    Yes

    6.1

    CVE-2026-42975

    Windows Bluetooth Port Driver Remote Code Execution

    Exploitation Less Likely

    No

    8.0

    CVE-2026-58538

    Windows Bluetooth Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58638

    Windows Boot Loader Security Feature Bypass Vulnerability

    Exploitation More Likely

    No

    6.0

    CVE-2026-58637

    Windows Client-Side Caching Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50384

    Windows Clip Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-49183

    Windows Clipboard Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50689

    Windows Clipboard Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50374

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.3

    CVE-2026-58536

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58613

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50401

    Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50697

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50667

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50421

    Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50428

    Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-50352

    Windows Cryptographic Services Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50302

    Windows Cryptographic Services Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    4.2

    CVE-2026-55144

    Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

    Exploitation Unlikely

    No

    7.1

    CVE-2026-50347

    Windows Data.dll Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49181

    Windows DHCP Client Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50683

    Windows DHCP Client Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.0

    CVE-2026-54128

    Windows DHCP Client Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    8.4

    CVE-2026-58627

    Windows DHCP Server Denial of Service Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50518

    Windows DHCP Server Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-50685

    Windows DHCP Server Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-49807

    Windows DirectX Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2

    CVE-2026-49175

    Windows DNS Client Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50487

    Windows DNS Client Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-50465

    Windows DNS Client Tampering Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-49169

    Windows DNS Server Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.0

    CVE-2026-50426

    Windows DNS Server Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-50424

    Windows Domain Controller Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50300

    Windows DWM Core Library Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50437

    Windows DWM Core Library Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-34348

    Windows Event Logging Service Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50502

    Windows Event Logging Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.0

    CVE-2026-33842

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-40422

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-41087

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50473

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50442

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50389

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50456

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-57084

    Windows File Explorer Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-57091

    Windows File History Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50405

    Windows Filtering Platform Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49172

    Windows FTP Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50387

    Windows GDI Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54122

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-49796

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50380

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.6

    CVE-2026-50483

    Windows Graphics Component Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-58609

    Windows Graphics Component Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50391

    Windows Group Policy Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50310

    Windows Human Interface Device Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-50485

    Windows Hyper-V Denial of Service Vulnerability

    Exploitation Less Likely

    No

    4.5

    CVE-2026-54129

    Windows Hyper-V Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-54127

    Windows Hyper-V Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.4

    CVE-2026-50680

    Windows Hyper-V Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.2

    CVE-2026-50315

    Windows Image Acquisition Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-58534

    Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50490

    Windows Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-58540

    Windows Installer Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50425

    Windows Internal System User Profile Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50293

    Windows Internal Task Bar Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49167

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    4.7

    CVE-2026-49173

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54132

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-49795

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    8.8

    CVE-2026-49798

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    9.3

    CVE-2026-49808

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50354

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-50332

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50377

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50390

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.0

    CVE-2026-50423

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50397

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50436

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50399

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50459

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50477

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50478

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50484

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50673

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58532

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50294

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.2


    CVE-2026-50316

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50419

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    3.3

    CVE-2026-50463

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50475

    Windows Kernel Information Disclosure Vulnerability

    Exploitation More Likely

    No

    5.5

    CVE-2026-50429

    Windows Kernel Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    8.2

    CVE-2026-58614

    Windows Kernel Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58545

    Windows Kernel Security Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58602

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50393

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50396

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50378

    Windows Key Guard Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50303

    Windows Key Guard Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-40378

    Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-49799

    Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50371

    Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-58544

    Windows Management Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50404

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50358

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50336

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50398

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-50414

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50379

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50433

    Windows Media Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50676

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50677

    Windows Media Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-34349

    Windows Media Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50394

    Windows Media Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50415

    Windows Media Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-57083

    Windows Media Photo Codec Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50327

    Windows Media Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58542

    Windows Media Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-54115

    Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50447

    Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50505

    Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50342

    Windows MIDI Service Module Elevation of Privileges Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56183

    Windows MIDI Service Module Elevation of Privileges Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-56187

    Windows MIDI Service Module Elevation of Privileges Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-58635

    Windows Narrator Braille Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50500

    Windows Netlogon Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-56181

    Windows Network Address Translation (NAT) Spoofing Vulnerability

    Exploitation Less Likely

    No

    8.3

    CVE-2026-50476

    Windows Network Connections Service Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50450

    Windows Network Connections Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56650

    Windows Network File System Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56649

    Windows Network File System Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    5.9

    CVE-2026-50470

    Windows Network Policy Server SNMP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-50496

    Windows Network Policy Server SNMP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-56194

    Windows NFS Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56648

    Windows NFS Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50337

    Windows Notification Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49789

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50412

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50422

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50672

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-56175

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56182

    Windows NTFS Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50341

    Windows NTFS Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-58640

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-49184

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.4

    CVE-2026-49797

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50308

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50386

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50309

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50313

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50388

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50448

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50471

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50461

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50417

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50482

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50494

    Windows NTFS Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50344

    Windows OLE Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50686

    Windows OLE Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.1

    CVE-2026-50335

    Windows Operating Systems Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50317

    Windows Operating Systems Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54987

    Windows Overlay Filter Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50435

    Windows Overlay Filter Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50409

    Windows Overlay Filter Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-40400

    Windows PowerShell Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.0

    CVE-2026-49166

    Windows Print Configuration Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55004

    Windows Print Configuration Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50499

    Windows Print Spooler Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50383

    Windows Print Spooler Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-57085

    Windows Print Spooler Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-58608

    Windows Print Spooler Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50469

    Windows Projected File System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50434

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50339

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50430

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50334

    Windows Push Notification Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-44800

    Windows Push Notifications Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50363

    Windows Push Notifications Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50431

    Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50372

    Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-54982

    Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54995

    Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50666

    Windows Remote Access Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56647

    Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50330

    Windows Remote Desktop Client Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50376

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50504

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58533

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58535

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58546

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-58539

    Windows Remote Desktop Client Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-55003

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-57979

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50445

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50497

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-54126

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    6.5

    CVE-2026-57982

    Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50369

    Windows Remote Desktop Services Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-58626

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-55014

    Windows Remote Help Defense Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50318

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50407

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50357

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50441

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50668

    Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-54109

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49792

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49793

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50362

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50492

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-50501

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-58530

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49791

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-50451

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.1

    CVE-2026-57096

    Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50323

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50452

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50348

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50345

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50322

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50340

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.5

    CVE-2026-50410

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50449

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50460

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50403

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-50385

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-50413

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50457

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50486

    Windows Runtime Elevation of Privilege Vulnerability

    N/A

    No

    7.8

    CVE-2026-50503

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-54125

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58527

    Windows Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50373

    Windows Search Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50679

    Windows Search Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-44806

    Windows Secure Channel Denial of Service Vulnerability

    Exploitation Less Likely

    No

    5.3

    CVE-2026-50681

    Windows Secure Channel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-56186

    Windows Secure Channel Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-42982

    Windows Secure Kernel Mode Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50392

    Windows Secure Kernel Mode Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50694

    Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    8.1

    CVE-2026-50367

    Windows Sensor Data Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58619

    Windows Sensor Data Service Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50311

    Windows Server Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56188

    Windows Server Network driver Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-50444

    Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50328

    Windows Server Update Service (WSUS) Tampering Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-58531

    Windows SMB Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.5

    CVE-2026-54997

    Windows SMB Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-49801

    Windows SMB Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5


    CVE-2026-50690

    Windows SMB Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-56168

    Windows SMB Server Denial of Service Vulnerability

    Exploitation Less Likely

    No

    6.5

    CVE-2026-50360

    Windows SMB Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    8.8

    CVE-2026-57089

    Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    7.5

    CVE-2026-50333

    Windows Spaceport.sys Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50298

    Windows Spaceport.sys Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    6.8

    CVE-2026-49171

    Windows Speech Runtime Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.5

    CVE-2026-49170

    Windows StateRepository API Server file Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-58526

    Windows Storage Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50299

    Windows Storage Spaces Direct Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-50418

    Windows System Secure Feature Bypass Vulnerability

    Exploitation Unlikely

    No

    5.1

    CVE-2026-50306

    Windows TCP/IP Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50307

    Windows TCP/IP Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-49177

    Windows TCP/IP Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-54999

    Windows TCP/IP Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50669

    Windows Telephony Server Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-54124

    Windows Terminal Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50350

    Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability

    Exploitation Unlikely

    No

    5.5

    CVE-2026-50326

    Windows Unified Consent System Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-49790

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.3

    CVE-2026-50498

    Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58547

    Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-49794

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    4.6

    CVE-2026-50453

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.1

    CVE-2026-58528

    Windows USB Audio Class Driver Information Disclosure Vulnerability

    Exploitation Less Likely

    No

    6.8

    CVE-2026-50321

    Windows USB Driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-50479

    Windows USB Hub Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-55000

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.4

    CVE-2026-54991

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54996

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-49802

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-49806

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-50674

    Windows USB Print Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.0

    CVE-2026-49804

    Windows USB Video Driver Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    6.6

    CVE-2026-50454

    Windows User Interface Core Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-49176

    Windows WalletService Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-49800

    Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50480

    Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-56173

    Windows WebView Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.0

    CVE-2026-58632

    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-54107

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-54986

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-54112

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    7.8

    CVE-2026-54114

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50670

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-50688

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    CVE-2026-50687

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    8.8

    CVE-2026-56176

    Windows Win32k Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-58628

    Windows Wireless Network Manager Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    7.8

    CVE-2026-50295

    Windows Zero Trust DNS Security Feature Bypass Vulnerability

    Exploitation Less Likely

    No

    5.5

    CVE-2026-50509

    Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    7.8

    Zero-Day Vulnerabilities: Known Exploited

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-56155

    Active Directory Federation Services Elevation of Privilege Vulnerability

    Exploitation Detected

    No

    7.8

    CVE-2026-56164

    Microsoft SharePoint Server Elevation of Privilege Vulnerability

    Exploitation Detected

    No

    5.3

    Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-50661

    Windows BitLocker Security Feature Bypass Vulnerability

    Exploitation Less Likely

    Yes

    6.1

    Critical RCEs

    CVE

    Title

    Exploitation status

    Publicly disclosed?

    CVSS v3 base score

    CVE-2026-56159

    DHCP Server Service Remote Code Execution Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-48561

    Microsoft Copilot Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.6

    CVE-2026-55944

    Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-55008

    Microsoft Exchange Server Spoofing Vulnerability

    Exploitation More Likely

    No

    9.6

    CVE-2026-50522

    Microsoft SharePoint Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-58644

    Microsoft SharePoint Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-55040

    Microsoft SharePoint Server Security Feature Bypass Vulnerability

    Exploitation More Likely

    No

    9.1

    CVE-2026-57092

    Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

    Exploitation Less Likely

    No

    9.9

    CVE-2026-55010

    Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-54990

    Remote Desktop Client Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-56190

    Remote Desktop Protocol Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-42990

    SQL Server ODBC driver Elevation of Privilege Vulnerability

    Exploitation Unlikely

    No

    9.8

    CVE-2026-50518

    Windows DHCP Server Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    CVE-2026-49172

    Windows FTP Service Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-50380

    Windows GDI+ Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.6

    CVE-2026-49798

    Windows Kernel Elevation of Privilege Vulnerability

    Exploitation More Likely

    No

    9.3

    CVE-2026-50447

    Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

    Exploitation Less Likely

    No

    9.8

    CVE-2026-56188

    Windows Server Network driver Remote Code Execution Vulnerability

    Exploitation More Likely

    No

    9.8

    ]]>         <![CDATA[Download: The ultimate guide to network operations management]]> https://tsecurity.de/de/3668124/it-security-nachrichten/download-the-ultimate-guide-to-network-operations-management/ https://tsecurity.de/de/3668124/it-security-nachrichten/download-the-ultimate-guide-to-network-operations-management/ Tue, 14 Jul 2026 15:38:08 +0200 📰 IT Security Nachrichten tsecurity.de Modern network operations are too manual. Today’s IT and security teams are managing growing complexity across networks, infrastructure, tools, and workflows. The result? Slower response, duplicated effort, and operational friction. This guide explores how intelligent workflows help teams reduce manual…

    Read more →

    The post Download: The ultimate guide to network operations management appeared first on IT Security News.

    ]]>         <![CDATA[1Password moves into AI cost management, betting that token spend is the next enterprise budget crisis]]> https://tsecurity.de/de/3668120/it-nachrichten/1password-moves-into-ai-cost-management-betting-that-token-spend-is-the-next-enterprise-budget-crisis/ https://tsecurity.de/de/3668120/it-nachrichten/1password-moves-into-ai-cost-management-betting-that-token-spend-is-the-next-enterprise-budget-crisis/ Tue, 14 Jul 2026 15:32:53 +0200 📰 IT Nachrichten tsecurity.de 1Password on Tuesday launched AI Spend and Consumption Management, a new capability embedded in its SaaS Manager platform that gives IT and finance teams a unified, real-time view of how their organizations consume and spend on AI services from vendors including Anthropic, Cursor, and OpenAI.

    The move marks the latest strategic expansion for a company that built its reputation on password management for consumers and, over the past three years, has aggressively repositioned itself as a broader identity security and SaaS governance platform for enterprise buyers. With this release, 1Password is staking a claim in one of enterprise technology's newest and most chaotic budget categories: the consumption-based cost of large language models.

    "Executives want teams to build faster with AI, but that speed is creating a new kind of spending pressure," Greg Henry, 1Password's chief financial officer, said in an exclusive interview with VentureBeat. "Developers are consuming tokens at a pace that traditional budgets weren't built to manage, and IT and finance teams are being asked to forecast and justify AI investments without a clear view of what's actually driving costs."

    The product, now in public preview with broad availability planned for fall 2026, connects directly to vendor admin APIs to pull token-level consumption data daily. It normalizes that data across providers into a single dashboard and allows organizations to set vendor-level spend limits, configure threshold-based alerts via Slack and email, and break down usage by team, user, vendor, and model.

    Why traditional software budgets can't keep up with AI token pricing

    The core challenge 1Password is targeting is structural. Traditional SaaS pricing operates on a per-seat, per-year model that is easy to budget and reconcile. AI pricing does not. Every API call to Claude, GPT-5.6, or a Cursor-powered coding assistant consumes tokens, and the cost of those tokens varies by model, by input versus output, and by the complexity of the task. A single engineering team running agentic workflows can burn through a prepaid token budget in weeks — and the finance team may not notice until the invoice arrives.

    Henry drew a sharp analogy to a problem enterprises have already lived through once. "Consumption-based pricing isn't new," he said. "We saw it arrive with cloud infrastructure, and it took years to build the tools and disciplines to manage it. AI is the next version of that shift."

    That comparison resonates across the industry. When Amazon Web Services, Microsoft Azure, and Google Cloud popularized consumption-based pricing for compute and storage in the 2010s, enterprises initially lacked the tooling to monitor and optimize their cloud bills. That gap spawned an entire FinOps ecosystem — companies like CloudHealth, Spot.io, and Apptio built multi-billion-dollar businesses helping organizations understand what they were spending on cloud and why. Henry is explicitly betting that AI token spend will follow the same trajectory, and that organizations that fail to build visibility now will end up, as he put it, "paying far more than they needed to, for far longer than they should have."

    The scale of the coming wave lends credibility to that bet. Goldman Sachs has estimated that token consumption from AI agents alone will grow 24 times by 2030, a projection driven by the expectation that autonomous AI systems will increasingly execute multi-step workflows — booking travel, writing and deploying code, managing customer service interactions — that generate vastly more API calls than a human sitting at a chat interface.

    How 1Password's new dashboard tracks every token across Anthropic, Cursor, and OpenAI

    The new capability extends 1Password SaaS Manager's existing foundation of application discovery, license management, and spend analytics. It is not a standalone product. Existing SaaS Manager customers can activate it by connecting their supported AI vendor API keys, at which point consumption data flows into a dedicated AI Consumption Management dashboard. Henry confirmed that there is no separate product or add-on fee: "AI Spend and Consumption Management is available to all 1Password SaaS Manager customers."

    The system provides four core functions. First, it aggregates token usage and spend across Anthropic, Cursor, and OpenAI into a single, normalized view — eliminating the need to toggle between three separate vendor dashboards with three different reporting formats. Second, it enables budget controls: organizations can set vendor-level spend limits, configure percentage-based thresholds, and receive automated alerts when prepaid balances approach depletion. Third, it disaggregates consumption by team, user, vendor, and model, allowing finance and IT to understand not just how much is being spent, but where and by whom. Fourth, it situates AI spend within the broader SaaS portfolio, helping organizations see how token costs relate to their total software investment.

    Notably, the system captures consumption regardless of whether a human or an AI agent generated it. "Token consumption is captured at the API level regardless of whether a human or an agent is generating it," Henry explained. "Organizations get the total consumption picture, including the spikes that agent loops can create, which can be some of the hardest usage to catch before it becomes a problem."

    That agent-level visibility matters because autonomous AI systems can generate runaway costs in ways that human users typically cannot. An agentic coding assistant stuck in a retry loop, for example, can consume thousands of dollars in tokens in minutes — with no human in the loop to notice. For now, the product alerts but does not enforce. When asked whether 1Password will eventually give organizations the ability to automatically cut off spending when a threshold is crossed, Henry said the company is "actively evaluating" automatic enforcement but emphasized that visibility must come first: "You can't enforce what you can't see."

    The choice of launch partners reveals where enterprise AI budgets are under the most pressure

    The decision to start with Anthropic, Cursor, and OpenAI — rather than casting a wider net — reflects where enterprise AI adoption and budget strain are most concentrated right now. Henry said the choice was driven entirely by customer demand. "Anthropic, Cursor, and OpenAI are where we're seeing the highest adoption, and where token consumption can move fast and get ahead of the teams responsible for managing it," he said. The company plans to add additional vendors based on customer demand, API availability, and budget impact, though it has not committed to a specific timeline or vendor list.

    The inclusion of Cursor alongside the two major foundation model providers is telling. Cursor, an AI-powered code editor that has rapidly gained traction among developers, represents a category of AI tool where consumption is particularly difficult to forecast. Unlike a chatbot interface where a user consciously types a prompt, Cursor integrates AI suggestions directly into the development workflow, generating token consumption continuously as developers write code. That ambient, always-on consumption pattern makes it especially prone to budget overruns.

    Henry also addressed who inside an organization should actually own this problem — and acknowledged that the honest answer right now is no one. "When spend is fragmented across vendor dashboards and finance teams are reconciling it monthly, you're always behind," he said. "AI spend can't be treated as a finance-only or IT-only problem." He noted that the pricing differences between models have become significant enough that the choice of which AI model a team uses is now a meaningful financial decision, one that is pulling CFOs into conversations with IT, product, and engineering leaders "in ways they never had to before."

    Steve May, director of IT at ServiceTrade, a 1Password customer that has been using the capability, said it addressed a concrete planning gap. "Forecasting tools for AI consumption and spend was one of our biggest gaps in planning because we didn't have a reliable way to track it," May said. He added that the visibility has "prevented overages that would have cost far more to fix after the fact."

    Where 1Password fits in the fast-consolidating SaaS management market

    1Password is not the only company racing to solve the AI cost management problem, but the competitive landscape is still fragmented and the category is far from mature.

    Zylo, a SaaS management platform that Gartner has also recognized as a leader in the space, published its 2026 SaaS Management Index in January showing that AI-native application spend surged 393% year over year in organizations with more than 10,000 employees and 108% overall. Zylo's data also revealed that ChatGPT has become the most expensed application in enterprise environments, highlighting how AI tools are entering organizations through employee credit cards and expense reports — outside formal procurement and governance workflows. Zylo has added its own token-level cost tracking for AI vendors including Anthropic, OpenAI, Cursor, and Perplexity.

    Meanwhile, according to a comparison published by Coommit in May, Vendr — which focuses more on SaaS negotiation than discovery — tracks AI tools at the contract level but does not yet offer consumption-level visibility. And the FinOps Foundation reported in its 2026 State of FinOps survey that 98% of organizations now actively manage AI costs, up from just 31% in 2024. The broader SaaS management market is also consolidating rapidly. In May, Deel acquired Sastrify, a German SaaS management vendor, and began folding it into its HR platform — a signal that SaaS management capabilities are increasingly being absorbed into adjacent enterprise platforms rather than remaining standalone products.

    1Password's approach differs from pure-play SaaS management competitors in one important respect: it is building AI cost management on top of an identity security platform, not a FinOps or procurement tool. The company's SaaS Manager product grew out of its 2025 acquisition of Trelica, a UK-based SaaS access management startup whose technology enabled the discovery of unsanctioned applications — so-called shadow IT. As BetaKit reported at the time of that deal, 1Password co-CEO Jeff Shiner described Trelica as "a pioneer in modern SaaS access management" and said the acquisition would accelerate 1Password's Extended Access Management product roadmap by more than a year. CRN noted that Trelica brought more than 300 SaaS integrations to the platform. That identity-first lineage gives 1Password a natural advantage in connecting spend data to specific users and teams — a linkage that matters when the question shifts from "how much are we spending on AI?" to "who is spending it, and is it delivering value?"

    From password manager to platform company: 1Password's $6.8 billion bet on enterprise identity

    The launch raises a question that Henry addressed head-on: whether a company that started as a consumer password manager can credibly compete in enterprise AI cost management.

    "It doesn't feel like a stretch to us. It feels like a natural progression," he said. "For more than 20 years, 1Password has evolved alongside how our customers work. We started by protecting passwords. Then we helped organizations manage secrets, control access, and get visibility into the applications their teams rely on."

    The company's evolution has been rapid. 1Password raised a $620 million Series C in January 2022 led by ICONIQ Growth, reaching a $6.8 billion valuation — at the time, the largest funding round ever raised by a Canadian company, according to Crunchbase. The round also attracted celebrity investors including Ryan Reynolds, Scarlett Johansson, and Robert Downey Jr. As of early 2025, BetaKit reported that 1Password had surpassed $250 million in annual recurring revenue, with B2B sales accounting for nearly three-quarters of total revenue and the company claiming to be cash-flow positive.

    In May 2024, 1Password launched Extended Access Management, a platform designed to secure sign-ins across both managed and unmanaged applications and devices. That same year, it acquired Kolide for device trust and, in early 2025, Trelica for SaaS discovery. In June 2026, Gartner named 1Password a Leader in its Magic Quadrant for SaaS Management Platforms. According to 1Password's own blog post on the recognition, its SaaS Manager now supports over 400 integrations and provides visibility into a library of more than 40,000 pre-populated application profiles. Each step has moved the company further from its consumer roots and deeper into enterprise infrastructure. The AI Spend and Consumption Management launch extends that trajectory into financial operations territory — a domain where 1Password will compete not only with SaaS management vendors but potentially with dedicated FinOps platforms and the AI vendors' own billing dashboards.

    Why high AI token consumption doesn't always mean wasted money

    Perhaps the most revealing part of Henry's commentary concerns what organizations should actually do with the consumption data once they have it. He pushed back forcefully against the assumption that high token consumption automatically signals waste.

    "A team burning through tokens may be building something genuinely valuable," he said. "A lower-usage project might not be moving the business forward at all. What matters is whether that consumption is producing enough business value to justify the spend."

    Henry drew a distinction between personal productivity — "having a bot summarize your meeting or draft a quick email" — and genuine business outcomes. "What organizations need to see is where consumption is actually driving revenue, efficiency, or something that moves the needle."

    That framing positions AI Spend and Consumption Management not just as a cost-cutting tool but as a decision-support system for AI investment allocation. If a CFO can see that one engineering team's heavy Claude usage is powering a product feature that drives revenue, while another team's OpenAI spend is funding low-value internal automation, the organization can reallocate budget accordingly rather than imposing across-the-board cuts.

    "When costs rise faster than expected, the instinct is to cut," Henry said. "But most organizations can't yet tell which teams, models, or tools are responsible for the increase, so they end up cutting across the board rather than directing investment toward the AI projects that are actually delivering business value. Blunt cuts on a technology you're counting on for competitive advantage is not a management strategy, it's a missed opportunity."

    The next enterprise budget crisis is already here — and it's priced per token

    The product's current scope — three vendor integrations, alerting but not enforcement — is clearly a starting point. Henry signaled that automatic spend limits are on the roadmap and that additional vendor integrations will follow based on customer demand.

    But the broader trajectory he described suggests 1Password sees this launch as a wedge into a much larger opportunity. "As traditional SaaS products add AI capabilities, their pricing models are going to follow," he said. "Organizations that build visibility and management discipline around consumption now are going to be in a much better position when that happens across the rest of their software portfolio."

    If Henry is right, the chaos currently confined to AI token budgets is not a temporary growing pain but a preview of how all enterprise software will eventually be priced. A decade ago, companies scrambled to understand their cloud bills. Today, they are scrambling to understand their AI bills. The question is whether the organizations building the dashboards this time around can get ahead of the curve — or whether, as Henry warned, they will end up where so many companies ended up with cloud, realizing too late how much they were overpaying, and for how long.

    AI Spend and Consumption Management is available now in public preview for 1Password SaaS Manager customers. Broad availability is planned for fall 2026.

    ]]>         <![CDATA[Download: The ultimate guide to network operations management]]> https://tsecurity.de/de/3668012/it-security-nachrichten/download-the-ultimate-guide-to-network-operations-management/ https://tsecurity.de/de/3668012/it-security-nachrichten/download-the-ultimate-guide-to-network-operations-management/ Tue, 14 Jul 2026 15:08:36 +0200 📰 IT Security Nachrichten tsecurity.de Modern network operations are too manual. Today’s IT and security teams are managing growing complexity across networks, infrastructure, tools, and workflows. The result? Slower response, duplicated effort, and operational friction. This guide explores how intelligent workflows help teams reduce manual work, improve visibility, and move faster across network operations. What you’ll learn: Why traditional approaches to network operations struggle to scale Where operational bottlenecks create delays, inefficiencies, and risk How intelligent workflows connect teams, systems, … More →

    The post Download: The ultimate guide to network operations management appeared first on Help Net Security.

    ]]>         <![CDATA[Owning an Apple Home: The broken promise of Matter]]> https://tsecurity.de/de/3667918/ios-mac-os/owning-an-apple-home-the-broken-promise-of-matter/ https://tsecurity.de/de/3667918/ios-mac-os/owning-an-apple-home-the-broken-promise-of-matter/ Tue, 14 Jul 2026 14:26:50 +0200 🍏 iOS / Mac OS tsecurity.de Apple Homes.

    Split-screen close-ups of smart home devices: a ceiling light on the left, a smart light bulb in the center, and a smart plug with two outlets on the right
    Matter is supposed to be unifying, but manufacturers are resistant to letting users leave their apps

    The smart home started life as a disjointed mess and new standards hoped to unify the different platforms. Today, everything feels a little too spread out even with better cross-platform compatibility.

    Don't get me wrong, owning a smart home has been much improved thanks to Matter. The Connectivity Standards Alliance has done great work.


    Continue Reading on AppleInsider | Discuss on our Forums]]>         <![CDATA[Five reasons switching from IP VPN to SD WAN will help you build an AI-ready network]]> https://tsecurity.de/de/3667631/it-nachrichten/five-reasons-switching-from-ip-vpn-to-sd-wan-will-help-you-build-an-ai-ready-network/ https://tsecurity.de/de/3667631/it-nachrichten/five-reasons-switching-from-ip-vpn-to-sd-wan-will-help-you-build-an-ai-ready-network/ Tue, 14 Jul 2026 12:32:26 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Ein kleiner Video-Ratgeber: Hue Signe oder Hue Play?]]> https://tsecurity.de/de/3667499/ios-mac-os/ein-kleiner-video-ratgeber-hue-signe-oder-hue-play/ https://tsecurity.de/de/3667499/ios-mac-os/ein-kleiner-video-ratgeber-hue-signe-oder-hue-play/ Tue, 14 Jul 2026 11:55:52 +0200 🍏 iOS / Mac OS tsecurity.de Philips Hue hat im Juni einige neue Produkte auf den Markt gebracht. Neben neuen Wandschalter Modulen, die erstmals auch nicht-smarte Deckenleuchten ein- und ausschalten oder sogar dimmen können, gibt es auch Neuzugänge in der Philips Hue Play Serie. Die Hue Play Serie ist offiziell auf Entertainment-Funktionen rund um Hue Sync ausgerichtet. Hier kennen wir ja […]

    Der Beitrag Ein kleiner Video-Ratgeber: Hue Signe oder Hue Play? erschien zuerst auf appgefahren.de.

    ]]>         <![CDATA[Rapid7 and Mindshare Partner to Accelerate Cyber Resilience Across the Middle East]]> https://tsecurity.de/de/3667282/it-security-nachrichten/rapid7-and-mindshare-partner-to-accelerate-cyber-resilience-across-the-middle-east/ https://tsecurity.de/de/3667282/it-security-nachrichten/rapid7-and-mindshare-partner-to-accelerate-cyber-resilience-across-the-middle-east/ Tue, 14 Jul 2026 10:24:33 +0200 📰 IT Security Nachrichten tsecurity.de Gopan Sivasankaran is Regional Director, Middle East & Africa, at Rapid7

    From AI adoption and cloud-first strategies to smart cities and critical infrastructure modernization, organizations across the United Arab Emirates are embracing innovation at an unprecedented rate. The country truly is setting the pace for digital transformation.

    Against this backdrop of rapid innovation, today's security teams are managing increasingly complex environments while defending against more sophisticated, AI-enabled threats. In this environment, business leaders still expect security to enable innovation, not slow it down. They're pushed to reduce risk, improve visibility across expanding attack surfaces, and respond faster than ever before, with limited resources now table stakes.

    This shift is changing what organizations expect from their cybersecurity partners, with customers no longer wanting disconnected tools or transactional relationships. They’re instead craving trusted advisors who can help simplify security operations, strengthen cyber resilience, and deliver measurable outcomes.

    That's why Rapid7 is excited to announce a new strategic, Middle East-spanning distribution partnership with Mindware.

    A shared commitment to the region

    The Middle East continues to establish itself as one of the world's most ambitious digital economies. As organizations invest in cloud technologies, AI, and connected infrastructure, cybersecurity has become a critical foundation for sustainable growth.

    This is precisely why Rapid7 has continued to invest in the Middle East: We recognize the region's growing importance to the global cybersecurity landscape, and this new partnership with Mindware represents another important step in that journey.

    This collaboration is about more than expanding our channel presence, it's about investing in the partners helping organizations navigate an increasingly complex security landscape.

    Mindware has built a strong reputation as one of the Middle East's leading value-added distributors, combining deep regional expertise with technical enablement, professional services, and an extensive partner ecosystem. Together, we're creating a framework that helps partners grow their cybersecurity practices while delivering greater value to customers.

    Building stronger security operations

    Security teams today face a common challenge: too many tools, too many alerts, and not enough time. Organizations are increasingly looking for platforms that bring exposure management, threat detection, and response together to improve visibility and reduce operational complexity.

    Rapid7's AI-powered cybersecurity operations platform helps organizations unify security operations, reduce risk, and respond to threats with greater speed and confidence. Combined with Mindware's regional market knowledge, partner enablement capabilities, and technical expertise, this partnership will make it easier for organizations across the Middle East to access modern cybersecurity operations through trusted local partners.

    For those partners, this creates new opportunities to expand managed services, strengthen technical capabilities, and help customers modernize their security operations while supporting long-term business growth.

    Local expertise alongside global innovation

    The most successful cybersecurity partnerships combine global innovation with local knowledge. Organizations want world-class technology, but they also expect partners who understand their business environment, regulatory landscape, and operational priorities.

    By combining Rapid7's cybersecurity innovation with Mindware's established regional ecosystem, we're helping partners fortify and deliver solutions capable of addressing today's unprecedented security challenges and threats.

    Together, we'll invest in partner enablement and technical training programs designed to help build stronger security practices and create long-term customer success.

    Looking ahead

    Cyber resilience is no longer just a technology objective; it’s a business imperative. As organizations across the Gulf continue to accelerate digital transformation, security teams need solutions that reduce complexity, improve operational efficiency, and help them stay ahead of an evolving threat landscape.

    Rapid7 and Mindware share a common belief that the future of cybersecurity is built through collaboration. By bringing together global cybersecurity innovation, regional expertise, and a shared commitment to partner success, we're helping organizations across the Middle East strengthen cyber resilience while enabling partners to grow with confidence.

    We're excited about what's ahead and look forward to working with our partners to build a stronger cybersecurity ecosystem across the region.

    Ready to grow with Rapid7? Learn more about the Rapid7 PACT Partner Program and discover how we're helping partners deliver stronger cybersecurity outcomes across the Middle East.

    ]]>         <![CDATA[watchOS 27 Public Beta Is Now Available: Here’s How to Install It]]> https://tsecurity.de/de/3666612/ios-mac-os/watchos-27-public-beta-is-now-available-heres-how-to-install-it/ https://tsecurity.de/de/3666612/ios-mac-os/watchos-27-public-beta-is-now-available-heres-how-to-install-it/ Tue, 14 Jul 2026 02:08:27 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[OpenClaw becomes a nonprofit foundation as it seeks to be ‘the Switzerland of AI’]]> https://tsecurity.de/de/3666484/it-nachrichten/openclaw-becomes-a-nonprofit-foundation-as-it-seeks-to-be-the-switzerland-of-ai/ https://tsecurity.de/de/3666484/it-nachrichten/openclaw-becomes-a-nonprofit-foundation-as-it-seeks-to-be-the-switzerland-of-ai/ Mon, 13 Jul 2026 23:17:44 +0200 📰 IT Nachrichten tsecurity.de

    OpenClaw’s announcement that it has become a nonprofit foundation is generating IT excitement because of the potential for governance and development consistency that the popular platform has thus far lacked. Still, some worry about the risks created by the move. 

    “Our ambition is for OpenClaw to be the Switzerland of AI. Neutral ground where every model and every lab can plug into the technology and collaborate on standards in the era of agents,” OpenClaw said in a post. “That work is already underway in Foundation-convened councils on agent identity, agent profiles, evals, and enterprise deployment.”

    The statement, co-authored by OpenClaw creator Peter Steinberger, pointed out, “the great open source projects of our time — Linux, Apache, Mozilla — endure because a neutral steward stands behind them. That is the role we are taking on to keep OpenClaw MIT licensed, open, and independent so that everyone building on it can trust it will be here for the long term.”

    But it reassured users that the original OpenClaw leadership is still in charge.

    “Peter built this thing and Peter keeps making the calls, especially the technical ones. Since joining OpenAI earlier this year, he has continued to steward OpenClaw as an open and independent project, and OpenAI has made a commitment to keep it that way,” the post said. “The foundation is here to serve: good governance, stable funding, and paying the people who keep the claws alive.”

    However, some analysts and consultants were skeptical about how much true independence Steinberger would have, given his salaried role with OpenAI. 

    Neutrality claim in question

    “The Switzerland of AI neutrality claim collapses under its own announcement,” said Noah Kenney, principal consultant at Digital 520. “OpenAI runs a team [at OpenAI] called Claw Labs that Peter leads and OpenAI is a major donor to OpenClaw. The ‘neutral steward’s’ chief technical decision maker is employed by one of the competing labs it is supposed to be neutral with.” To OpenAI, he said, OpenClaw is closer to a tax-exempt nonprofit subsidiary than it is to a neutral ‘Switzerland of AI.’

    He pointed out that, in addition, Microsoft is shipping the enterprise version of OpenClaw, and Nvidia is shipping the hardware bundle. “This is being called the Switzerland of AI, but Switzerland does not have its central bank run by France,” he observed.

    Kenney said that what the new OpenClaw has actually built is “a shared dependency that several competitors fund, staff, and steer, wrapped in a nonprofit structure. Enterprise IT should understand that structure, because treating OpenClaw as neutral is a mistake,” adding that CIOs need to look at this development devoid of the emotional component. 

    “There is a strategic irony here that CIOs should sit with,” Kenney said. “If OpenClaw succeeds at becoming the universal agent substrate, then every model plugs into the same identity layer, the same profiles, and the same deployment plumbing. The thing every vendor is racing to own becomes a commodity that nobody owns.” He pointed out that, in the short term, that is genuinely good news for buyers because it means less lock-in and more portability.

    “But,” he said, “when the connective tissue is free and natural, the only labs that benefit are the ones with the best models and the deepest distribution. Commoditize the layer below you and you compete on the layer where you are already strongest. The foundation is not a charity. It is the biggest players agreeing to stop fighting over the plumbing so they can fight over the water, and the enterprise is the one paying the water bill either way.”

    Good news, bad news

    Jason Andersen, principal analyst at Moor Insights & Strategy, liked the potential consistency that could emerge from the structural change, given the complexity of agent development today. 

    “We are seeing a lot of OpenClaw variants hit the market, such as those from Nvidia as well as competing products from cloud and SaaS vendors. A common base helps solidify the common parts,” Andersen noted. “That said, a common challenge is the sustainability of these open source foundations over time. In addition to releasing code, these foundations need funding to evolve and grow. And that funding needs to come from continued momentum to incentivize existing members to increase investment and recruit new members to join.”

    Andersen stressed that IT buyers need to keep an eye on the roadmap for any OpenClaw variant they choose to deploy, “as that will directly impact the foundation, and the momentum of the foundation and common base. If the common base loses momentum, it can lead to forks, or just a loss of innovation. When that happens, members tend to back away, which puts customers in limbo.”

    But not everyone sees the promised structure as entirely good for IT.

    Ishraq Khan, CEO at coding productivity tool vendor Kodezi, said, “most CIOs do not want to bet their future entirely on a single model vendor. They want Claude for some workloads, GPT for others, open models for sensitive environments, and potentially internally fine-tuned systems for specific use cases. The problem is that every vendor currently brings its own identity system, tool interfaces, permissions model, and operational assumptions. That fragmentation does not scale.”

    He said, “the risk if standards fail is straightforward: every vendor builds its own closed ecosystem, enterprises become locked into individual stacks, and security becomes dramatically harder. The opportunity if OpenClaw succeeds is equally significant: enterprises get portable agents, common identity standards, interoperable tooling, and a healthier competitive market around models rather than ecosystems.”

    Will it remain a nonprofit?

    However, said Justin Greis, CEO of consulting firm Acceligence, one of the key details that IT executives will want to keep in mind is that OpenAI also began as a nonprofit, but it was quickly seen as not adhering to nonprofit objectives. 

    “OpenAI’s transition from a nonprofit research organization into a more complex structure highlighted the challenge of maintaining mission alignment while scaling technology, capital, partnerships, and commercial operations,” Greis said. “OpenClaw has the opportunity to address some of those governance questions earlier by establishing clear principles around neutrality, transparency, and decision-making before the ecosystem becomes even larger and more valuable.”

    He noted, “we have seen this pattern before with technologies like Linux and Kubernetes. The strongest open ecosystems succeeded because they created trusted foundations that enterprises could build upon. The technology was important, but the governance model that underpinned it was equally critical.”

    Risks are ‘squarely in IT’s lap’

    Consultant Brian Levine, executive director of FormerGov, echoed Greis’ concerns. 

    “CIOs shouldn’t assume that this nonprofit will always be a nonprofit, or confuse being a nonprofit with actually being neutral or unbiased,” he said. “The risks are squarely in IT’s lap: autonomous agents ‘with their own identity’ acting on a user’s behalf blow straight through traditional IAM assumptions. Issues, such as agent identity, auditability, secret handling. Identity boundaries have not yet been reliably solved. Until they are, enterprises should treat OpenClaw agents like privileged service accounts, not like a browser plugin.”

    Independent cybersecurity and risk advisor Steven Eric Fisher pointed to another IT exposure that might come from this OpenClaw transition: Cost.

    “OpenClaw currently has a very high token burn rate in usage, which presents a significant cost consideration for large-scale enterprise adoption,” he said. “The skills marketplace introduces a new supply chain threat that enterprises will need to manage. Threat management, and specifically handling external marketplace elements, can be highly challenging for open-source operations. Ultimately, at scale, enterprise adoption could become a difficult balancing act between managing high operational costs and securing an expanded security surface.”

    ]]>         <![CDATA[What Is Storage Virtualization? Everything You Need to Know About the Virtualization of Storage]]> https://tsecurity.de/de/3666305/unix-server/what-is-storage-virtualization-everything-you-need-to-know-about-the-virtualization-of-storage/ https://tsecurity.de/de/3666305/unix-server/what-is-storage-virtualization-everything-you-need-to-know-about-the-virtualization-of-storage/ Mon, 13 Jul 2026 22:01:24 +0200 🐧 Unix Server tsecurity.de Storage infrastructure has grown very complex over the past few years, and the old model of managing physical disks one by one just doesn’t scale anymore. Storage virtualization reduces that complexity by creating a layer of abstraction between your physical storage hardware and the systems that use it. The result is a single, manageable pool […]

    The post What Is Storage Virtualization? Everything You Need to Know About the Virtualization of Storage appeared first on SUSE Communities.

    ]]>         <![CDATA[Weather grows as one of data center growth’s greatest risks]]> https://tsecurity.de/de/3666279/it-security-nachrichten/weather-grows-as-one-of-data-center-growths-greatest-risks/ https://tsecurity.de/de/3666279/it-security-nachrichten/weather-grows-as-one-of-data-center-growths-greatest-risks/ Mon, 13 Jul 2026 21:53:18 +0200 📰 IT Security Nachrichten tsecurity.de

    AI-driven hyperscale data centers are creating a new generation of risks and challenges that extend well beyond power shortages and chip supply, according to a new report from Zurich North America.

    The unprecedented scale, speed and complexity of AI data center construction are exposing the industry to new threats previously unknown to the older generation of data centers, ranging from severe weather and energy constraints to insurance capacity, labor shortages and geopolitical disruptions, in its report, “Data Center Risks Right Now: Six Critical Questions to Enable a Resilient Buildout.”

    The report states that hyperscalers are prepared to spend an estimated $710 billion in capital expenditures during 2026, and global investment in data centers is projected to top $7 trillion by 2030. New capacity added between 2026 and 2030 is expected to total roughly 100 gigawatts, equivalent to the peak electricity demand of about nine New York Cities.

    Much of that is because these new data centers are not like any previous generations of  data center development in that modern AI campuses can span up to 20 buildings, consume as much as 2,000 megawatts of electricity and house billions of dollars’ worth of servers and cooling equipment.

    In addition, insurance providers are struggling to keep pace with the massive growth in projected value of these data centers.  Zurich says the average value of the data centers it insured has jumped from roughly $150 million five years ago to about $3 billion today, while the largest campuses can be measured in the tens of billions of dollars.

    The report cited six areas of concern, the primary of which is growing: severe weather.   Severe weather has surpassed fire as leading construction threat due to changing geography. Zurich states that 64% of U.S. data center capacity currently under construction is located outside traditional markets such as Northern Virginia, in areas are known for bad weather.

    They include West Texas, Tennessee, Wisconsin and Ohio, where tornadoes, hailstorms and high winds present new hazards. Zurich says severe weather has become the largest source of losses in its U.S. builders-risk portfolio over the past three years, surpassing fire as the industry’s dominant construction threat. Weather accounts for 32% of losses in Zurich’s data center portfolio, followed by fire and equipment damage.

    The second issue is compressed construction schedules. Operators are increasingly beginning operating portions of a campus where construction is complete and while construction continues elsewhere. That means welding and other, heavy equipment plus incomplete fire protection coexist with active server halls containing sensitive computing equipment.

    Beyond construction and to absolutely no surprise, Zurich identifies energy infrastructure as one of the defining challenges facing AI expansion. The report notes that U.S. data center electricity demand increased roughly 22% in a single year and is expected to nearly triple to approximately 134 gigawatts by 2030.

    Likewise, water availability is becoming equally important as power as AI workloads generate more heat and require increasingly sophisticated cooling systems. The report notes that many operators are deploying closed-loop water recycling systems or shifting toward air cooling where possible in a bid to reduce water consumption.

    Downtime has become more expensive because so much expensive equipment is involved, even minor operational failures can become multimillion-dollar events.

    The report also warns that replacement equipment often requires months to arrive, citing industry estimates that switchgear may take up to 85 weeks to replace and generators as long as 100 weeks.

    Workforce shortages have raised operational concerns as the AI construction boom is straining the labor market, and they don’t mean The IT staff to run the place, they need people to build it. Zurich cited a report from Associated General Contractors of America that 92% of U.S. construction firms are having difficulty finding qualified workers.

    The report concludes that geopolitical tensions, regulatory scrutiny and emerging technologies will increasingly influence where and how data centers are built. Among the trends Zurich identifies are growing political concern over electricity prices and water consumption, increased reliance on nuclear energy, interest in integrating future quantum computing systems and even early proposals for orbital data centers supported by solar power.

    ]]>         <![CDATA[CVE-2026-10103 | Mattermost up to 10.11.19/11.6.4/11.7.2 Shared Channel Inbound Sync improper synchronization (WID-SEC-2026-1932)]]> https://tsecurity.de/de/3666077/sicherheitsluecken/cve-2026-10103-mattermost-up-to-10111911641172-shared-channel-inbound-sync-improper-synchronization-wid-sec-2026-1932/ https://tsecurity.de/de/3666077/sicherheitsluecken/cve-2026-10103-mattermost-up-to-10111911641172-shared-channel-inbound-sync-improper-synchronization-wid-sec-2026-1932/ Mon, 13 Jul 2026 19:51:26 +0200 🕵️ Sicherheitslücken tsecurity.de critical has been identified in Mattermost up to 10.11.19/11.6.4/11.7.2. Affected by this issue is some unknown functionality of the component Shared Channel Inbound Sync Handler. The manipulation results in improper synchronization. This vulnerability was named CVE-2026-10103. The attack may be performed from remote. There is no available exploit.]]> <![CDATA[AI is killing low cost smartphones]]> https://tsecurity.de/de/3666045/it-nachrichten/ai-is-killing-low-cost-smartphones/ https://tsecurity.de/de/3666045/it-nachrichten/ai-is-killing-low-cost-smartphones/ Mon, 13 Jul 2026 19:32:57 +0200 📰 IT Nachrichten tsecurity.de

    Except for the second user/refurbished smartphone markets, AI means the days of cheap phones are over, with huge price pressures putting low-end vendors out of business. 

    Omdia data confirms that Apple and Samsung are undisputed kings of the hill, combining for 42% of the market even as smartphone sales overall have seen a 4% average decline. 

    The two companies increased market share by 4% (Apple) and 2% (Samsung) compared with 2Q25. Meanwhile, the situation is becoming much worse for smaller vendors as memory prices spiral, leaving their businesses under immense strain. Data from Counterpoint Research tells a similar story, indicating Apple growth against a background of market decline. 

    It’s important to put the impact of raised RAM costs into perspective. While Apple and Samsung make products at the kind of scale that enables them to cut better deals, smaller makers don’t have the same advantage, leaving them far more exposed to memory price driven pressures.  

    Memory prices are crushing the low end

    And they really are exposed; not only are sales declining, but Omdia analyst Runar Bjorhovde notes that vendors at that end of the market are dealing with hugely destructive DRAM price hikes over just the past year — up to four or five times higher in some cases. That degree of increase is the kind of business-focused tsunami that drives people out of the market altogether and certainly leaves companies exposed to M&A activity.

    Right now, memory and storage can account for more than 60% of the product cost, Bjorhovde said. And as costs continue to increase, what profitability that does exist in the low-cost, high competition lower end smartphone space is being utterly mauled. Omdia forecasts a 22% decline in the sub-$400 smartphone segment as a result.

    “Samsung Electronics and Apple — the two market leaders — made huge market share gains…, whereas most players beyond went through steep volume declines,” Bjorhovde said.

    From volume to value

    Apple’s decision to expand its addressable market with the iPhone ‘e’ series just adds pressure, while Samsung’s enduring popularity helps make it difficult for smaller vendors to generate profit through market scale. “To adapt, vendors are shifting their strategies from volume to value by reoptimizing portfolios and adjusting retail pricing,” he said. 

    “Although memory and storage costs are the biggest challenges for vendors, they are far from the only challenge,” Bjorhovde said. “New semiconductor bottlenecks, such as within foundries, are adding further cost pressures.”

    With the cost of manufacturing set to continue to rise, it’s generally accepted that we’ll see the average selling price of smartphones climb in the coming 12 months, with Apple set to lead the market toward higher cost builds with the new Pro and Ultra iPhones this September.

    Apple’s decision to hold smartphone prices so far has added another price pressure to low-end vendors; the longer it holds its prices down, the longer and more painful will smaller vendors hang onto their own low-price structure to compete.

    Future shock: AI hardware

    A further wild card is in Apple’s recent lawsuit against OpenAI, which accuses the ChatGPT maker of “illegal reliance on misappropriated trade secrets” in its hardware plans. OpenAI is thought to be planning an AI-driven iPhone competitor.

    We’ve heard speculation about these plans before, of course. But what seems to be emerging in the wake of Apple’s litigation are hints OpenAI intends to introduce its first AI hardware product at some point in 2027.

    Assuming that schedule remains on track, OpenAI will likely impose further component pricing pressure across the whole industry. After all, Apple’s customer loyalty leads the industry, and Samsung has built something similar. So, the companies with the most to lose to OpenAI will be the same set of smaller vendors who are already struggling with component price-driven market complexity.

    OpenAI products will demand the same memory, similar processors, manufacturing, and other components as other devices, prompting further pricing pressure. That’s likely to put some small vendors out of business entirely, even as standard smartphone prices increase. 

    Fragmentation will be next

    Those outcomes won’t be universal, as the desire for sovereign data services and growing mistrust of US tech companies suggest OpenAI’s products might see limited adoption in most markets. But they could serve to accelerate divergence in smartphone purchasing patterns worldwide, while adding to market pressure.

    You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon, and subscribe to The Core.

    ]]>         <![CDATA[What is devops? Bringing dev and ops together to build better software]]> https://tsecurity.de/de/3665673/ai-nachrichten/what-is-devops-bringing-dev-and-ops-together-to-build-better-software/ https://tsecurity.de/de/3665673/ai-nachrichten/what-is-devops-bringing-dev-and-ops-together-to-build-better-software/ Mon, 13 Jul 2026 17:04:38 +0200 🔧 AI Nachrichten tsecurity.de

    A portmanteau of “development” and “operations,” devops emerged as a way of bringing together two previously separate groups responsible for the building and deploying of software.

    In the old world, developers (devs) typically wrote code before throwing it over to the system administrators (operations, or ops) to deploy and integrate that code. But as the industry shifted towards agile development and cloud-native computing, many organizations reoriented around modern, cloud-native practices in the pursuit of faster, better releases.

    This required a new way to perform these key functions in a more streamlined, efficient, and cohesive way, one where the old frustrations of disconnected dev and ops functions would be eliminated. With two groups working together, developers can rapidly roll out small code enhancements via continuous integration and delivery rather than spending years on “big bang” product releases.

    Devops was born at cloud-native companies like Facebook, Netflix, Spotify, and Amazon; but it’s become one of the defining technology industry trends of the past decade, primarily because it bridges so many of the changes that have shaped modern software development.

    As agile development and cloud-native computing have become ubiquitous, devops has enabled the entire industry to speed up its software development cycles. Thus, devops has now thoroughly infiltrated the enterprise, especially in organizations that rely on software to run their business, such as banks, airlines, and retailers. And it’s spawned a host of other “ops” practices, some of which we’ll touch on here.[JF1] 

    Devops practices

    Devops requires a shift in mindset from both sides of the dev and ops divide. Development teams should focus on learning and adopting agile processes, standardizing platforms, and helping drive operational efficiencies. Operations teams must now focus on improving stability and velocity, while also reducing costs by working hand in hand with the developer team.

    Broadly speaking, these teams need to all speak a common language and there needs to be a shared goal and understanding of each other’s key skills for devops to thrive.

    More specifically, engineers Damon Edwards and John Willis created the CALMS model to bring together what are commonly understood to be the key principles of devops:

    • Culture: One that embraces agile methodologies and is open to change, constant improvement, and accountability for the end-to-end quality of software.
    • Automation: Automating away toil is a key goal for any devops team.
    • Lean: Ensuring the smooth flow of software through key steps as quickly as possible.
    • Measurement: You can’t improve what you don’t measure. Devops pushes for a culture of constant measurement and feedback that can be used to improve and pivot as required, on the fly.
    • Sharing: Knowledge sharing across an organization is a key tenet of devops.

    “Who could go back to the old way of trying to figure out how to get your laptop environment looking the same as the production environment? All these things make it so clear that there’s a better way to work. I think it’s very tough to turn back once you’ve done things like continuous integration, like continuous delivery. Once you’ve experienced it, it’s really tough to go back to the old way of doing things,” Kim told InfoWorld.

    What is a devops engineer?

    Naturally, the emergence of devops has spawned a whole new set of job titles, most prominent of which is the catch-all devops engineer.

    Generally speaking, this role is the natural evolution of the system administrator — but in a world where developers and ops work in close tandem to deliver better software. This person should have a blend of programming and system administrator skills so that he or she can effectively bridge those two sides of the team.

    That bridging of the two sides requires strong social skills more than technical. As Kim put it, “one of the most important skills, abilities, traits needed in these pioneering rebellions — using devops to overthrow the ancient powerful order, who are very happy to do things the way they have for 30 to 40 years — are the cross-functional skills to be able to reach across the table to their business counterparts and help solve problems.”

    This person, or team of people, will also have to be a born optimizer, tasked with continually improving the speed and quality of software delivery from the team, be that through better practices, removing bottlenecks, or applying automation to smooth out software delivery.

    The good news is that these skills are valuable to the enterprise. Salaries for this set of job titles have risen steadily over the years, with 95% of devops practitioners making more than $75,000 a year in salary in 2020 in the United States. In Europe and the UK, where salaries are lower across the board, 71% made more than $50,000 a year in 2020, up from 67% in 2019.

    Key devops tools

    While devops is at its heart a cultural shift, a set of tools has emerged to help organizations adopt devops practices.

    This stack typically includes infrastructure as code, configuration management, collaboration, version control, continuous integration and delivery (CI/CD), deployment automation, testing, and monitoring tools.

    Here are some of the tools/categories that are increasingly relevant in 2025, and what is changing:

    • CI/CD and delivery automation: Traditional tools like Jenkins remain in many stacks, but newer orchestration tools and CLI-driven or GitOps-centric platforms are growing in importance (e.g. ArgoCD, Flux, Tekton). Also, platforms that integrate more tightly with monitoring, secrets management, drift detection, and policy enforcement are gaining traction.
    • Security, compliance, and devsecops tooling: Security tools are increasingly integrated into devops pipelines. Expect to see more use of static analysis (SAST), dynamic testing (DAST), dependency and supply chain scanning (SCA), secret management, and policy as code. The push is toward embedding security earlier and bridging gaps between dev, security, and machine learning teams. (InfoWorld:)
    • AI  and automation augmentation: AI-assisted tools are increasingly part of tooling stacks: auto-suggestions in CI/CD, anomaly detection, predictive scaling, intelligent test suite selection, and more. The hope is that these tools will reduce manual interventions and improve reliability. Tools that are “AI ready”—that is, they integrate well with AI or have mature built-in automation or assistance—increasingly stand out from the pack.

    Devops challenges

    Even as devops becomes more widely adopted, there remain real obstacles that can slow progress or limit impact. One major challenge is the persistent skills gap. The modern devops engineer (or team) is expected to master not just source control, CI/CD, and scripting, but also cloud architecture, infrastructure as code, security best practices, observability, and strong cross-team communication. In many organizations these capabilities are uneven: some teams excel, others lag behind. A 2024 survey showed that while 83% of developers report participating in devops activities, using multiple CI/CD tools was correlated with worse performance — a sign that complexity without deep expertise can backfire.

    Toolchain fragmentation and complexity is a related issue. Devops toolchains have sprouted into a sometimes bewildering array of packages and techniques to master: version control, CI build/test, security scanning, artifact management, monitoring, observability, deployment, secret management, and more.

    The more tools you have, the more difficult it becomes to integrate them cleanly, manage their versions, ensure compatibility, and avoid duplicated effort. Organizations often get stuck with “tool sprawl” — tools chosen by different teams, legacy systems, or overlapping functionalities — which introduce friction, maintenance burden, and sometimes vulnerabilities.

    Finally, although devops has spread far and wide, there is still cultural resistance and alignment. Devops isn’t just about tools and processes; it’s about collaboration, shared responsibility, and continuous feedback. Teams rooted in traditional silos (dev vs ops, or security separate) may resist changes to roles and workflows. Leadership support, communication of shared goals, trust, and allowance for continuous learning are all necessary.

    Many CIOs focus too much on tools or implementation first, rather than organizational culture and behaviors; but without addressing culture, even the best tools or processes may not yield the hoped-for velocity, quality, or reliability. Organizations that succeed here tend to have proactive strategies: dedicated training programs, mentorship, internal “guilds,” pairing junior and senior engineers, and making sure leadership supports ongoing learning rather than one-off bootcamps.

    Why do devops?

    Whoever you ask will tell you that devops is a major culture shift for organizations, so why go through that pain at all?

    Devops aims to combine the formerly conflicting aims of developers and system administrators. Under its principles, all software development aims to meet business demands, add functionality, and improve the usability of applications while also ensuring those applications are stable, secure, and reliable. Done right, this improves the velocity and quality of your output, while also improving the lives of those working on these outcomes.

    Does devops save money — or add cost?

    Devops teams are recognizing that speed and agility are only part of success — unchecked cloud bills and waste undermine long-term sustainability. Waste in devops often comes in the form of “devops debt”— idle cloud capacity, dead code, or false-positive security alerts—which was called a “hidden tax on innovation” in recent Java-environment studies.

     Embedding finops practices can help fight these costs. Teams should shift left on cost: estimating costs when spinning up new environments, resizing instances, and scaling down unused resources before they become runaway expenses.

    How to start with devops

    There are lots of resources for help getting started with devops, including Kim’s own Devops Handbook, or you can enlist the help of external consultants. But you have to be methodical and focus on your people more than on the tools and technology you will eventually use if you want to ensure lasting buy-in across the business.

    A proven route to achieving this is a “land and expand” strategy, where a small group starts by mapping key value streams and identifying a single product team or workload for trialing devops practices. If this team is successful in proving the value of the shift, you will likely start to get interest from other teams and from senior leadership.

    If you are at the start of your devops journey, however, make sure you are prepared for the disruption a change like this can have on your organization, and keep your eye on the prize of building better, faster, stronger software.

    More on devops:

    ]]>         <![CDATA[The complete guide to Node.js frameworks]]> https://tsecurity.de/de/3665672/ai-nachrichten/the-complete-guide-to-nodejs-frameworks/ https://tsecurity.de/de/3665672/ai-nachrichten/the-complete-guide-to-nodejs-frameworks/ Mon, 13 Jul 2026 17:04:36 +0200 🔧 AI Nachrichten tsecurity.de

    Node.js is one of the most popular server-side platforms, especially for web applications. It gives you non-blocking JavaScript without a browser, plus an enormous ecosystem. That ecosystem is one of Node’s chief strengths, making it a go-to option for server development.

    This article is a quick tour of the most popular web frameworks for server development on Node.js. We’ll look at minimalist tools like Express.js, batteries-included frameworks like Nest.js, and full-stack frameworks like Next.js. You’ll get an overview of the frameworks and a taste of what it’s like to write a simple server application in each one.

    Minimalist web frameworks

    When it comes to Node web frameworks, minimalist doesn’t mean limited. Instead, these frameworks provide the essential features required to do the job for which they are intended. The frameworks in this list also tend to be highly extensible, so you can customize them as needed. With minimalist frameworks, pluggable extensibility is the name of the game.

    Express.js

    At over 47 million weekly downloads on npm, Express is one of the most-installed software packages of all time—and for good reason. Express gives you basic web endpoint routing and request-and-response handling inside an extensible framework that is easy to understand. Most other frameworks in this category have adopted the basic style of describing a route from Express. This framework is the obvious choice when you simply need to create some routes for HTTP, and you don’t mind a DIY approach for anything extra.

    Despite its simplicity, Express is fully-featured when it comes to things like route parameters and request handling. Here is a simple Express endpoint that returns a dog breed based on an ID:

    import express from 'express';

const app = express();
const port = 3000;

// In-memory array of dog breeds
const dogBreeds = [
  "Shih Tzu",
  "Great Pyrenees",
  "Tibetan Mastiff",
  "Australian Shepherd"
];
app.get('/dogs/:id', (req, res) => {
  // Convert the id from a string to an integer
  const id = parseInt(req.params.id, 10);

  // Check if the id is a valid number and within the array bounds
  if (id >= 0 && id  {
  console.log(`Server running at http://localhost:${port}`);
});

    You can easily see how the route is defined here: a string representation of a URL, followed by a function that receives a request and response object. The process of creating the server and listening on a port is simple.

    If you are coming from a framework like Next, the biggest thing you might notice about Express is that it lacks a file-system based router. On the other hand, it offers a huge range of middleware plugins to help with essential functions like security.

    Koa

    Koa was created by the original creators of Espress, who took the lessons learned from that project and used them for a fresh take on the JavaScript server. Koa’s focus is providing a minimalist core engine. It uses async/await functions for middleware rather than chaining with next() calls. This can give you a cleaner server, especially when there are many plugins. It also makes the error handling less clunky for middleware.

    Koa also differs from Express by exposing a unified context object instead of separate request and response objects, which makes for a somewhat less cluttered API. Here is how Koa manages the same route we created in Express:

    router.get('/dogs/:id', (ctx) => {
  const id = parseInt(ctx.params.id, 10);

  if (id >= 0 && id < dogBreeds.length) {
    ctx.status = 200;
    ctx.body = { breed: dogBreeds[id] };
  } else {
    ctx.status = 404;
    ctx.body = { error: 'Dog breed not found' };
  }
});

    The only real difference is the combined context object.

    Koa’s middleware mechanism is also worth a look. Here’s a simple logging plugin in Koa:

    const logger = async (ctx, next) => {
  await next(); // This passes control to the router
  console.log(`${ctx.method} ${ctx.url} - ${ctx.status}`);
};

// Use the logger middleware for all requests
app.use(logger);

    Fastify

    Fastify lets you define schemas for your APIs. This is an up-front, formal mechanism for describing what the server supports:

    const schema = {
  params: {
    type: 'object',
    properties: {
      id: { type: 'integer' }
    }
  },
  response: {
    200: {
      type: 'object',
      properties: {
        breed: { type: 'string' }
      }
    },
    404: {
      type: 'object',
      properties: {
        error: { type: 'string' }
      }
    }
  }
};

fastify.get('/dogs/:id', { schema }, (request, reply) => {
  const id = request.params.id;

  if (id >= 0 && id  {
  if (err) {
    fastify.log.error(err);
    process.exit(1);
  }
  console.log(`Server running at ${address}`);
});

    From this example, you can see the actual endpoint definition is similar to Express and Koa, but we define a schema for the API. The schema is not strictly necessary; it is possible to define endpoints without it. In that case, Fastify behaves much like Express, but with superior performance.

    Hono

    Hono emphasizes simplicity. You can define a server and endpoint with as little as:

    const app = new Hono()
app.get('/', (c) => c.text('Hello, Infoworld!'))

    And here’s how our dog breed example looks:

    app.get('/dogs/:id', (c) => {
  // Get the id parameter from the request URL
  const id = parseInt(c.req.param('id'), 10);

  // Check if the id is a valid number and within the array bounds
  if (id >= 0 && id < dogBreeds.length) {
    // Return a JSON response with a 200 OK status (default)
    return c.json({ breed: dogBreeds[id] });
  } else {
    // Set status to 404 and return a JSON error message
    c.status(404);
    return c.json({ error: 'Dog breed not found' });
  }
});

    As you can see, Hono provides a unified context object, similar to Koa.

    Nitro.js

    Nitro is the back end for several full-stack frameworks, including Nuxt.js. As part of the UnJS ecosystem, Nitro goes further than Express in providing cloud-native tooling support. It includes a universal storage adapter and deployment support for serverless and cloud deployment targets.

    Also see: Intro to Nitro: The server engine built for modern JavaScript.

    Like Next.js, Nitro uses filesystem-based routing, so our Dog Finder API would exist at the following filepath:

    /api/dogs/:id

    The handler might look like this:

    export default defineEventHandler((event) => {
  // Get the dynamic parameter from the event context
  const { id } = getRouterParams(event);
  const parsedId = parseInt(id, 10);

  // Check if the id is a valid number and within the array bounds
  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    // Nitro handles JSON serialization
    return { breed: dogBreeds[parsedId] };
  } else {
    setResponseStatus(event, 404);
    return { error: 'Dog breed not found' };
  }
});

    Nitro inhabits the middle ground between a pure tool like Express and a full-blown stack, which is why full-stack front ends often use Nitro on the back end.

    Batteries-included frameworks

    Although Express and other minimalist frameworks set the standard for simplicity, more opinionated frameworks can be useful if you want additional features out of the box.

    Nest.js

    Nest is a progressive framework built with TypeScript from the ground up. Nest is actually a layer on top of Express (or Fastify), with additional services. It is inspired by Angular and incorporates the kind of architectural support found there. In particular, it includes dependency injection. Nest also uses annotated controllers for endpoints.

    Also see: Intro to Nest.js: Server-side JavaScript development on Node.

    Here is an example of injecting a dog finder provider into a controller:

    // The provider:
import { Injectable, NotFoundException } from '@nestjs/common';

// The @Injectable() decorator marks this class as a provider.
@Injectable()
export class DogsService {
  private readonly dogBreeds = [
    "Shih Tzu",
    "Great Pyrenees",
    "Tibetan Mastiff",
    "Australian Shepherd"
  ];

  findOne(id: number) {
    if (id >= 0 && id < this.dogBreeds.length) {
      return { breed: this.dogBreeds[id] };
    }
    // NestJS has built-in HTTP exception classes for common errors.
    throw new NotFoundException('Dog breed not found');
  }
}

// The controller

import { Controller, Get, Param, ParseIntPipe } from '@nestjs/common';
import { DogsService } from './dogs.service';

@Controller('dogs')
export class DogsController {
  // NestJS injects the DogsService through the constructor.
  // The 'private readonly' syntax is a TypeScript shorthand
  // to both declare and initialize the dogsService member.
  constructor(private readonly dogsService: DogsService) {}

  @Get(':id')
  findOneDog(@Param('id', ParseIntPipe) id: number) {
    // We can now use the service's methods. The ParseIntPipe
    // automatically converts the string URL parameter to a number.
    return this.dogsService.findOne(id);
  }
}

    This style is typical of dependency injection frameworks like Angular, as well as Spring. It allows you to declare components as injectable, then consume them anywhere you need them.

    In Nest, we’d just add these as modules to make them live.

    Adonis.js

    Like Nest, Adonis provides a controller layer that you wire together with routes. Adonis is inspired by the model-view-controller (MVC) pattern, so it also includes a layer for modelling data and accessing stores via an ORM. Finally, it provides a validator layer for ensuring data meets requirements.

    Routes in Adonis are very simple:

    Route.get('/dogs/:id', [DogsController, 'show'])

    In this case, DogsController would be the handler for the route, and might look something like:

    import type { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'  // Note, ioc means inversion of control, similar to dependency injection

export default class DogsController {
  // The 'show' method handles the logic for the route
  public async show({ params, response }: HttpContextContract) {
    const id = Number(params.id);

    // Check if the id is a valid number and within the array bounds
    if (!isNaN(id) && id >= 0 && id < this.dogBreeds.length) {
      // Use the response object to send a 200 OK JSON response
      return response.ok({ breed: this.dogBreeds[id] });
    } else {
      // Send a 404 Not Found response
      return response.notFound({ error: 'Dog breed not found' });
    }
  }
}

    Of course, in a real application, we could define a model layer to handle the actual data access.

    Sails

    Sails is another MVC-style framework. It is one of the original one-stop-shopping frameworks for Node and includes an ORM layer (Waterline), API generation (Blueprints), and realtime support, including WebSockets.

    Sails strives for conventional operation. For example, here’s how you might define a simple model for dogs:

    /**
 * Dog.js
 *
 * @description :: A model definition represents a database table/collection.
 * @docs        :: https://sailsjs.com/docs/concepts/models
 */
module.exports = {
  attributes: {
    breed: { type: 'string', required: true },
  },
};

    If you run this in Sails, the framework will generate default routes and wire up a NoSQL or SQL datastore based on your configuration. Sails also provides the option to override these defaults and add in your own custom logic.

    Full-stack frameworks

    Also known as meta-frameworks, these tools combine a front-end framework with a solid back end and various CLI niceties like build chains.

    Next.js

    Next is a React-based framework built by Vercel. It is largely responsible for the huge growth in popularity of these types of frameworks. Next was the first framework to bring together back-end API definitions with the front end that consumes them. It also introduced file-system routing. In Next and other full-stack frameworks, you get both parts of your stack in one place and you can run them together during development.

    In Next, we could define a route at pages/api/dogs/[id].js like so:

    export default function handler(req, res) {
  // `req.query.id` comes from the dynamic filename [id].js
  const { id } = req.query;
  const parsedId = parseInt(id, 10);

  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    // If the ID is valid, return the data
    res.status(200).json({ breed: dogBreeds[parsedId] });
  } else {
    // Otherwise, return a 404 error
    res.status(404).json({ error: 'Dog breed not found' });
  }
}

    We’d then define the UI component to interact with this route at pages/dogs/[id].js:

    import React from 'react';

// This is the React component that renders the page.
// It receives the `dog` object as a prop from getServerSideProps.
function DogPage({ dog }) {
  // Handle the case where the dog wasn't found
  if (!dog) {
    return 
    Dog Breed Not Found
    ;
  }

  return (
    
    
      
    Dog Breed Profile
    
      
    Breed Name: {dog.breed}
    
    
    
  );
}

// This function runs on the server before the page is sent to the browser.
export async function getServerSideProps(context) {
  const { id } = context.params; // Get the ID from the URL

  // Fetch data from our own API route on the server.
  const res = await fetch(`http://localhost:3000/api/dogs/${id}`);
  
  // If the fetch was successful, parse the JSON.
  const dog = res.ok ? await res.json() : null;

  // Pass the fetched data to the DogPage component as props.
  return {
    props: {
      dog,
    },
  };
}

export default DogPage;

    Nuxt.js

    Nuxt is the same idea as Next, but applied to the Vue front end. The basic pattern is the same, though. First, we’d define a back-end route:

    // server/api/dogs/[id].js

// defineEventHandler is Nuxt's helper for creating API handlers.
export default defineEventHandler((event) => {
  // Nuxt automatically parses route parameters.
  const id = getRouterParam(event, 'id');
  const parsedId = parseInt(id, 10);

  if (parsedId >= 0 && parsedId < dogBreeds.length) {
    return { breed: dogBreeds[parsedId] };
  } else {
    // Helper to set the status code and return an error.
    setResponseStatus(event, 404);
    return { error: 'Dog breed not found' };
  }
});

    Then, we’d create the UI file in Vue:

    // pages/dogs/[id].vue


  
    
    
    
      Loading...
    
    
    
    
      
    {{ error.data.error }}
    
    
    
    
    
      
    Dog Breed Profile
    
      
    Breed Name: {{ dog.breed }}

    SvelteKit

    SvelteKit is the full-stack framework for the Svelte front end. It’s similar to Next and Nuxt, with the main difference being the front-end technology.

    In SvelteKit, a back-end route looks like so:

    // src/routes/api/dogs/[id]/+server.js

import { json, error } from '@sveltejs/kit';

// This is our data source for the example.
const dogBreeds = [
  "Shih Tzu",
  "Australian Cattle Dog",
  "Great Pyrenees",
  "Tibetan Mastiff",
];

/** @type {import('./$types').RequestHandler} */
export function GET({ params }) {
  // The 'id' comes from the [id] directory name.
  const id = parseInt(params.id, 10);

  if (id >= 0 && id < dogBreeds.length) {
    // The json() helper creates a valid JSON response.
    return json({ breed: dogBreeds[id] });
  }

  // The error() helper is the idiomatic way to return HTTP errors.
  throw error(404, 'Dog breed not found');
}

    SvelteKit usually splits the UI into two components. The first component is for loading the data (which can then be run on the server):

    // src/routes/dogs/[id]/+page.js

import { error } from '@sveltejs/kit';

/** @type {import('./$types').PageLoad} */
export async function load({ params, fetch }) {
  // Use the SvelteKit-provided `fetch` to call our API endpoint.
  const response = await fetch(`/api/dogs/${params.id}`);

  if (response.ok) {
    const dog = await response.json();
    // The object returned here is passed as the 'data' prop to the page.
    return {
      dog: dog
    };
  }

  // If the API returns an error, forward it to the user.
  throw error(response.status, 'Dog breed not found');
}

    The second component is the UI:

    // src/routes/dogs/[id]/+page.svelte




    
  
    Dog Breed Profile
    
  
    Breed Name: {data.dog.breed}

    Conclusion

    The Node.js ecosystem has moved beyond the “default-to-Express” days. Now, it is worth your time to look for a framework that fits your specific situation.

    If you are building microservices or high-performance APIs, where every millisecond counts, you owe it to yourself to look at minimalist frameworks like Fastify or Hono. This class of frameworks gives you raw speed and total control without requiring decisions about infrastructure.

    If you are building an enterprise monolith or working with a big team, batteries-included frameworks like Nest or Adonis offer useful structure. The complexity of the initial setup buys you long-term maintainability and makes the codebase more standardized for new developers.

    Finally, if your project is a content-rich web application, full-stack meta-frameworks like Next, Nuxt, and SvelteKit offer the best developer experience and the perfect profile of tools.

    It’s also worth noting that, while Node remains the standard server-side runtime, alternatives Deno and Bun have both made a name for themselves. Deno has great heritage, is open source with a strong security focus, and has its own framework, Deno Fresh. Bun is respected for its ultra-fast startup and integrated tooling.

    ]]>         <![CDATA[Cloud native explained: How to build scalable, resilient applications]]> https://tsecurity.de/de/3665670/ai-nachrichten/cloud-native-explained-how-to-build-scalable-resilient-applications/ https://tsecurity.de/de/3665670/ai-nachrichten/cloud-native-explained-how-to-build-scalable-resilient-applications/ Mon, 13 Jul 2026 17:04:33 +0200 🔧 AI Nachrichten tsecurity.de

    What is cloud native? Cloud native defined

    The term “cloud-native computing” encompasses the modern approach to building and running software applications that exploit the flexibility, scalability, and resilience of cloud computing. The phrase is a catch-all that encompasses not just the specific architecture choices and environments used to build applications for the public cloud, but also the software engineering techniques and philosophies used by cloud developers.

    The Cloud Native Computing Foundation (CNCF) is an open source organization that hosts many important cloud-related projects and helps set the tone for the world of cloud development. The CNCF offers its own definition of cloud native:

    Cloud native practices empower organizations to develop, build, and deploy workloads in computing environments (public, private, hybrid cloud) to meet their organizational needs at scale in a programmatic and repeatable manner. It is characterized by loosely coupled systems that interoperate in a manner that is secure, resilient, manageable, sustainable, and observable.

    Cloud native technologies and architectures typically consist of some combination of containers, service meshes, multi-tenancy, microservices, immutable infrastructure, serverless, and declarative APIs — this list is not exhaustive.

    This definition is a good start, but as cloud infrastructure becomes ubiquitous, the cloud native world is beginning to spread behind the core of this definition. We’ll explore that evolution as well, and look into the near future of cloud-native computing.

    Cloud native architectural principles

    Let’s start by exploring the pillars of cloud-native architecture. Many of these technologies and techniques were considered innovative and even revolutionary when they hit the market over the past few decades, but now have become widely accepted across the software development landscape.

    Microservices. One of the huge cultural shifts that made cloud-native computing possible was the move from huge, monolithic applications to microservices: small, loosely coupled, and independently deployable components that work together to form a cloud-native application. These microservices can be scaled across cloud environments, though (as we’ll see in a moment) this makes systems more complex.

    Containers and orchestration. In could-native architectures, individual microservices are executed inside containers — lightweight, portable virtual execution environments that can run on a variety of servers and cloud platforms. Containers insulate the developers from having to worry about the underlying machines on which their code will execute. That is, all they have to do is write to the container environment. 

    Getting the containers to run properly and communicate with one another is where the complexity of cloud native computing starts to emerge. Initially, containers were created and managed by relatively simple platforms, the most common of which was Docker. But as cloud-native applications got more complex, container orchestration platforms that augmented Docker’s functionality emerged, such as Kubernetes, which allows you to deploy and manage multi-container applications at scale. Kubernetes is critical to cloud native computing as we know it — it’s worth noting that the CNCF was set up as a spinoff of the Linux Foundation on the same day that Kubernetes 1.0 was announced — and adhering to Kubernetes best practices is an important key to cloud native success. 

    Open standards and APIs. The fact that containers and cloud platforms are largely defined by open standards and open source technologies is the secret sauce that makes all this modularity and orchestration possible, and standardized and documented APIs offer the means of communication between distributed components of a larger application. In theory, anyway, this standardization means that every component should be able to communicate with other components of an application without knowing about their inner workings, or about the inner workings of the various platform layers on which everything operates.

    DevOps, agile methodologies, and infrastructure as code. Because cloud-native applications exist as a series of small, discrete units of functionality, cloud-native teams can build and update them using agile philosophies like DevOps, which promotes rapid, iterative CI/CD development. This enables teams to deliver business value more quickly and more reliably.

    The virtualized nature of cloud environments also make them great candidates for infrastructure as code (IaC), a practice in which teams use tools like Terraform, Pulumi, and AWS CloudFormation, to manage infrastructure declaratively and version those declarations just like application code. IaC boosts automation, repeatability, and resilience across environments—all big advantages in the cloud world. IaC also goes hand-in-hand with the concept of immutable infrastructure—the idea that, once deployed, infastructure-level entities like virtual machines, containers, or network appliances don’t change, which makes them easier to manage and secure. IaC stores declarative configuration code in version control, which creates an audit log of any changes.

    Chart listing five things to love and five things to fear when considiering cloud native

    There’s a lot to love about cloud-native architectures, but there are also several things to be wary of when considering it.

    Foundry

    How the cloud-native stack is expanding

    As cloud-native development becomes the norm, the cloud-native ecosystem is expanding; the CNCF maintains a graphical representation of what it calls the  cloud native landscape that hammers home to expansive and bewildering variety of products, services, and open source projects that contribute to (and seek to profit from) to cloud-native computing. And there are a number of areas where new and developing tools are complicating the picture sketched out by the pillars we discussed above.   

    An expanding Kubernetes ecosystem. Kubernetes is complex, and teams now rely on an entire ecosystem of projects to get the most out of it: Helm for packaging, ArgoCD for GitOps-style deployments, and Kustomize for configuration management. And just as Kubernetes augmented Docker for enterprise-scale deployments. Kubernetes itself has been augmented and expanded by service mesh offerings like Istio and Linkerd, which offer fine-grained traffic control and improved security

    Observability needs. The complex and distributed world of cloud-native computing requires in-depth observability to ensure that developers and admins have a handle on what’s happening with their applications. Cloud-native observability uses distributed tracing and aggregated logs to provide deep insight into performance and reliability. Tools like Prometheus, Grafana, Jaeger, and OpenTelemetry support comprehensive, real-time observability across the stack.

    Serverless computing.  Serverless computing, particularly in its function-as-a-service guise, offers to strip needed compute resources down to their bare minimum, with functions running on service provider clouds using exactly as much as they need and no more. Because these services can be exposed as endpoints via APIs, they are increasingly integrated into distributed applications, operating side-by-side with functionality provided by containerized microservices. Watch out, though: the big FaaS providers (Amazon, Microsoft, and Google) would love to lock you in to their ecosystems.  

    FinOps. Cloud computing was initially billed as a way to cut costs — no need to pay for an in-house data center that you barely use — but in practice it replaces capex with opex, and sometimes you can run up truly shocking cloud service bills if you aren’t careful. Serverless computing is one way to cut down on those costs, but financial operations, or FinOps, is a more systematic discipline that aims to aligns engineering, finance, and product to optimize cloud spending. FinOps best practices make use of those observability tools to best determine what departments and applications are eating up resources.

    How cloud-native architecture is adapting to AI workloads

    Enterprises deploy larger AI models and make use of more and more real-time inference services. That’s putting demands on cloud-native systems and forcing them to adapt to remain scalable and reliable.

    For instance, organizations are re-engineering cloud environments around GPU-accelerated clusters, low-latency networking, and predictable orchestration. These needs align with established cloud-native patterns: containers package AI services consistently, while Kubernetes provides resilient scheduling and horizontal scale for inference workloads that can spike without warning.

    Kubernetes itself is changing to better support AI inference, adding hardware-aware scheduling for GPUs, model-specific autoscaling behavior, and deeper observability into inference pipelines. These enhancements make Kubernetes a more natural platform for serving generative AI workloads.

    AI’s resource demands are amplifying traditional cloud-native challenges. Observability becomes more complex as inference paths span GPUs, CPUs, vector databases, and distributed storage. FinOps teams contend with cost volatility from training and inference bursts. And security teams must track new risks around model provenance, data access, and supply-chain integrity.

    Application frameworks for building distributed cloud-native apps

    Microsoft’s Aspire is one of the most visible examples of a shift towards application frameworks to simplify how teams build distributed systems. Opinionated frameworks like Aspire provide structure, observability, and integration out of the box so developer don’t need to stitch together containers, microservices, and orchestration tooling by hand.

    Aspire in particular is a prescriptive framework for cloud-native applications, bundling containerized services, environment configuration, health checks, and observability into a unified development model. Aspire provides defaults for service-to-service communication, configuration, and deployment, along with a built-in dashboard for visibility across distributed components.

    While Aspire was originally aligned with Microsoft’s .NET platform,Redmond now sees it as having a  polyglot future. This positions Aspire as part of a broader trend: frameworks that help teams build cloud-native, service-oriented systems without being locked into a single language ecosystem. Several other frameworks are gaining traction: Dapr provides a portable runtime that abstracts many of the plumbing tasks in cloud-native distributed applications, and Orleans offers an actor-model-based framework for large-scale systems in the .NET world, and Akka gives JVM teams a mature, reactive toolkit for elastic, resilient services.

    Frameworks and tools in the expanding cloud-native ecosystem

    While frameworks like Aspire simplify how developers compose and structure distributed applications, most cloud-native systems still depend on a broader ecosystem of platforms and operational tooling. This deeper layer is where much of the complexity—and innovation—of cloud-native computing lives, particularly as Kubernetes continues to serve as the industry’s control plane for modern infrastructure.

    Kubernetes provides the core abstractions for deploying and orchestrating containerized workloads at scale. Managed distributions such as Google Kubernetes Engine (GKE), Amazon EKS, Azure AKS, and Red Hat OpenShift build on these primitives with security, lifecycle automation, and enterprise support. Platform vendors are increasingly automating cluster operations—upgrades, scaling, remediation—to reduce the operational burden on engineering teams.

    Surrounding Kubernetes is a rapidly expanding ecosystem of complementary frameworks and tools. Service meshes like Istio and Linkerd provide fine-grained traffic management, policy enforcement, and mTLS-based security across microservices. GitOps platforms such as Argo CD and Flux bring declarative, version-controlled deployments to cloud-native environments. Meanwhile, projects like Crossplane turn Kubernetes into a universal control plane for cloud infrastructure, letting teams provision databases, queues, and storage through familiar Kubernetes APIs. These tools illustrate how cloud-native development now spans multiple layers: developer-focused application frameworks like Aspire at the top, and a powerful, evolving Kubernetes ecosystem underneath that keeps modern distributed applications running.

    Advantages and challenges for cloud-native development

    Cloud native has become so ubiquitous that its advantages are almost taken for granted at this point, but it’s worth reflecting on the beneficial shift the cloud native paradigm represents. Huge, monolithic codebases that saw updates rolled out once every couple of years have been replaced by microservice-based applications that can be improved continuously. Cloud-based deployments, when managed correctly, make better use of compute resources and allow companies to offer their products as SaaS or PaaS services. 

    But cloud-native deployments come with a number of challenges, too:

    • Complexity and operational overhead: You’ll have noticed by now that many of the cloud-native tools we’ve discussed, like service meshes and observability tools, are needed to deal with the complexity of cloud-native applications and environments. Individual microservices are deceptively simple, but coordinating them all in a distributed environment is a big lift.
    • Security: More services executing on more machines, communicating by open APIs, all adds up to a bigger attack surface for hackers. Containers and APIs each have their own special security needs, and a policy engine can be an important tool for imposing a security baseline on a sprawling cloud-native app. DevSecOps, which adds security to DevOps, has become an important cloud-native development practice to try to close these gaps.
    • Vendor lock-in: This may come as a surprise, since cloud-native is based on open standards and open source. But there are differences in how the big cloud and serverless providers works, and once you’ve written code with one provider in mind, it can be hard to migrate elsewhere.
    • A persistent skills gap: Cloud-native computing and development may have years under its belt at this point, but the number of developers who are truly skilled in this arena is a smaller portion of the workforce than you’d think. Companies face difficult choices in bridging this skills gap, whether that’s bidding up salaries, working to upskill current workers, or allowing remote work so they can cast a wide net. 

    Cloud native in the real world

    Cloud native computing is often associated with giants like Netflix, Spotify, Uber, and AirBNB, where many of its technologies were pioneered in the early ’10s. But the CNCF’s Case Studies page provides an in-depth look at how cloud native technologies are helping companies. Examples include the following:

    Cloud-native infrastructure’s capability to quickly scale up to large workloads also make it an attractive platform for developing AI/ML applications: another one of those CNCF case studies looks at how IBM uses Kubernetes to train its Watsonx assistant. The big three providers are putting a lot of effort into pitching their platforms as the place for you to develop your own generative AI tools, with offerings like Azure AI Foundry,Google Firebase Studio, and Amazon Bedrock. It seems clear that cloud native technology is ready for what comes next.

    Learn more about related cloud-native technologies:

    ]]>         <![CDATA[What is cloud computing? From infrastructure to autonomous, agentic-driven ecosystems]]> https://tsecurity.de/de/3665669/ai-nachrichten/what-is-cloud-computing-from-infrastructure-to-autonomous-agentic-driven-ecosystems/ https://tsecurity.de/de/3665669/ai-nachrichten/what-is-cloud-computing-from-infrastructure-to-autonomous-agentic-driven-ecosystems/ Mon, 13 Jul 2026 17:04:32 +0200 🔧 AI Nachrichten tsecurity.de

    Cloud computing continues to be the platform of choice for large applications and a driver of innovation in enterprise technology. Gartner forecasts public cloud spending alone to the public cloud services market alone will reach $1.42 trillion in current U.S. dollars, driven by AI workloads and enterprise modernization.

    Driving this growth are the rise of AI and machine learning on the cloud, adoption of edge computing, the maturation of serverless computing, the emergence of multicloud strategies, improved security and privacy, and more sustainable cloud practices.

    What is cloud computing?

    While often used broadly, the term cloud computing is defined as an abstraction of compute, storage, and network infrastructure assembled as a platform on which applications and systems are deployed quickly and scaled on the fly.

    Most cloud customers consume public cloud computing services over the internet, which are hosted in large, remote data centers maintained by cloud providers. The most common type of cloud computing, SaaS (software as service), delivers prebuilt applications to the browsers of customers who pay per seat or by usage, exemplified by such popular apps as Salesforce, Google Docs, or Microsoft Teams.

    5 top trends in cloud computing

    1. Agentic cloud ecosystems: The shift from AI as a tool to AI as an autonomous operator within cloud environments.
    2. Sovereign and localized clouds: Meeting strict national data residency and digital sovereignty laws.
    3. Specialized AI hardware access: Navigating the GPU capacity crunch through reserved instances and boutique AI clouds.
    4. Integrated greenOps: Merging cost optimization with mandatory carbon-footprint reporting.
    5. Industry-specific walled gardens: The maturation of vertical clouds into highly regulated, precompliant environments for finance and healthcare.

    Next in line is IaaS (infrastructure as a service), which offers vast, virtualized compute, storage, and network infrastructure upon which customers build their own applications, often with the aid of providers’ API-accessible services.

    When people refer to the “the cloud” today, they most often mean the big IaaS providers: AWS (Amazon Web Services), Google Cloud Platform, or Microsoft Azure. All three have become ecosystems of services that go way beyond infrastructure and include developer tools, serverless computing, machine learning services and APIs, data warehouses, and thousands of other services. With both SaaS and IaaS, a key benefit is agility. Customers gain new capabilities almost instantly without the capital investment in hardware or software on-premises — and they can instantly scale the cloud resources they consume up or down as needed.

    According to Foundry’s Cloud Computing Study, 2025, enterprises are moving to the cloud to improve security and/or governance, increase scalability​, accelerate adoption of artificial intelligence and machine learning and other new technologies, replace on-premises legacy technology, ​improve employee productivity, and ensure disaster recovery and business continuity.

    Hyperscalers now dominate cloud services

    The largest cloud service providers are often described as hyperscalers, due to their capability to provide large-scale data centers across the globe. Hyperscalers typically offer a wide range of cloud services, including IaaS, PaaS, SaaS, and more.

    As mentioned above, notable hyperscalers include Amazon Web Services (AWS), Google Cloud Platform, and Microsoft Azure. They offer the following capabilities.

    • Scalability: Hyperscalers can handle massive workloads and scale resources up or down quickly.
    • Cost-effectiveness: Hyperscalers often offer competitive pricing and economies of scale.
    • Global reach: Hyperscalers operate data centers around the world, providing low-latency access to customers in different regions.
    • Innovation: Hyperscalers are at the forefront of cloud innovation, offering new services and features.

    Challenges of working with hyperscalers

    • Vendor lock-in: Relying heavily on a single hyperscaler can create vendor lock-in, making it difficult to switch to another provider and charging large egress fees if you do move.
    • Complexity: Hyperscalers offer a vast array of services, which can be overwhelming for some customers.
    • Security concerns: Because hyperscalers handle sensitive data, security is a major concern.

    AI, Agents, and the Sovereign Cloud

    The AI-enabled enterprise has moved beyond simple chatbots. The focus has shifted to agentic workflows — autonomous systems that reside in the cloud and possess the authority to execute business processes, manage cloud spend, and self-patch security vulnerabilities without human intervention.

    The shift to agentic infrastructure

    Cloud providers are no longer just selling compute. They are selling inference-as-a-service. Modern cloud budgets are now dominated by the high cost of specialized GPU clusters (such as Nvidia’s Blackwell architecture). This has led to the rise of boutique AI clouds that compete with hyperscalers by offering bare-metal access to the latest silicon specifically for model training and fine-tuning.

    Data sovereignty and private AI

    A major shift in late 2025 is the move away from public AI models for sensitive data. Organizations are increasingly using retrieval-augmented generation (RAG) within walled garden environments. This ensures that a company’s proprietary data never leaves their specific cloud instance to train a provider’s base model.

    Furthermore, sovereign AI has become a requirement for global operations. Governments now demand that the AI models processing their citizens’ data be hosted on infrastructure that is owned, operated, and governed within their own borders.

    The challenges of ghost AI

    Just as shadow IT plagued the 2010s, ghost AI—unauthorized AI agents running on corporate cloud accounts — has become a primary security risk. Managing these autonomous entities requires a new layer of AI governance, where the cloud provider automatically audits the intent and permissions of every running agent to prevent runaway costs or data leaks.

    Cloud computing definitions

    In 2011, NIST posted a PDF that divided cloud computing into three “service models” — SaaS, IaaS, and PaaS (platform as a service) — the latter being a controlled environment within which customers develop and run applications. These three categories have largely stood the test of time, although most PaaS solutions now are made available as services within IaaS ecosystems rather than as dedicated PaaS clouds.

    Two evolutionary trends stand out since NIST’s threefold definition. One is the long and growing list of subcategories within SaaS, IaaS, and PaaS, some of which blur the lines between categories. The other is the explosion of API-accessible services available in the cloud, particularly within IaaS ecosystems. The cloud has become a crucible of innovation where many emerging technologies appear first as services, a big attraction for business customers who understand the potential competitive advantages of early adoption.

    SaaS (software as a service) definition

    This type of cloud computing delivers applications over the internet, typically with a browser-based user interface. Today, most software companies offer their wares via SaaS — if not exclusively, then at least as an option.

    The most popular SaaS applications for business are Google’s G Suite and Microsoft’s Office 365. Most enterprise applications, including giant ERP suites from Oracle and SAP, come in both SaaS and on-premises versions. SaaS applications typically offer extensive configuration options as well as development environments that enable customers to code their own modifications and additions. They also enable data integration with on-prem applications.

    IaaS (infrastructure as a service) definition

    At a basic level, IaaS cloud providers offer virtualized compute, storage, and networking over the internet on a pay-per-use basis. Think of it as a data center maintained by someone else, remotely, but with a software layer that virtualizes all those resources and automates customers’ ability to allocate them with little trouble.

    But that’s just the basics. The full array of services offered by the major public IaaS providers is staggering: highly scalable databases, virtual private networks, big data analytics, AI and machine learning services, application platforms, developer tools, devops tools, and so on. Amazon Web Services was the first IaaS provider and remains the leader, followed by Microsoft Azure, Google Cloud Platform, IBM Cloud, and Oracle Cloud.

    PaaS (platform as a service) definition

    PaaS provides sets of services and workflows that specifically target developers, who can use shared tools, processes, and APIs to accelerate the development, testing, and deployment of applications. Salesforce’s Heroku and Salesforce Platform (formerly Force.com) are popular public cloud PaaS offerings; Cloud Foundry and Red Hat’s OpenShift can be deployed on premises or accessed through the major public clouds. For enterprises, PaaS can ensure that developers have ready access to resources, follow certain processes, and use only a specific array of services, while operators maintain the underlying infrastructure.

    FaaS (function as a service) definition

    FaaS, the original and most basic version of serverless computing, adds another layer of abstraction to PaaS, so that developers are insulated from everything in the stack below their code. Instead of futzing with virtual servers, containers, and application runtimes, developers upload narrowly functional blocks of code, and set them to be triggered by a certain event (such as a form submission or uploaded file). All of the major clouds offer FaaS on top of IaaS: AWS Lambda, Azure Functions, Google Cloud Functions, and IBM Cloud Functions. A special benefit of FaaS applications is that they consume no IaaS resources until an event occurs, reducing pay-per-use fees.

    Private cloud definition

    A private cloud downsizes the technologies used to run IaaS public clouds into software that can be deployed and operated in a customer’s data center. As with a public cloud, internal customers can provision their own virtual resources to build, test, and run applications, with metering to charge back departments for resource consumption. For administrators, the private cloud amounts to the ultimate in data center automation, minimizing manual provisioning and management.

    VMware remains a force in the private cloud software market, but the acquisition by Broadcom has created confusion and raised concerns among some customers about potential changes in pricing, licensing, and support. This could lead some organizations to explore alternative solutions.

    OpenStack continues to be a popular open-source choice for building private clouds. It offers a flexible and customizable platform that can be tailored to specific needs. However, OpenStack can be complex to deploy and manage, and it may require significant expertise to maintain.

    Kubernetes, a container orchestration platform that has gained significant traction in recent years, is often used in conjunction with other technologies like OpenStack to build cloud-native applications. Red Hat OpenShift is a comprehensive cloud platform based on Kubernetes that provides a managed experience for deploying and managing container-based, applications.

    Many cloud providers offer their own cloud-native platforms and tools, such as AWS Outposts, Azure Stack, and Google Cloud Anthos.

    Common factors to consider when evaluating private cloud platforms include the following:

    1. Pricing: The initial cost of deployment and ongoing maintenance costs.
    2. Complexity: The level of technical expertise needed to manage the platform.
    3. Flexibility: The ability to customize the platform to meet specific needs.
    4. Vendor lock-in: The degree to which the organization is tied to a particular vendor.
    5. Security: The security features and capabilities of the platform.
    6. Scalability: The capability to expand the platform to meet future needs.

    Hybrid cloud definition

    A hybrid cloud is the integration of a private cloud with a public cloud. At its most developed, the hybrid cloud involves creating parallel environments in which applications can move easily between private and public clouds. In other instances, databases may stay in the customer data center and integrate with public cloud applications — or virtualized data center workloads may be replicated to the cloud during times of peak demand. The types of integrations between private and public clouds vary widely, but they must be extensive to earn a hybrid cloud designation.

    Public APIs (application programming interfaces) definition

    Just as SaaS delivers applications to users over the internet, public APIs offer developers application functionality that can be accessed programmatically. For example, in building web applications, developers often tap into the Google Maps API to provide driving directions; to integrate with social media, developers may call upon APIs maintained by Twitter, Facebook, or LinkedIn. Twilio has built a successful business delivering telephony and messaging services via public APIs. Ultimately, any business can provision its own public APIs to enable customers to consume data or access application functionality.

    iPaaS (integration platform as a service) definition

    Data integration is a key issue for any sizeable company, but particularly for those that adopt SaaS at scale. iPaaS providers typically offer prebuilt connectors for sharing data among popular SaaS applications and on-premises enterprise applications, though providers may focus more or less on business-to-business and e-commerce integrations, cloud integrations, or traditional SOA-style integrations. iPaaS offerings in the cloud from such providers as Dell Boomi, Informatica, MuleSoft, and SnapLogic also let users implement data mapping, transformations, and workflows as part of the integration-building process.

    IDaaS (identity as a service) definition

    The most difficult security issue related to cloud computing is managing user identity and its associated rights and permissions across data centers and pubic cloud sites. IDaaS providers maintain cloud-based user profiles that authenticate users and enable access to resources or applications based on security policies, user groups, and individual privileges. The ability to integrate with various directory services (Active Directory, LDAP, etc.) and provide single sign-on across business-oriented SaaS applications is essential.

    Leaders in IDaaS include Microsoft, IBM, Google, Oracle, Okta, Capgemini, Okta, Junio Corporation, OneLogin, and JumpCloud.  

    Collaboration platforms

    Collaboration solutions such as Slack and Microsoft Teams have become vital messaging platforms that enable groups to communicate and work together effectively. Basically, these solutions are relatively simple SaaS applications that support chat-style messaging along with file sharing and audio or video communication. Most offer APIs to facilitate integrations with other systems and enable third-party developers to create and share add-ins that augment functionality.

    Vertical clouds

    Key providers in such industries as financial services, healthcare, retail, life sciences, and manufacturing provide PaaS clouds to enable customers to build vertical applications that tap into industry-specific, API-accessible services. Vertical clouds can dramatically reduce the time to market for vertical applications and accelerate domain-specific B2B integrations. Most vertical clouds are built with the intent of nurturing partner ecosystems.

    Other cloud computing considerations

    The most widely accepted definition of cloud computing means that you run your workloads on someone else’s servers, but this is not the same as outsourcing. Virtual cloud resources and even SaaS applications must be configured and maintained by the customer. Consider these factors when planning a cloud initiative.

    Cloud computing security considerations

    Objections to the public cloud generally begin with cloud security, although the major public clouds have proven themselves much less susceptible to attack than the average enterprise data center.

    Of greater concern is the integration of security policy and identity management between customers and public cloud providers. In addition, government regulation may forbid customers from allowing sensitive data off-premises. Other concerns include the risk of outages and the long-term operational costs of public cloud services.

    Multicloud management considerations

    To enhance their operational efficiency, reduce costs, and improve security, many companies are increasingly turning to multicloud strategies. By distributing workloads across multiple cloud providers, organizations can avoid vendor lock-in, optimize costs, and leverage the best-of-breed services offered by different providers.

    This multicloud approach also improves performance and reliability by minimizing downtime and optimizing latency. Additionally, multicloud strategies strengthen security by diversifying the attack surface and facilitating compliance with industry regulations. Finally, by replicating critical workloads across multiple regions and providers, companies can establish robust disaster recovery and business continuity plans, ensuring minimal disruption in the event of catastrophic failures.

    The bar to qualify as a multicloud adopter is low: A customer just needs to use more than one public cloud service. However, depending on the number and variety of cloud services involved, managing multiple clouds can become complex from both a cost optimization and a technology perspective.

    In some cases, customers subscribe to multiple cloud services simply to avoid dependence on a single provider. A more sophisticated approach is to select public clouds based on the unique services they offer and, in some cases, integrate them. For example, developers might want to use Google’s Vertex AI Studio on Google Cloud Platform to build AI-driven applications, but prefer Jenkins hosted on the CloudBees platform for continuous integration.

    To control costs and reduce management overhead, some customers opt for cloud management platforms (CMPs) and/or cloud service brokers (CSBs), which let you manage multiple clouds as if they were one cloud. The problem is that these solutions tend to limit customers to such common-denominator services as storage and compute, ignoring the panoply of services that make each cloud unique.

    Edge computing considerations

    You often see edge computing incorrectly described as an alternative to cloud computing. Edge computing is about moving compute to local devices in a highly distributed system, typically as a layer around a cloud computing core. There is typically a cloud involved to orchestrate all of the devices and take in their data, then analyze it or otherwise act on it. 

    To the cloud and back – why repatriation is real

    While public cloud offers scalability and flexibility, some enterprises are opting to return to on-premises infrastructure due to rising costs, data security concerns, performance issues, vendor lock-in, and regulatory compliance challenges. While the public cloud offers scalability and flexibility, on-premises infrastructure provides greater control, customization, and potential cost savings in certain scenarios leading some technology decision-makers to consider repatriation. However, a hybrid cloud approach, combining public and private cloud, often offers the best balance of benefits.

    More specific reasons to repatriate including the following:

    • Unanticipated costs, such as data transfer fees, storage charges, and egress fees, can quickly escalate, especially for large-scale cloud deployments.  
    • Inaccurate resource provisioning or underutilization can lead to higher-than-expected costs.
    • Stricter data privacy regulations require organizations to store and process data within specific geographic boundaries.  
    • For highly sensitive data, companies may prefer to maintain greater control over security measures and access permissions. 
    • On-premises infrastructure can offer lower latency, particularly for applications requiring real-time processing or high-performance computing.  
    • Overreliance on a single cloud provider can limit flexibility and increase costs. Repatriation allows organizations to diversify their infrastructure and reduce vendor dependency.  
    • Industries with stringent compliance requirements may find it easier to meet standards with on-premises infrastructure.  
    • On-premises environments offer greater control over hardware, software, and network configurations, allowing for customized solutions.  

    Benefits of cloud computing

    The cloud’s main appeal is to reduce the time to market of applications that need to scale dynamically. Increasingly, however, developers are drawn to the cloud by the abundance of advanced new services that can be incorporated into applications, from machine learning to internet of things (IoT) connectivity.

    Although businesses sometimes migrate legacy applications to the cloud to reduce data center resource requirements, the real benefits accrue to new applications that take advantage of cloud services and “cloud native” attributes. The latter include microservices architecture, Linux containers to enhance application portability, and container management solutions such as Kubernetes that orchestrate container-based services. Cloud-native approaches and solutions can be part of either public or private clouds and help enable highly efficient devops workflows.

    Cloud computing, be it public or private or hybrid or multicloud, has become the platform of choice for large applications, particularly customer-facing ones that need to change frequently or scale dynamically. More significantly, the major public clouds now lead the way in enterprise technology development, debuting new advances before they appear anywhere else. Workload by workload, enterprises are opting for the cloud, where an endless parade of exciting new technologies invite innovative use.

    SaaS has its roots in the ASP (application service provider) trend of the early 2000s, when providers would run applications for business customers in the provider’s data center, with dedicated instances for each customer. The ASP model was a spectacular failure because it quickly became impossible for providers to maintain so many separate instances, particularly as customers demanded customizations and updates.

    Salesforce is widely considered the first company to launch a highly successful SaaS application using multitenancy — a defining characteristic of the SaaS model. Rather than each Salesforce customer getting its own application instance, customers who subscribe to the company’s salesforce automation software share a single, large, dynamically scaled instance of an application (like tenants sharing an apartment building), while storing their data in separate, secure repositories on the SaaS provider’s servers. Fixes can be rolled out behind the scenes with zero downtime and customers can receive UX or functionality improvements as they become available.

    ]]>         <![CDATA[What is GitOps? Extending devops to Kubernetes and beyond]]> https://tsecurity.de/de/3665667/ai-nachrichten/what-is-gitops-extending-devops-to-kubernetes-and-beyond/ https://tsecurity.de/de/3665667/ai-nachrichten/what-is-gitops-extending-devops-to-kubernetes-and-beyond/ Mon, 13 Jul 2026 17:04:29 +0200 🔧 AI Nachrichten tsecurity.de

    Over the past decade, software development has been shaped by two closely related transformations. One is the rise of devops and continuous integration and continuous delivery (CI/CD), which brought development and operations teams together around automated, incremental software delivery.

    The other is the shift from monolithic applications to distributed, cloud-native systems built from microservices and containers, typically managed by orchestration platforms such as Kubernetes.

    While Kubernetes and similar platforms simplify many aspects of running distributed applications, operating these systems at scale is still complicated. Configuration sprawl, environment drift, and the need for rapid, reliable change all introduce operational challenges. GitOps emerged as a way to address those challenges by extending familiar devops and CI/CD techniques beyond application code and into infrastructure and system configuration.

    At the heart of GitOps is the concept of infrastructure as code (IaC). In a GitOps model, not only application code but also infrastructure definitions, deployment configurations, and operational settings are described in files stored in a version control system. Automated processes continuously compare the running system with those declarations and work to bring the live environment back into alignment when differences appear.

    In this approach, the version control repository serves as the system of record for how applications and their supporting infrastructure should look in production. Changes flow through the same review, approval, and automation pipelines that developers already use for software, bringing greater consistency, traceability, and repeatability to cloud-native operations.

    At a high level, GitOps refers to a set of operational practices for managing cloud-native systems using declarative configuration, version control, and automated reconciliation. Rather than treating infrastructure and application configuration as mutable runtime state, GitOps treats them as versioned artifacts that move through the same review, testing, and deployment processes as application code.

    GitOps defined

    The term GitOps was originally coined and popularized by Weaveworks, which helped formalize the approach in the context of Kubernetes operations. While that early work shaped the way GitOps was discussed and implemented, GitOps has since evolved into a broadly adopted, vendor-neutral pattern. Today, it describes a shared set of ideas rather than a specific product or platform.

    The defining characteristic of GitOps is its reliance on declarative configuration stored in a version control system. Instead of issuing imperative commands to change live systems, teams describe the desired state of applications and infrastructure in configuration files. Automated agents then continuously compare that declared state with what is actually running and work to reconcile any differences. This pull-based model—where systems converge toward the desired state defined in version control—provides built-in drift detection, repeatability, and a clear audit trail for every change.

    Because GitOps centers on configuration files stored in a version control system, familiar software development practices carry over naturally. Changes are proposed through commits, reviewed before being accepted, and tracked over time. Rollbacks are accomplished by reverting to known-good versions, and the history of how a system evolved is preserved alongside the configuration itself.

    While the use of Git as the version control system is not strictly required, it has become the default choice because of its ubiquity in modern devops workflows and its strong support for collaboration and change management, so its place in the name has stuck.

    What is the CI/CD process?

    A complete look at CI/CD is beyond the scope of this article—see the InfoWorld explainer on the subject—but we need to say a few words about CI/CD because it’s at the core of how GitOps works. The continuous integration half of CI/CD is enabled by version control repositories like Git: Developers can make constant small improvements to their codebase, rather than rolling out huge, monolithic new versions every few months or years. The continuous deployment piece is made possible by automated systems called pipelines that build, test, and deploy the new code to production.

    Again, we keep talking about code here, and that usually summons up visions of executable code written in a programming language such as C or Java or JavaScript. But in GitOps, the “code” we’re managing is largely made up of configuration files. This isn’t just a minor detail — it’s at the heart of what GitOps does. These config files are, as we’ve said, the “single source of truth” describing what our system should look like. They are declarative rather than instructive. That means that instead of saying “start up ten servers,” the configuration file will simply say, “this system includes ten servers.”

    GitOps and Kubernetes

    GitOps first took hold in the Kubernetes ecosystem, where declarative configuration and continuous reconciliation are core design principles. As a result, Kubernetes remains the most common and best-understood environment for applying GitOps practices. A typical GitOps-driven update process for a Kubernetes application looks like this:

    1. A developer proposes a change by committing updated application code or configuration to a version control repository, usually through a pull request.
    2. That change is reviewed and approved, then merged into the main branch.
    3. The merge triggers an automated CI/CD pipeline that tests the change, builds new artifacts if needed, and publishes them to a registry.
    4. A GitOps controller or similar automated agent detects the updated desired state stored in version control.
    5. The controller compares that desired state with the current state of the Kubernetes cluster and applies the necessary changes to bring the cluster back into alignment.

    This pull-based reconciliation loop—where the cluster continuously converges toward the desired state defined in version control—is central to how GitOps works in practice. While Kubernetes provides a natural fit for this model, it represents just one canonical use case. The same patterns increasingly apply to infrastructure provisioning, policy enforcement, and multi-cluster operations beyond Kubernetes itself.

    GitOps tooling in practice: Argo CD, Flux, and the ecosystem

    GitOps is enabled by a set of tools that embody the principles we’ve outlined, with some open-source projects emerging as de facto standards in cloud-native environments.

    At the center of the GitOps ecosystem is Argo CD, an open-source controller that continuously monitors a version control repository and ensures that the state of running systems matches the declared desired state. Argo CD is widely used in Kubernetes environments because it directly implements pull-based reconciliation: it compares the desired state stored in Git with the cluster’s actual state and applies changes to correct any drift.

    Alongside Argo CD, Flux is another prominent open source GitOps engine. Both Flux and Argo CD help teams adopt GitOps workflows by managing the synchronization loop between code and runtime, but they differ in operational philosophy, integration surfaces, and ecosystem fit.

    GitOps tooling often appears as part of broader platforms or integrated stacks rather than as isolated utilities. For example, multicloud and cluster management solutions now routinely include GitOps support, with Argo CD or compatible controllers bundled alongside deployment, policy, and governance capabilities.

    In addition to Flux and Argo CD, a range of auxiliary tools contribute to a complete GitOps ecosystem: policy as code engines (e.g., Open Policy Agent), drift detection systems, and infrastructure provisioning tools that mesh with Git-centric workflows.

    GitOps, devops, and normalization

    GitOps grew out of the same forces that drove devops into mainstream IT practice, and in its early days, GitOps was often discussed as a distinct extension of devops, specifically tailored to managing declarative infrastructure and Kubernetes-centric systems. At the time, GitOps was still relatively new and not yet widely adopted outside cloud-native pioneers.

    Over the last several years, however, GitOps practices have become deeply woven into how teams operate modern cloud environments. Rather than being treated as an optional add-on or marketing term, the core ideas of GitOps — using version-controlled, declarative configuration and automated reconciliation loops to continuously align running systems with intended state — are now part of standard operational practice in many Kubernetes-centric shops. In this sense, GitOps has shifted from a buzzword about what might be possible to a baseline pattern for cloud-native operations, much like devops itself did years earlier.

    In environments where Kubernetes and declarative systems are the norm, GitOps workflows are the default way teams manage and deploy change. Many organizations now implement these patterns without explicitly calling them “GitOps,” just as few teams today explicitly say they do “CI/CD” even though continuous pipelines are taken for granted. The term has become less prominent in marketing, but its practices are often embedded in pipelines, controllers, and platform tooling.

    That normalization shows up in how GitOps workflows are woven into broader operational frameworks. For example, platform engineering teams frequently build internal developer platforms that encapsulate GitOps patterns behind standardized developer APIs, making the pattern invisible to most application teams while still providing the auditability and automation that GitOps promises.

    GitOps beyond Kubernetes: infrastructure, policy, and drift

    While GitOps first gained traction as a way to manage Kubernetes deployments, its core principles apply broadly to infrastructure and operational concerns beyond any single orchestration platform. GitOps treats desired state as declarative configuration stored in version control and uses automated reconciliation to ensure running systems align with that state. That pattern naturally extends to infrastructure provisioning, policy enforcement, configuration drift detection, and governance workflows across diverse environments.

    In modern operational stacks, infrastructure is increasingly defined declaratively, whether through Kubernetes manifests, Terraform modules, or other infrastructure-as-code formats. Storing these declarations in version control enables the same peer-review, auditability, and rollback practices developers already use for application code. Automated tooling then continuously detects when the live infrastructure diverges from the declared state and works to bring it back into alignment, reducing the risk of configuration drift and inadvertent misconfigurations.

    Configuration drift — the state where an environment has diverged from what’s declared in version control — remains a major operational headache, especially in complex, dynamic systems. Drift can arise from ad hoc fixes, emergency updates, or manual changes made outside normal pipelines, and it can lead to inconsistencies, outages, and security gaps. By continually checking running systems against the desired state in Git and reconciling deviations automatically, GitOps workflows help teams keep environments predictable and auditable.

    Policy enforcement and compliance are another natural extension of GitOps patterns. As organizations adopt declarative practices, policy-as-code engines and drift detection systems can be woven into GitOps pipelines to validate that proposed configurations meet security, compliance, or operational standards before they’re ever applied to running systems. Embedding policy checks into declarative workflows brings consistency to governance while preserving the automation and speed that devops teams expect.

    GitOps – beyond Kubernetes

    GitOps began as a way to bring devops discipline to Kubernetes operations, but its longer-term impact has been more subtle. In many ways, it’s been absorbed into the fabric of modern cloud-native operations, where declarative configuration, version control, and automated reconciliation are taken for granted. Today, GitOps is less about a specific set of tools or a named practice and more about an operational mindset. By treating infrastructure and configuration as versioned, auditable artifacts and relying on automation to enforce consistency, GitOps helps teams manage complexity at scale. Even as the term itself fades from the spotlight, the practices it introduced continue to shape how distributed systems are built, deployed, and operated.

    ]]>         <![CDATA[Get started with Angular: Introducing the modern reactive workflow]]> https://tsecurity.de/de/3665664/ai-nachrichten/get-started-with-angular-introducing-the-modern-reactive-workflow/ https://tsecurity.de/de/3665664/ai-nachrichten/get-started-with-angular-introducing-the-modern-reactive-workflow/ Mon, 13 Jul 2026 17:04:25 +0200 🔧 AI Nachrichten tsecurity.de

    Angular is a cohesive, all-in-one reactive framework for web development. It is one of the larger reactive frameworks, focused on being a single architectural system that handles all your web development needs under one idiom. While Angular was long criticized for being heavyweight as compared to React, many of those issues were addressed in Angular 19. Modern Angular is built around the Signals API and minimal formality, while still delivering a one-stop-shop that includes dependency injection and integrated routing.

    Angular is popular with the enterprise because of its stable, curated nature, but it is becoming more attractive to the wider developer community thanks to its more community engaged development philosophy. That, along with its recent technical evolution, make Angular one of the most interesting projects to watch right now.

    Why choose Angular?

    Choosing a JavaScript development framework sometimes feels like a philosophical debate, but it should be a practical decision. Angular is unique because it is strongly opinionated. It doesn’t just give you a view layer; it provides a complete toolkit for building web applications.

    Like other reactive frameworks, Angular is built around its reactive engine, which lets you bind state (variables) to the view. But if that’s all you needed, one of the smaller, more focused frameworks would be more than enough. What Angular has that some of these other frameworks don’t is its ability to use data binding to automatically synchronize data from your user interface (UI) with your JavaScript objects. Angular also leverages dependency injection and inversion of control to help structure your application and make it easier to test. And it contains more advanced features like server-side rendering (SSR) and static-site generation (SSG) within itself, rather than requiring you to engage a meta-framework for either style of development.

    While Angular might not be your top choice for every occasion, it’s an excellent option for larger projects that require features you won’t get with a more lightweight framework.

    Also see: Catching up with Angular 19.

    Getting started with Angular

    With those concepts in mind, let’s set up Angular in your development environment. After that, we can run through developing a web application with Angular. To start, make sure you have Node and NPM installed. From the command line, enter:

    $ node -v
$ npm -v

    Next, you can use the Angular CLI to launch a new app:

    $ ng new iw-ng

    You can use the defaults in your responses to the interactive prompts shown here:

    A screenshot of a new project setup in the Angular command-line interface.

    Matthew Tyson

    We now have a basic project layout in the new directory, which you can import into an IDE (such as VS Code) or edit directly.

    Looking at the project layout, you might notice it is fairly lean, a break from Angular projects of the past. The most important parts are:

    • src/main.ts: This is the main entry point. In older versions of Angular, this file had to bootstrap a module, which then bootstrapped a component. Now, it avoids any verbose syntax, calling bootstrapApplication with your root component directly.
    • src/index.html: The main HTML page that hosts your application. This is the standard index.html that serves all root requests in a web page and contains the tag where your Angular component will render. It is the “body” that the “spirit” of your code animates.
    • src/app/app.ts: The root component of your application. This single file defines the view logic and the component metadata. In the new “standalone” world, it manages its own imports, meaning you can see exactly what dependencies it uses right at the top of the file. (This is the root element that appears in src/index.html.)
    • src/app/app.config.ts: This file is new in modern Angular and replaces the old AppModule providers array. It is where you configure global services, like the router or HTTP client.
    • angular.json: The configuration file for the CLI itself. It tells the build tools how to process your code, though you will rarely need to touch this file manually anymore.

    Here is the basic flow of how the engine renders these components:

    1. The arrival (HTML): The browser receives index.html. The tag is there, but it’s empty.
    2. The unpacking (JavaScript): The browser sees the tags at the bottom of the HTML and downloads the JavaScript bundles (your compiled code) from src/app/app.ts.
    3. The assembly (Bootstrap): The browser runs that JavaScript. The code “wakes up,” finds the tag in the DOM, and dynamically inserts your title, buttons, and lists.

    This flow will be different if you are using server-side rendering (SSR), but we’ll leave that option aside for now. Now that you’ve seen the basic architecture, let’s get into the code.

    Developing your first web app in Angular

    If you open src/app/app.ts (more info here) the component definition looks like this:

    import { Component, signal } from '@angular/core';
import { RouterOutlet } from '@angular/router';

@Component({
  selector: 'app-root',
  imports: [RouterOutlet],
  templateUrl: './app.html',
  styleUrl: './app.css'
})
export class App {
  protected readonly title = signal('iw-ng');
}

    Before we dissect the code, let’s run the app and see what it produces:

    $ ng serve

    You should see a page like this one at localhost:4200:

    A screenshot of a Hello, World! app built with Angular.

    Matthew Tyson

    Returning to the src/app.ts component, notice that there are three main parts of the definition: the class, the metadata, and the view. Let’s unpack these separately.

    The class (export class App)

    Export class App is vanilla TypeScript that holds your component’s data and logic. In our example, title = signal(‘iw-ng’) defines a piece of reactive state. Unlike older versions of Angular where data was just a plain property, here we use a signal. Signals are wrappers around values that notify the template precisely when they change, enabling fine-grained performance.

    The metadata (@Component)

    The @Component decorator tells Angular it is dealing with a component, not just a generic class. There are several elements involved in the decorator’s communication with the engine:

    • selector: 'app-root': Defines the custom HTML tag associated with any given component. Angular finds in your index.html and renders the component there.
    • imports: In the new Angular era, dependencies are explicit. You list exactly what a component needs (like RouterOutlet or other components) here, rather than hiding them in a separate module file.
    • templateUrl: Points to the external HTML file that defines the view.

    The view (the template)

    This is the visual part of the component, defined in app.html. It combines standard HTML with Angular’s template syntax. (JSX handles this part for React-based apps.)

    We can modify src/app/app.html to see how these three elements work together. To start, delete the default content and add the following:

    Hello, {{ title() }}

    The double curly braces {{ }} are called interpolation. Notice the parentheses in title(). We are reading the “title” signal value by calling its function. If you were to update that signal programmatically (e.g., this.title.set('New Value')), the text on the screen would update instantly.

    Angular’s built-in control flow

    Old-school Angular required “structural directives” like *ngIf and *ngFor logic control. These were powerful but required importing CommonModule and learning a specific micro-syntax. Modern Angular uses a built-in control flow that looks like standard JavaScript (similar to other Reactive platforms).

    To see the new control flow in action, let’s add a list to our component. Update src/app/app.ts as follows, leaving the rest of the file the same:

    export class App {
  protected readonly title = signal('iw-ng');
  protected readonly frameworks = signal(['Angular', 'React', 'Vue', 'Svelte']);
  protected showList = signal(true);

  toggleList() {
    this.showList.update(v => !v);
  }
}

    While we’re at it, let’s also update src/app/app.html to render this new list (don’t worry about for now; it just tells Angular where to render the framing template):

    

@if (showList()) {
  
      
    @for (tech of frameworks(); track tech) {
      
    • {{ tech }}
      • 
    }
  
    
} @else {
  
    List is hidden
    
}

    The app will now display a list that can be toggled for visibility:

    Screenshot of a list that can be toggled on and off for visibility.

    Matthew Tyson

    This syntax is cleaner and easier to read than the old *ngFor loops:

    • @if conditionally renders the block if the signal’s value is true.
    • @for iterates over the array. The track keyword is required for performance (it tells Angular how to identify unique items in the list).
    • (click) is an event binding. It lets us run code (the toggleList method) when the user interacts with the button.

    Services: Managing business logic in Angular

    Components focus on the view (i.e., what you see). For the business logic that backs the application functionality, we use services.

    A service is just a class that can be “injected” into a component that needs it. This is Angular’s famous dependency injection system. It allows you to write logic once and reuse it anywhere. It’s a slightly different way of thinking about how an application is wired together, but it gives you real organizational benefits over time.

    To generate a service, you can use the CLI:

    $ ng generate service frameworks

    This command creates a src/app/hero.ts file. In modern Angular, we define services using the @Injectable decorator. Currently, the src/app/hero.ts file just has this:

    import { Injectable } from '@angular/core';

@Injectable({
  providedIn: 'root',
})
export class Frameworks {
  
}

    Open the file and add a simple method to return our data:

    import { Injectable } from '@angular/core';

@Injectable({
  providedIn: 'root', // Available everywhere in the app
})
export class Frameworks {
  getList() {
    return ['Angular', 'React', 'Vue', 'Svelte'];
  }
}

    The providedIn: 'root' metadata is important, it tells Angular to create a single, shared instance of this service for the entire application (you might recognize this as an instance of the singleton pattern).

    Using the service

    In the past, we had to list dependencies in the constructor. Modern Angular offers a cleaner way: the inject() function. Subsequently, we can refactor our src/app/app.ts to get its data from the service instead of hardcoding it:

    import { Component, inject, signal } from '@angular/core';
import { RouterOutlet } from '@angular/router';
import { Frameworks } from './frameworks'; // Import the service

@Component({
  selector: 'app-root',
  imports: [RouterOutlet],
  templateUrl: './app.html',
  styleUrl: './app.css'
})
export class App {
  private frameworksService = inject(Frameworks); // Dependency Injection
  
  protected readonly title = signal('iw-ng');
  
  // Initialize signal with data directly from the service
  protected readonly frameworks = signal(this.frameworksService.getList());
  protected showList = signal(true);

  toggleList() {
    this.showList.update(v => !v);
  }
}

    Dependency injection is a powerful pattern. The component doesn’t need to know where the list came from (it could be coming from an API, a database, or a hard-coded array); it just asks the service for what it needs. This pattern adds a bit of extra work up front, but it delivers a more flexible, organized codebase as the app grows in size and complexity.

    Routers and routes

    Once your application grows beyond a single view, you need a way to navigate between different screens. In Angular, we use the built-in router for this purpose. In our example project, src/app/app.routes.ts is the dedicated home for the router config. Let’s follow the steps for creating a new route.

    First, we define the route. When you open src/app/app.routes.ts, you will see an exported routes array. This array contains the available routes for your app. Each string name resolves to a component that handles rendering that route. In effect, this is the map of your application’s landscape.

    In a real application, you’d often have “framing template” material in the root of the app (like the navbar) and then the routes fill in the body content. (Remember that by default, Angular is designed for single-page apps, where navigation does reload the screen, but swaps content.)

    For now, let’s just get a sense of how the router works. First, create a new component so we have a destination to travel to. In your terminal, run:

    $ ng generate component details

    This will generate a simple details component in the src/app/details directory.

    Now we can update src/app/app.routes.ts to include this new path. We will also add a “default” path that redirects empty requests to the home view, ensuring the user always lands somewhere:

    import { Routes } from '@angular/router';
import { App } from './app'; // Matches src/app/app.ts
import { Details } from './details/details'; // Matches src/app/details/details.ts

export const routes: Routes = [
  { path: '', redirectTo: '/home', pathMatch: 'full' },
  { path: 'home', component: App },
  { path: 'details', component: Details },
];

    Now if you visit localhost:4200/home, you’ll get the message from the details component: “Details works!”

    Next, we’ll use the routerLink directive to move between views without refreshing the page. In src/app/app.html, we create a navigation bar that sits permanently at the top of the page (the “stationary” element), while the router swaps the content below it (the “impermanent” element):

    And with that, the application has a navigation flow. The user clicks, the URL updates, and the content transforms, all without the jarring flicker of a browser reload.

    Parametrized routes

    The last thing we’ll look at is handling route parameters, where the route accepts variables in the path. To manage this kind of dynamic data, you define a route with a variable, marked by a colon. Open src/app/app.routes.ts and add a dynamic path:

    export const routes: Routes = [
  // ... existing routes
  { path: 'details/:id', component: Details }, 
];

    The :id is a placeholder. Whether the URL is /details/42 or /details/108, this router will receive it because it matches the path. Inside the details component, we have access to this parameter (using the ActivatedRoute service or the new withComponentInputBinding). We can use that value to retrieve the data we need (like using it to recover a detail item from a database).

    Conclusion

    We have seen the core elements of modern Angular: Setting up the environment, building reactive components with signals, organizing logic with services, and tying it all together with interactive routing.

    Deploying these pieces together is the basic work in Angular. Once you get comfortable with it, you have an extremely powerful platform at your fingertips. And, when you are ready to go deeper, there is a whole lot more to explore in Angular, including:

    • State management: Beyond signals, Angular has support for managing complex, application-wide state.
    • Forms: Angular has a robust system for handling user input.
    • Signals: We only scratched the surface of signals here. Signals offer a powerful, fine-grained way to manage state changes.
    • Build: You can learn more about producing production builds.
    • RxJS: Takes reactive programming to the next level.
    ]]>         <![CDATA[Neues Notebook? Diese 10 Schritte sollten Sie sofort erledigen]]> https://tsecurity.de/de/3665427/windows-tipps/neues-notebook-diese-10-schritte-sollten-sie-sofort-erledigen/ https://tsecurity.de/de/3665427/windows-tipps/neues-notebook-diese-10-schritte-sollten-sie-sofort-erledigen/ Mon, 13 Jul 2026 15:41:22 +0200 🪟 Windows Tipps tsecurity.de

    Ein neues Notebook fßhlt sich an wie ein digitaler Neubeginn: schnell, sauber, bereit fßr alles. Doch bevor Sie mit dem neuen Gerät loslegen, empfehlen wir einen kurzen System-Check. Denn viele Geräte leiden ab Werk an unnÜtiger Software, suboptimalen Einstellungen und deaktivierten Sicherheitsfunktionen.

    Wir zeigen Ihnen die 10 wichtigsten Schritte, die Sie direkt nach dem ersten Einschalten erledigen sollten – damit Ihr Windows-11-Notebook von Anfang an mit voller Leistung und bestmöglichem Schutz läuft.

    1. Windows einrichten und Updates installieren

    Der erste Start ist vielleicht der wichtigste. Nehmen Sie sich die paar Minuten und richten Sie Windows sorgfältig ein, das kann Ihnen später manchen Ärger ersparen. Nach der Anmeldung (egal ob mit Microsoft- oder lokalem Konto) sollten Sie sofort nach Updates suchen:

    1. Öffnen Sie Einstellungen → Windows Update.
    2. Klicken Sie auf „Nach Updates suchen“ und installieren Sie alles, was hier angeboten wird.
    3. Starten Sie den Rechner neu – und wiederholen Sie den Vorgang, bis keine Updates mehr anstehen.

    Viele neue Notebooks liegen vor dem Verkauf monatelang im Lager. Deswegen fehlen oft wichtige Sicherheits- und Treiber-Updates. Optional kÜnnen Sie auf der Website Ihres Herstellers (zum Beispiel Lenovo, Dell, HP, Asus) zusätzlich nach aktuellen Treibern fßr Grafik, WLAN oder Chipsatz suchen. Das sorgt fßr mehr Stabilität und Performance.

    Tipp: Wenn Windows Sie mit Forderungen oder Empfehlungen zum Microsoft-Konto nervt, Sie das aber nicht wollen, dann lesen Sie unseren Ratgeber Windows ohne Microsoft-Konto nutzen – so geht’s.

    Sie ßberlegen, ein neues Notebook zu kaufen? Hier finden Sie unsere Laptop-Tests mit Kaufempfehlung fßr jeden Einsatzzweck. Notebooks fßr Schßler und Studenten stellen wir in diesem Beitrag vor. Und wenn Sie auf der Suche nach einem Schnäppchen sind, dann lesen Sie hier unsere Tests der besten Laptops unter 500 Euro.

    2. UnnĂśtige Software finden und deinstallieren

    Windows 11 Apps deinstallieren
    UnnĂśtige Programme sollten Sie gleich am Anfang deinstallieren. Das schafft Platz und beseitigt mĂśgliche Systembremsen.

    Foundry

    Hersteller lieben es, Notebooks mit Testversionen, Tools und Mini-Games zu überfrachten – als Nutzer hat man für diese „Bloatware“ oft weniger Begeisterung. Solche überflüssigen Programme fressen Speicher, starten gerne im Hintergrund und können Ihr schönes neues System ausbremsen. Deshalb gilt: Am besten gleich am Anfang ausmisten.

    So gehen Sie vor:

    1. Öffnen Sie Einstellungen → Apps → Installierte Apps.
    2. Sortieren Sie nach Installationsdatum oder Hersteller.
    3. Deinstallieren Sie alles, was Sie nicht kennen oder brauchen (etwa „McAfee Trial“, „Candy Crush“, oder die „Booking.com-App“).

    Tipp: Noch gründlicher klappt’s mit Tools wie Revo Uninstaller, das auch versteckte Reste in der Registry aufspüren kann. Profi-Tipps zur Tiefenreinigung finden Sie hier. Weitere Tipps zur Beschleunigung von Windows erklären wir in diesem Beitrag.

    Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.

    3. Wichtige Programme und Tools installieren

    Jetzt kommt der kreative Teil: Ihr Notebook bekommt seine persÜnliche Grundausstattung. Diese Software sollte auf keinem neuen Windows-11-Gerät fehlen:

    Tipp: Installieren Sie Ihre wichtigsten Programme gleich nach dem Update-Durchlauf. So haben Sie bei späteren Problemen einen klaren Systemstand, auf den Sie sich verlassen kÜnnen. Mit Ninite kÜnnen Sie ßbrigens mehrere Programme gleichzeitig installieren, ohne nervige Toolbars oder Zusatzsoftware.

    4. Wichtige Windows-Einstellungen fĂźr Laptops

    Windows 11 Datenschutz Einstellungen
    Ein paar kurze, aber wichtige Einstellungen zum Datenschutz sollten Sie bei Windows 11 unbedingt vornehmen.

    Foundry

    Windows 11 bringt viele smarte Funktionen mit, die sind aber bei Weitem nicht alle optimal vorkonfiguriert. Ein paar Klicks in den Einstellungen machen den Alltag deutlich angenehmer (und sicherer):

    • Datenschutz: Unter Einstellungen → Datenschutz und Sicherheit → Windows-Berechtigungen kĂśnnen Sie ĂźberflĂźssige Telemetrie, Werbung und Standortzugriffe abschalten.
    • Windows Defender: PrĂźfen Sie unter Windows Sicherheit → Viren- und Bedrohungsschutz, ob der Echtzeitschutz aktiv ist.
    • Onedrive-Sync: Falls Sie lokale Ordner bevorzugen, deaktivieren oder begrenzen Sie den automatischen Upload.
    • Standard-Apps: Wählen Sie Ihre bevorzugten Programme fĂźr Browser, Mail und Fotos – sonst Ăśffnet Windows gerne ungefragt Edge & Co. Die Einstellungen finden Sie unter „Standard-Apps“ (einfach ins Start-Fenster tippen). Über Einstellungen → Apps → Standard-Apps kommen Sie ebenfalls ans Ziel.

    Tipp: Aktivieren Sie die Option „Dateiendungen anzeigen“ im Datei-Explorer. Das erleichtert das Erkennen verdächtiger Dateien und ist ein einfacher Schutz gegen Phishing und Schad-Software. Klicken Sie dazu in der Menüleiste auf Ansicht und setzen Sie ein Häkchen bei “Dateinamenerweiterungen”.

    5. Touchpad, Tastatur und Funktionstasten konfigurieren

    Gerade bei Laptops ist das Feintuning der Eingabegeräte Gold wert. Ein zu empfindliches Touchpad oder eine unpraktische FN-Belegung können schnell nerven und Arbeitsprozesse bremsen – solche Probleme sind aber schnell behoben.

    • Touchpad-Gesten: Öffnen Sie Einstellungen → Bluetooth und Geräte → Touchpad. Hier kĂśnnen Sie Gesten fĂźr Scrollen, Zoomen und Desktop-Wechsel anpassen oder deaktivieren.
    • Mausgeschwindigkeit: In denselben Einstellungen lässt sich die Zeigergeschwindigkeit anpassen („Cursergeschwindigkeit“).
    • Funktionstasten: Viele Hersteller bieten Tools wie Asus Armoury Crate oder HP Command Center, um FN-Tasten zu konfigurieren. PrĂźfen Sie dort, ob Helligkeit, Lautstärke und LĂźftersteuerung korrekt reagieren.

    Tipp: Nutzen Sie Drei-Finger-Gesten fĂźr Multitasking. Damit kĂśnnen Sie blitzschnell zwischen Apps wechseln oder zum Desktop springen. Das spart Zeit im Alltag und erlaubt entspannteres Arbeiten.

    6. Akku und Energieeinstellungen optimieren

    Ein frischer Akku hält am Anfang lange durch – mit den richtigen Einstellungen läuft das neue Notebook aber noch effizienter. Windows 11 bietet mehrere Möglichkeiten, um Laufzeit, Performance und Stromverbrauch fein abzustimmen.

    So holen Sie das Maximum heraus:

    1. Öffnen Sie Einstellungen → System → Strom und Akku.
    2. Unter Energiestatus wählen Sie, was Ihnen wichtiger ist: Beste Energieeffizienz, Ausbalanciert oder Beste Leistung.
    3. Sie können die Bildschirmhelligkeit im Akkubetrieb um ein paar Stufen reduzieren – das bringt oft 30 bis 60 Minuten mehr Laufzeit.
    4. Aktivieren Sie den Energiesparmodus, wenn der Akkustand unter 30 Prozent fällt.

    Tipp für Technikfans: Erstellen Sie mit dem Befehl „powercfg /batteryreport“ im Terminal (Win + X → Terminal (Admin)) einen detaillierten Akkubericht. Der zeigt, wie oft Ihr Akku schon geladen wurde, welche Kapazität er noch hat und wann es Zeit für einen Austausch wird.

    Um Ihren Akku dauerhaft zu schonen, empfehlen wir außerdem:

    • Regelmäßige Zwischenladungen statt Dauerbetrieb am Netzteil.
    • Keine dauerhafte 100-Prozent-Ladung, das stresst die Energiezellen.
    • Bei längerer Nichtnutzung: Akku auf circa 50 Prozent laden und kĂźhl lagern (aber nicht kalt).

    7. Sicherheit und Datenschutz stärken

    Windows 11 Home kommt mit der Geräteverschlßsselung. Diese bringt aber nicht die EinstellungsmÜglichkeiten, die Bitlocker nutzt.
    Unsichtbarer Bodyguard: Bitlocker verschlĂźsselt bei Bedarf die gesamte Festplatte. So sind Dokumente, Fotos oder sensiblen Dateien robust gegen Fremdzugriffe geschĂźtzt.

    Thomas Joos

    Sobald Ihr System läuft, sollten Sie den Sicherheitsgurt anlegen – sprich: die wichtigsten Schutzfunktionen aktivieren. Windows 11 bringt dafür schon alles mit, Sie müssen es nur einschalten oder prüfen.

    Empfohlene Schritte:

    1. Windows Hello aktivieren – unter Einstellungen → Konten → Anmeldeoptionen können Sie eine PIN, Fingerabdruck oder Gesichtserkennung einrichten.
    2. Bitlocker oder Geräteverschlüsselung aktivieren – so sind Ihre Daten auch bei Diebstahl geschützt.
    3. Firewall prüfen – die sollte immer aktiv sein.
    4. WLAN-Sicherheit: Alte Netzwerke lĂśschen, Ăśffentliche Hotspots meiden oder per VPN absichern.

    Tipp: Wenn Sie Windows 11 Pro nutzen (das Upgrade auf die Pro-Version bekommen Sie hier fßr nur 59,99 Euro), sollten Sie Bitlocker aktivieren. Das verschlßsselt die komplette Festplatte und lässt sich mit Ihrem Microsoft-Konto koppeln. Bei Geräten mit TPM 2.0 (Standard seit 2021) funktioniert das ganz automatisch. Wenn Sie maximale Kontrolle ßber Ihre Privatsphäre haben wollen: Tools wie O&O ShutUp10++ helfen, versteckte Telemetrie-Dienste mit einem Klick zu deaktivieren.

    8. Backup und Wiederherstellung einrichten

    Nichts ist ärgerlicher, als ein perfekt eingerichtetes System zu verlieren, weil ein Update dazwischenfunkt oder ein Virus zuschlägt. Darum unsere Empfehlung: gleich zu Beginn ein Gesamtbackup anlegen.

    So geht’s:

    1. Öffnen Sie Systemsteuerung → System und Sicherheit → Sichern und Wiederherstellen (Windows 7). Lassen Sie sich dabei nicht vom Begriff „Windows 7“ irritieren, das ist nur eine alte Bezeichnung, an der Microsoft festhält.
    2. Wählen Sie „Systemabbild erstellen“ und speichern Sie es auf einer externen Festplatte.
    3. Danach am besten gleich einen Wiederherstellungspunkt setzen. Tippen Sie dafür einfach „Wiederherstellungspunkt erstellen“ in die Suche.

    Tipp: Alternativ können Sie auch Cloud-Dienste wie Onedrive oder Google Drive nutzen, um persönliche Dateien automatisch zu sichern. Wer es bequem mag und bereit ist, etwas Geld auszugeben, greift zu Tools wie Macrium Reflect oder Acronis True Image. Damit erstellen Sie komplette Abbilder und planen regelmäßige Backups automatisch.

    9. Performance-Tuning und Komfortfunktionen

    Ein paar schnelle Handgriffe machen Windows nicht nur schneller, sondern auch komfortabler.
    Hier sind die besten Sofortmaßnahmen:

    • Autostart-Programme reduzieren: Im Task-Manager (Strg + Shift + Esc → „Autostart“) deaktivieren Sie alles, was Sie nicht ständig benĂśtigen.
    • Speicheroptimierung aktivieren: Einstellungen → System → Speicher → „Speicheroptimierung“ einschalten. Windows lĂśscht dann automatisch temporäre Dateien.
    • Visuelle Effekte anpassen: „Erweiterte Systemeinstellungen“ in die Suche eingeben und Ăźber Erweitert → Leistung → Einstellungen die Funktion „FĂźr optimale Leistung anpassen“ auswählen.
    • Snap-Layouts und virtuelle Desktops nutzen: Mit Win + Z Fenster flexibel anordnen und mit Win + Tab zwischen Arbeitsflächen wechseln.

    Tipp: FĂźr Power-User lohnt sich ein Blick auf Powertoys. Das kostenlose Microsoft-Tool liefert Zusatzfunktionen wie Fenster-Snap, TastenkĂźrzel oder Farbpipette.

    10. Bonus: Extras fĂźr Fortgeschrittene

    Wenn Sie es ganz genau nehmen wollen, kĂśnnen Sie jetzt noch ein paar Feineinstellungen vornehmen, die oft nur erfahrene Nutzer kennen:

    • BIOS/UEFI prĂźfen: Mit Entf oder F2 beim Start aufrufen. Dort kĂśnnen Sie Secure Boot, Bootreihenfolge oder LĂźfterprofile anpassen.
    • Hersteller-Tools checken: Programme wie My Asus, Lenovo Vantage oder HP Support Assistant liefern Firmware-Updates – entscheiden Sie selbst, welche Sie nutzen oder behalten mĂśchten.
    • Gaming-Optimierung: Bei Notebooks mit dedizierter GPU lohnt es sich, die Energieprofile in der Grafikkartensteuerung zu prĂźfen.
    • Windows-Features deaktivieren: Systemsteuerung → Programme → Programme und Features → Windows-Features aktivieren oder deaktivieren – hier lassen sich unnĂśtige Dienste wie „Internet Explorer 11“ oder „XPS-Dienste“ abschalten.

    Fazit: Traumstart fĂźr Ihr neues Notebook

    Ein neues Notebook ist wie ein leeres Notizbuch. Es lohnt sich, die ersten Seiten ordentlich zu gestalten. Mit diesen zehn Schritten sichern Sie sich Leistung, Datenschutz und Komfort von Anfang an. Nach der kurzen Einrichtung läuft Ihr Windows 11 dann so stabil, schnell und individuell, wie es sollte. Mit weniger Ballast und Neugier – dafür mit mehr Komfort und Sicherheit.

    Extra-Tipp: Wenn Sie noch mehr aus Ihrem System herausholen wollen, lesen Sie auch: kostenlose Tipps, damit Ihr Windows-PC schneller läuft.

    ]]>         <![CDATA[CVE-2026-55470 | HAPI FHIR 5.4.0/6.4.0 FHIRPathEngine.matches redos]]> https://tsecurity.de/de/3664926/sicherheitsluecken/cve-2026-55470-hapi-fhir-540640-fhirpathenginematches-redos/ https://tsecurity.de/de/3664926/sicherheitsluecken/cve-2026-55470-hapi-fhir-540640-fhirpathenginematches-redos/ Mon, 13 Jul 2026 12:21:58 +0200 🕵️ Sicherheitslücken tsecurity.de problematic has been discovered in HAPI FHIR 5.4.0/6.4.0. This impacts the function FHIRPathEngine.matches. Such manipulation leads to inefficient regular expression complexity. This vulnerability is referenced as CVE-2026-55470. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.]]> <![CDATA[CIOs must rethink operating models to unlock AI at scale]]> https://tsecurity.de/de/3664901/it-nachrichten/cios-must-rethink-operating-models-to-unlock-ai-at-scale/ https://tsecurity.de/de/3664901/it-nachrichten/cios-must-rethink-operating-models-to-unlock-ai-at-scale/ Mon, 13 Jul 2026 12:17:14 +0200 📰 IT Nachrichten tsecurity.de

    Almost every company has a board or executive AI mandate. Vendors are rolling out agentic AI platforms. The pressure to move is intense.

    But the reality on the ground looks different. Eighty-three percent of organizations say data quality is their top AI challenge, and 74% struggle to demonstrate ROI, according to Lopez Research. And only 21% report having a mature governance model for AI agents, per Deloitte’s 2026 State of Enterprise AI report.

    “Agentic AI is real, and vendors’ offerings are very real, too,” says Boris Evelson, vice president and principal analyst at Forrester. “However, most enterprises are still not ready to adopt at scale.”

    Dave Hilborn, who leads West Monroe’s Organization, People & Change practice, frames it as a race with three arrows moving forward — one representing AI and tech evolution, one representing organizations and people, and one representing data. “The AI arrow is far out ahead,” he says. “That delta is the readiness gap.”

    The gap isn’t the technology. It’s the foundational work most organizations haven’t done: data readiness, operating models, governance, skills, and culture. The companies making progress aren’t waiting for vendors to solve these problems. They’re tackling the unglamorous work themselves.

    AI doesn’t tolerate ambiguity

    AI readiness can be framed across six levels — from data foundation at the base to reinvented business experiences at the top, says Afshean Talasaz, former CIO at Colonial Pipeline and now an executive advisor. One of the key areas that doesn’t always get the attention it needs is the operating model.

    “The technology playbooks of the past don’t work in the AI world,” Talasaz says. “Those areas were able to tolerate more ambiguity between business and tech teams. AI doesn’t tolerate the same level of ambiguity. It needs clarity.”

    That demands a different kind of partnership between IT and the business. AI systems learn from data — records and measurements of what’s actually happening in the business — and then operate within business processes. Unlike traditional software, which is built based on user requirements, AI is sandwiched between the business that produces the data and the business that consumes the outputs.

    “AI is requiring IT and business teams to work more closely together, to be clearer about what AI will and will not do — that really close partnership is crucial,” Talasaz says. “It’s not something that will always naturally evolve. It requires a lot of intentionality about how teams need to work together to deliver outcomes.”

    The AI questions CIOs must answer aren’t just technical. Do we have the right operating model? Have we balanced governance and standard operating procedures within the model? Have we organized teams appropriately? All this must be designed within the context of what the business actually needs.

    Too many organizations are bolting AI onto existing processes without redefining roles or workflows, Forrester’s Evelson. “Organizations can either incrementally enhance existing workflows by augmenting capabilities with AI or pursue a more transformative approach by redesigning the process end-to-end.”

    The companies getting value are doing the latter.

    Data debt comes due

    Data readiness remains the most common barrier to scaling AI. “We’ve never fixed this data quality problem in most organizations,” says Maribel Lopez, founder and principal analyst at Lopez Research, “and it comes back to haunt a company in spades as they move to AI.”

    At Levi Strauss, the foundational work came first. “If you think about the Levi’s business, it’s quite complex — 100 countries, over 3,000 stores, multiple business models,” says Jason Gowans, the company’s chief digital and technology officer. “You can imagine the complexity of gathering all that data to understand how the business is performing. The idea of this single source of truth — that’s been the biggest thing.”

    Levi’s now has more than 1,100 standard operating procedures that govern how work gets done on top of SAP. “That’s fertile material to feed to LLMs on how work gets done,” Gowans says.The results are tangible: partner onboarding that once took three to six months to set up EDI exchanges now takes days.

    At contract manufacturing company Jabil, Chase Christensen, segment CIO, took a similar path. “We had to get everyone to understand where the source data resides, put tech in place so consumption is easier, and drive ownership around data and decision rights — so 140,000 employees don’t feel empowered to create their own data sources that fall out of line.”

    The data challenge goes beyond quality, Evelson notes. Most organizations’ data isn’t AI-ready; it hasn’t been prepared for how AI systems consume and learn from information. “Data is siloed, poorly governed, and hard to discover, integrate, and trust,” he says.

    Forrester research shows that 45% of data and analytics decision-makers were adopting vector databases in 2025, and 53% were adopting graph databases — investments that signal recognition of how much data architecture needs to evolve. The firm recommends a balanced approach: roughly 48% of AI spending on foundations such as data management and engineering, and 52% on consumption, including analytics, governance, and applications.

    But even as organizations work to prepare existing data, AI is creating new challenges. Users leveraging AI tools are generating new forms of data and information that never make it into corporate databases, West Monroe’s Hilborn notes.

    “There are explosions of new data, content, and insights being created on the periphery of these data lakes,” he says. “The challenge is how do you capture that and leverage it.”

    Who’s sponsoring this?

    Even when data is in order, many AI initiatives stall due to how they’re sponsored and funded.

    “Enterprise data, analytics, and AI programs succeed when business CxOs sponsor them because they are accountable for business outcomes, not just technology delivery,” Forrester’s Evelson says. “IT-led initiatives often become siloed or tool-centric, whereas business sponsorship ensures alignment to enterprise strategy, prioritization of end-to-end use cases, and a focus on decisions and actions rather than insights alone.”

    Too often, AI is still treated as a series of disconnected use cases rather than a sustained, multi-year investment. Evelson calls this the “use case trap” — organizations overindex on individual projects and miss the enterprise-wide compounding impact. That leads to fragmented priorities, inconsistent adoption, and difficulty demonstrating ROI.

    Leadership readiness is a distinct layer of AI preparedness, Talasaz says. “Are leaders prepared to provide a vision of reinvented business experiences that become the north star?” he asks. “Leadership teams, at various levels of the organization, need to articulate what a reinvented business looks like so teams have the direction and support to build differentiating capabilities.”

    Levi’s offers a counterexample. AI is a CEO priority there. At the last quarterly offsite, the execs were building agents. “When you’re committed to upskilling the workforce, you’re better served to answer how to rewire processes with AI at the core,” Gowans says. “It starts at the top. It has to be an exec priority.”

    Fear, literacy, and two types of AI

    Technical talent is only part of the equation. Organizations also need to address change management.

    “We saw it with the AI boom — fear about jobs, not knowing what AI did,” says Jabil’s Christensen. “The key is demystifying AI. We doubled down and focused on AI literacy. We want everyone to understand how it was put together, and that removed a lot of that fear. That’s been the biggest hurdle.”

    Different types of AI require different skills and governance, Talasaz says. “General use focuses on productivity on the desktop,” he says. “Integrated AI — industrial-capable AI embedded within core business processes — requires different skills, capabilities, and governance.”

    For desktop AI, training and guardrails help employees be successful — what Talasaz calls “bumpers,” like in bowling. Organizations need to help employees through reskilling and guidance. “You have tools in a toolbox,” he says. “It’s important to know when to use a power tool versus when you need a screwdriver.”

    But for integrated AI embedded in core processes, the stakes are higher. “Business leaders responsible for business outcomes based on AI-driven processes need to be fully aware of both the benefits and risks that come along with using these tools,” Talasaz says.

    That distinction matters for governance, too. Lower-, medium-, and high-risk AI use cases may require different ways of working and different risk management approaches. “Deploying AI in potentially high-risk or high-cost areas of the business requires a higher level of rigor,” Talasaz says. “That’s different than building something that helps write my emails.”

    From POC to production

    Perhaps the biggest readiness gap is the transition from proof of concept to production. “It requires such a different approach,” Talasaz says. “A successful proof of concept can create a lot of excitement, but when teams are unprepared to build and scale, it can create the potential to over-promise and under-deliver.”

    The operating model that works for experimentation doesn’t work for production at scale. Proofs of concept are designed to demonstrate the efficacy of ideas and the underlying technology. But building, scaling, and sustaining technology in the business requires operating models, standards, roles, and skills that many organizations haven’t developed. Intentionally designed operating models reduce the cost of learning, improve execution, and increase delivery velocity, says Talasaz.

    But there’s no one-size-fits-all answer. “A business that needs to build capabilities in a marketplace moving very fast requires one kind of operating model,” Talasaz says. “A business that can take longer to develop business capabilities and adapt to market changes can choose a different operating model. It’s important to design ways of working tailored to what the business needs and the speed at which the business needs to leverage technology to be successful.”

    Jabil is navigating this journey as part of its move to SAP’s cloud ERP through RISE, scaling from $29 billion to $34 billion in revenue while keeping selling, general, and administrative (SG&A) expenses relatively flat — in part by layering generative AI onto predictive analytics capabilities built over years.

    “We started years ago with computer vision to drive product quality,” Christensen says. “As gen AI blew up, we took the predictive analytics we had built over the years and imbued them with gen AI. We’ve implemented the basics, and now we’re looking for complex scenarios.”

    Governance built in, not bolted on

    Governance is often treated as a policy document or committee. It should be embedded in the operating model itself, Talasaz argues.

    “The operating model doesn’t always get the attention it needs,” he says. “Policies and committees are useful, but they should handle larger enterprise risks. Most of the governance should be embedded in the operating model to ensure you’re getting outcomes you want.”

    That might mean peer review built into the development process, bias checks before deployment, or clear escalation paths for high-risk use cases. When governance is separate from the operating model, it tends to slow things down. When it’s integrated, it becomes how work naturally gets done, says Talasaz.

    Governance at the agent level matters, too, Levi’s Gowans says. “Know what agents have been deployed, who authored them, and who’s responsible,” he says, noting that the company has established a registry to understand what agents it has operating within its networks.

    The challenges of AI governance are unique, Lopez of Lopez Research says. “Very few people have the governance stack required to say they did the right things with AI,” she says. “Non-human identity and access control is totally different and, frankly, evolving so quickly that no one knows what to do.”

    The challenge is ultimately a trade-off, Forrester’s Evelson says. “Push agentic AI capabilities too far, and you risk creating a governance and compliance nightmare,” he says. “Tighten controls too aggressively, and you stifle innovation. Best practices for striking the right balance are still being discovered.”

    It takes a team

    The AI readiness gap isn’t about technology — it’s about the work organizations have been deferring for years. Data quality. Operating models. Executive sponsorship. Skills and culture. Governance embedded in process.

    “Once you progress from everyone using Copilot to putting agents in production, then you realize the need for business context,” Gowans of Levi Strauss says.

    It’s a shared journey requiring all teams to understand what’s required, Talasaz says. “It involves helping people understand what it takes from all sides — the technology itself, the operating model, the skills and talents needed — but also working with business leaders on the art of the possible,” he says. “Helping them understand both the benefits and the responsibility of deploying this tech.”

    A colleague of his calls AI “the ultimate executive team sport.”

    “It requires people to do it well and manage it,” Talasaz says.

    ]]>         <![CDATA[Jurassic Park, cybersecurity and the dangerous myth of control]]> https://tsecurity.de/de/3664863/it-security-nachrichten/jurassic-park-cybersecurity-and-the-dangerous-myth-of-control/ https://tsecurity.de/de/3664863/it-security-nachrichten/jurassic-park-cybersecurity-and-the-dangerous-myth-of-control/ Mon, 13 Jul 2026 12:08:23 +0200 📰 IT Security Nachrichten tsecurity.de

    Jurassic Park wasn’t really about dinosaurs.

    It was about arrogant people building systems they believed were controllable.

    “Life finds a way” is probably the most famous line from the entire franchise. Ian Malcolm’s warning that no matter how sophisticated the technology becomes, no matter how expensive the fences are, and no matter how confident the operators feel, nature eventually escapes containment.

    And in every movie, it does.

    The dinosaurs always get out. The systems fail. Eventually, the humans lose control.

    What makes Jurassic Park fascinating is that despite advanced monitoring, complex containment systems and sophisticated operational controls, the outcome never really changes. At its core, the story is about people mistaking visibility for control.

    Cybersecurity has the same problem.

    For years, security teams have operated under the assumption that with enough tooling, governance, process, maturity and spend, we can build environments that are effectively secure. Maybe not perfect, but secure enough that compromise becomes rare and manageable.

    But attackers find a way.

    Given enough time, skill or motivation, they eventually identify the weakness nobody considered. The overlooked privilege. The dependency nobody mapped. The misconfiguration hiding behind layers of dashboards, process, and compliance reporting.

    We are already seeing this play out. Nation-state attacks are becoming increasingly sophisticated, while AI-driven exploit discovery is beginning to compress vulnerability research from weeks into minutes.

    The raptors are learning faster now.

    Mistaking visibility for control

    That does not mean prevention no longer matters. The fences in Jurassic Park still slowed the dinosaurs down. They created friction. They reduced exposure. Modern security controls do the same thing.

    But the failure in Jurassic Park was never simply that the fences broke.

    It was that the entire system assumed the fences represented certainty.

    Cybersecurity often makes the same mistake.

    The industry has become incredibly good at demonstrating preparedness in controlled environments. Dashboards. Compliance reports. Tabletop exercises. RTO metrics. Recovery attestations.

    Jurassic Park had dashboards too.

    The problem is that visibility is often mistaken for survivability. Organizations can prove they monitored the environment, documented the process, and ran the exercise, while still having very little confidence that the business could continue operating during a genuine systemic failure.

    Most organizations still operate with an implicit belief that compromise is exceptional rather than inevitable. Disaster recovery plans, business continuity workshops, and annual tabletop exercises are treated as evidence of resilience. In reality, many of them are carefully controlled simulations of a world that no longer exists.

    Traditional disaster recovery was designed for an era where infrastructure changed slowly, applications were relatively static, and dependencies were limited enough that recovery assumptions could remain valid for months or even years.

    That world is gone. AI killed it.

    Environments now evolve constantly. Cloud infrastructure changes daily. AI-assisted development accelerates release cycles. Applications rely on sprawling third-party ecosystems. APIs connect systems in ways many organizations do not fully understand. Entire workloads appear and disappear dynamically.

    The environment you tested last quarter may no longer exist today.

    And yet many resilience programs still operate as if annual or quarterly testing provides meaningful confidence.

    Most companies do not really test resilience.

    They test optimism.

    The backup fallacy

    And nowhere is this overconfidence more obvious than backups.

    Somewhere along the way, organizations confused “having backups” with “being resilient.” Those are not remotely the same thing.

    A backup simply proves you stored a copy of something at a specific point in time. It does not prove you can survive.

    Most recovery models were designed in the late 90s and early 2000s for relatively static systems and predictable infrastructure. The core philosophy has barely evolved since then, even as environments have become increasingly distributed, ephemeral, and interconnected.

    Restoring data is not the same as restoring operations.

    Restoring infrastructure is not the same as restoring business functionality. Modern application are complex and rely on ephemeral elements, third party components and applications as well as complex data flows not just data sets.

    Very few organizations continuously validate whether they can recover full feature-function applications, maintain operational workflows, preserve data integrity, reconnect dependencies, restore permissions correctly, or continue operating under active attack conditions.

    We built incredibly sophisticated telemetry for understanding how we die.

    We built almost none for proving we can survive.

    That gap is becoming impossible to ignore.

    The recent rise of continuous resilience testing and recovery validation is not accidental. It reflects a growing realization that recovery assumptions themselves may no longer be trustworthy.

    Static resilience models are struggling to survive dynamic infrastructure.

    This is where resilience starts becoming an engineering problem rather than a compliance exercise.

    When restoration assumptions fail

    Because the real question is no longer, “How quickly can we restore the application?”

    The real question is, “What happens if we cannot restore it?”

    Jurassic Park repeatedly explored exactly this scenario. The real panic never started when the fences failed. It started when the operators realized they could not regain control quickly enough.

    Businesses now face the same risk.

    What happens if AWS experiences a prolonged outage? What happens if Azure Identity Services fail globally? What happens if Stripe, Salesforce, Slack, or Microsoft 365 disappear for days rather than hours?

    Many organizations do not actually have business continuity strategies for those situations.

    They have restoration assumptions.

    Twenty years ago, most organizations directly owned large portions of their operational stack. Today, companies increasingly rent critical business capability from a relatively small number of providers.

    Identity. Infrastructure. Communications. Payments. Collaboration. Customer operations.

    The efficiency gains are enormous.

    So is the concentration risk.

    Resilience as an engineering discipline

    Historically, business continuity planning assumed localized disruption. A building burned down. A regional data center failed. A storm impacted an office. The internet itself was not the dependency.

    Today, entire businesses are built on tightly interconnected SaaS and cloud ecosystems where operational survivability depends on third parties remaining continuously available.

    We optimized organizations for efficiency, automation, integration, and scale.

    Not necessarily survivability.

    That is why resilience needs to evolve beyond annual tabletop exercises and static recovery plans.

    True resilience is not a binder sitting on a shelf. It is not a workshop performed once a year. It is not a recovery document written against an environment that changed six months ago.

    It is a continuous understanding of the environment itself.

    It requires live telemetry, operational visibility, dependency awareness, continuous validation, and the ability to adapt under changing conditions.

    Adapting to chaos

    The survivors in Jurassic Park only succeeded once they stopped pretending the environment was fully controllable and instead adapted to the reality in front of them.

    Cybersecurity needs to make the same shift.

    Attackers will keep adapting.

    AI will accelerate faster than most governance models can handle.

    Complexity will continue to outpace our assumptions about control.

    The organizations that survive will not necessarily be the ones with the tallest fences. They will be the ones who understand their environments deeply enough to continue operating when control is lost.

    The goal was never to eliminate chaos.

    It was to survive long enough to adapt to it.

    Because resilience is not about preventing chaos.

    It is about operating through it.

    Because eventually, one way or another, life finds a way.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Where the software development jobs are now]]> https://tsecurity.de/de/3664782/ai-nachrichten/where-the-software-development-jobs-are-now/ https://tsecurity.de/de/3664782/ai-nachrichten/where-the-software-development-jobs-are-now/ Mon, 13 Jul 2026 11:33:25 +0200 🔧 AI Nachrichten tsecurity.de

    While many technology companies have slowed hiring or even launched significant layoffs, that doesn’t mean job opportunities have dried up for software developers. In fact, skilled developers—particularly those with knowledge of AI—are in demand in other industries.

    The key to success for developers looking to snatch up these roles is to be well-prepared to meet the needs of potential employers in a variety of sectors.

    “The demand for developers in non-tech sectors is real and growing, but the roles look different from what you’d find at a software company,” says Pragati Awasthi, assistant teaching professor of AI and data science at Drexel University.

    “Across all these sectors, the common thread is that software is no longer a support function; it is embedded in core operations,” Awasthi says. “The developer in these environments is often the person translating domain-specific business problems into technical solutions, which requires a different profile than a pure product engineer at a tech firm.”

    Opportunity knocks

    The tech industry has long been a mainstay as far as employing software developers. But as these businesses trim staffs in efforts to cut expenses, that has impacted the hiring landscape. Even as the tech sector scales back, however, companies in industries such as financial services/fintech, healthcare/healthtech, retail/ecommerce, and manufacturing are looking to acquire programming talent.

    “The unifying factor is data complexity,” Awasthi says. “These industries generate large volumes of sensitive, regulated, or operationally critical data, and they need developers who can build and maintain systems that handle it responsibly.”

    While recruiting firm Summit Search Group has placed developers in roles with technology companies, “it is just as common to recruit them for roles outside this niche,” says Matt Erhard, managing partner at the company. “There are actually a fairly wide variety of roles available for developers in industries beyond tech,” Erhard says.

    For example, in financial services Summit Search Group has seen significant hiring for back-end and data engineers who can build and maintain fraud detection systems, digital banking platforms, and regulatory tools, Erhard says. In healthcare, companies are hiring developers to build AI-driven diagnostics platforms and patient portals, or to work with systems that manage electronic health records, he says.

    In manufacturing and industrial companies, developers are needed for systems integration and embedded software related to predictive maintenance, Internet of Things (IoT) systems, and smart factories. And in retail and ecommerce, there’s strong demand for full-stack developers and data developers who can handle logistics systems, omni-channel platforms, and personalization engines, Erhard says.

    “One significant function where we’ve been placing developer talent lately is in developing business systems and internal applications,” Erhard says. These roles often have titles such as systems engineer or application developer, and professionals are hired to handle tasks such as customizing customer relationship management (CRM) or enterprise resource planning (ERP) platforms, building workflow automation tools or modernizing legacy systems, he says.

    Other core functions for which Summit Search Group has placed a lot of developers include data, analytics, and AI-enablement. “That could be directly involved with data engineering or in building tools like reporting systems and ETL [extract, transform, load] pipelines,” Erhard says.

    The firm also has handled searches for developers who can build and maintain customer-facing products for banking, healthcare, and retail companies, such as mobile apps or digital platforms customers can use to interact with companies.

    Randstad Digital, a provider of global technology talent, sees demand for roles including web developers, system developers, and app developers. “These professionals would work on anything from customer-facing platforms to internal tools,” says Michael Morris, global head of platform and talent at the company. “Non-tech companies are also often hiring roles like software architecture and devops to help scale existing technology. These involve being more ingrained in the business, like building a supply chain system for a retailer, rather than creating individual tech products like you would at a technology company.”

    Prep for success

    To increases the chances of success at landing developer jobs outside of the tech industry, development professionals would be wise to follow some good practices.

    Boost AI skills

    One best practice is to boost skills in using AI-powered tools and get familiar with all things AI.

    “Get fluent with AI-assisted development and its limits,” Awasthi says. “This is not optional. Organizations across every sector expect developers to use AI coding tools productively. But the more durable skill is knowing when AI output is wrong, incomplete, or unsuitable for a regulated context. That critical evaluation capacity is what non-tech employers are increasingly trying to hire.”

    AI does not necessarily replace the need for human developers so much as it changes the skills profile for those roles, Erhard says. “The biggest difference in recent years is that AI literacy is now a non-negotiable,” he says. “At minimum, developers today need to understand concepts like prompt engineering and how to use AI tools to improve their efficiency.”

    One thing many job candidates don’t expect is that the rise of AI has also increased the importance of high-level skills such as problem framing, system design, and cross-functional communication,” Erhard says. “Essentially, if something is related to development but too complex or nuanced for an AI to handle effectively, then the demand is high for human developers who have that expertise,” he says.

    Candidates who land roles consistently have experience building AI-augmented workflows along with standard coding skills, Erhard says. “Employers increasingly expect to hire developers who can leverage AI, so demonstrating this experience on your résumé can be very beneficial,” he says.

    Gain domain knowledge

    Summit Search Group is seeing high demand for developers with deep domain knowledge in an organization’s specific industry. “So, for instance, if someone is both an experienced developer and has expertise in healthcare compliance, or financial regulations, then those candidates tend to be very sought after,” Erhard says.

    Domain fluency is an underrated skill, Awasthi says. “A developer who understands healthcare compliance, financial regulation, or manufacturing process logic is significantly harder to replace than one who only writes clean code,” she says. “AI can generate boilerplate. It cannot navigate a HIPAA audit or explain a model’s output to a compliance officer.”

    Development professionals should “pick an industry and learn it seriously; not just the technology stack but the regulatory environment, the business model, and the actual problems practitioners face,” Awasthi says. “A developer who has read about HIPAA, or spent time understanding credit risk, is immediately more valuable in those hiring contexts.”

    It’s also vital to demonstrate real-world, practical application of skills, not just credentials. “The strongest candidates have projects in their portfolio that directly tie to and solve real business problems,” Erhard says.

    Acquire soft skills

    And then there are the soft skills that are becoming more of a differentiator than they were in the past. As AI handles more routine coding, human developers are expected to make more architectural decisions and collaborate across departments, Erhard says. “Strong communication and problem-solving skills are critical for many of the developer roles that we’re filling today,” he says.

    While technical skills are still relevant for developers using and managing AI tools, “they also need to develop the skill of ‘deeper thinking’ and learn how to think one step ahead,” Morris says. “This includes skills like system design mastery—understanding the macro view and learning how microservices, databases, and third-party APIs interact securely and efficiently.”

    They also should become deeply fluent in the AI coding tools commonly used in their particular industry, with a strong understanding of how to prompt them for optimal output, Morris says. Product context awareness is also useful. “AI doesn’t know what the customer wants, but you do,” Morris says. “Understanding the business problem and the end-user experience is a requirement for being able to guide LLMs.”

    Master debugging and incident response

    Developers looking to break into non-tech sectors also should develop skills in debugging and incident response, Morris says. “Complex systems with multiple AI agents can, and will, fail, which means companies need humans to trace logic flaws to get the system back on track,” he says. “A mastery of root-cause analysis is a critical skill.”

    “Security, compliance, and reliability are very important in non-tech industries like finance and healthcare,” says Rohit Agarwal, co-founder of Zenius, a remote hiring company. “So employers want developers who also know regulatory environments well.”

    Network and keep learning

    To successfully pivot from jobs at tech companies, “continuous learning, upskilling, and building hybrid skills that combine technical and business knowledge are essential,” Morris says. “With the right preparation, tech professionals can adapt and continue to thrive in meaningful, dynamic careers.”

    It’s also a good idea to join talent communities in fields of interest and “engage with other members in conversations that increase your knowledge through the collective intelligence of the community,” Morris says. “Take advantage of AI skilling opportunities relevant for your role, or better yet, where you want to go next. Experiment with the technology either on your own or through structured programs.” Ultimately, be curious and proactive, he says.

    “I’d also recommend developers not to ignore referrals, direct outreach, and industry-specific communities during job search,” Agarwal says. “There are often a lot more opportunities available than the ones posted online.”

    ]]>         <![CDATA[Your AI agent shouldn’t know everything – it should know who to ask]]> https://tsecurity.de/de/3664615/it-nachrichten/your-ai-agent-shouldnt-know-everything-it-should-know-who-to-ask/ https://tsecurity.de/de/3664615/it-nachrichten/your-ai-agent-shouldnt-know-everything-it-should-know-who-to-ask/ Mon, 13 Jul 2026 10:18:31 +0200 📰 IT Nachrichten tsecurity.de

    Intro

    • Consumers across APJ are getting more impatient. They expect brands to resolve their issues in just 24 minutes on average.
    • If the brand is unsuccessful, 34% say they’ll switch channels to find a faster path to resolution, and 30% say they’ll abandon the effort altogether.
    • Most leaders reading this insight would respond by improving agent response times, but speed isn’t the problem. The crux is that consumers want a solution, not to wait less.
    • Unfortunately, the AI that most brands have deployed are chatbots who try to handle everything (and then fail).
    • What we’re seeing is the opposite. The most productive agents aren’t generalists, but specialists who excel at one thing and know when to hand off when they can’t handle something.
    • This intelligent orchestration is a superpower.

    The cost of sending customers in circles

    • 90% of business leaders believe their customers are satisfied with conversational AI, but only 59% of consumers agree.
    • 54% of consumers say AI agents rarely or never have context about them as a customer.
    • 78% say it’s important to be able to switch from an AI agent to a human, yet only 15% report experiencing seamless handoffs.
    • Most escalations involve lost context, repeated explanations, and restarted conversations. Every misroute doesn’t just waste one interaction—it triggers a cascade. The customer calls back, a second agent asks the same questions, trust erodes, and the next interaction starts from a deficit.
    • It’s no wonder that 42% of consumers say AI makes them less patient, not more. 41% are satisfied with how brands currently use AI.
    • For customer service teams, the real challenge is routing, not tech.

    What self-service really needs

    • Brands need four capabilities for self-service AI agents to work.
      • 1. Agency: Specialised agents that can handle defined tasks with precision and don’t attempt everything and resolve nothing.
      • 2. Always-on monitoring: The system must monitor interaction quality in real time and catch failures before they compound into callbacks.
      • 3. Real-time contextual data: Agents must have a unified view of the customer, including history, intent, and recent interactions.
      • 4. Intelligent routing: The system must accurately decide in the moment whether a task stays with AI, moves to a specialist, or escalates to a human with full context.
    • Of these four, routing is the most underinvested and the one that determines whether the other three deliver value.

    Routing is the intelligence layer

    • Think of routing not as plumbing but as decision-making.
    • A well-designed system evaluates task complexity, required skills, customer history, sentiment, and more before matching it to the right resource.
    • For example, a complex billing dispute will be routed to a senior billing specialist, not the next available generalist. A routing appointment request stays with the AI agent that can solve it in seconds.
    • When the AI encounters an edge case it can’t handle, the routing layer transfers the task, along with full context, so the next agent can pick up where the AI left off.
    • Twilio’s own research confirms this. 42% of consumers prefer starting with a human agent, even if it takes longer, while 23% are comfortable starting with AI and escalating when needed.
    • Both paths demand routing intelligence. The AI-first customer needs seamless escalation, and the human-first customer needs to reach the right human immediately. Neither can afford a misroute.

    When resolution compounds

    • Every issue resolved on first contact is one fewer repeat call in the queue.
    • Fewer repeat calls mean shorter wait times for everyone.
    • This compounding effect extends to agent capacity. When routing works, human agents are freed from solving issues that should have been addressed the first time. They spend their time on complex, high-value interactions instead.
    • This is what 72% of consumers are signaling when they say they’d choose AI over a human if the issue was guaranteed to be solved faster.
    • 46% of consumers say quick service and resolution are their top priorities, and 51% say delays are acceptable if they lead to better customer support.
    • Patience is available but only when the brands earn it by sending customers to the right place the first time.
    • The brands that treat routing as an afterthought will keep optimising for speed and see their customers quietly leave. Those who optimise for resolution will build trust that compounds with every interaction.

    To learn more about Twilio, visit here.

    ]]>         <![CDATA[Infrastructure for the agentic era: A new conversation layer for the Twilio Platform]]> https://tsecurity.de/de/3664598/it-security-nachrichten/infrastructure-for-the-agentic-era-a-new-conversation-layer-for-the-twilio-platform/ https://tsecurity.de/de/3664598/it-security-nachrichten/infrastructure-for-the-agentic-era-a-new-conversation-layer-for-the-twilio-platform/ Mon, 13 Jul 2026 10:09:19 +0200 📰 IT Security Nachrichten tsecurity.de

    A new era of customer engagement is taking shape. AI agents are quickly becoming integral to the way businesses serve, support, and sell to customers — able to respond, reason, and take action in ways that go far beyond scripted automation.

    Many customer journeys, however, are still built on systems that don’t talk to each other. Customer data lives in one place, channel history in another, and AI agents often operate with only part of the picture. Customers feel the pain when they switch between channels like voice and messaging, get transferred, and have to repeat themselves yet again. It doesn’t matter that they’ve been loyal to a brand for years, every interaction feels like a cold start. That is the conversation gap.

    It’s clear that AI isn’t the problem, infrastructure is. Closing the gap requires new building blocks that focus on continuity, so context can carry forward across systems, channels, human agents, and AI agents.

    To bridge the gap, at SIGNAL 2026, we are introducing a new conversation layer for the Twilio Platform.

    Twilio Conversation Orchestrator, Twilio Conversation Memory, and Twilio Conversation Intelligence are now generally available. Together, they help businesses coordinate interactions, preserve context, and connect human and AI agents so every conversation is more continuous and useful.

    In addition to the new Conversations layer, we’re also announcing platform updates that make it easier to build, manage, and scale customer engagement on Twilio — from a reimagined Twilio Console to expanded channels and new voice AI capabilities.

    New building blocks for connected conversations

    The conversation gap does more than create inconsistent customer experiences. It hurts conversion and retention, increases operational costs, adds integration complexity, and makes agents less productive. The new platform capabilities we’re introducing are designed to fix that by coordinating interactions, maintaining context, and surfacing signals as conversations happen.

    Conversation Orchestrator

    Conversation Orchestrator helps businesses coordinate interactions across Twilio channels without complex custom logic. Teams can configure it in Console or configure their implementation with the API. It connects interactions into a single thread and manages handoffs between human agents and automated systems.

    Conversation Memory

    Conversation Memory creates a living, identity-resolved profile by connecting customer data with conversation history and customer traits. That means each interaction starts with the right context. It’s built specifically for LLMs to reduce latency and token usage by surfacing the most relevant details when they matter.

    A new Enterprise Knowledge API (now generally available) also allows teams to deliver more relevant experiences and ground interactions in trusted business knowledge such as FAQs, policies, and product documentation.

    Conversation Intelligence

    Conversation Intelligence provides real-time understanding of live interactions. Using prebuilt and custom LLM-based operators, it can detect changes in sentiment, flag potential escalations, and trigger action during a conversation, not only after it ends.

    That gives teams the ability to respond sooner, support agents more effectively, and improve customer outcomes while the conversation is still in progress.

    Together, these products help businesses create customer experiences that feel more connected across channels.

    Open by design

    Twilio remains neutral by design. We start with the premise that you know your business. We aren’t here to prescribe a model, framework, or data strategy. We provide the infrastructure that helps you build customer engagement in the way that works best for your business. You pick the model and agent runtime. You own the data.

    That doesn’t mean you need to start from scratch, either. We partnered with Microsoft, AWS, and others to create blueprints that support faster development. We are also introducing an open-source developer toolkit, Twilio Agent Connect (now generally available), that lets your teams connect agents built on any LLM or framework directly to Twilio’s infrastructure.

    For developers, this means more flexibility. For businesses, it means less lock-in and the ability to get value from existing investments. For partners, it means more ways to build with Twilio.

    A new front door

    We are also introducing a reimagined Twilio Console, because as customer engagement grows more complex, managing the infrastructure behind it should feel effortless.

    The new Console is a single mission control center that brings your communications, identity, and data into one experience: one login, consistent logs across every surface, an intelligent Console Assistant, transparent billing insights, and streamlined compliance workflows that no longer slow you down.

    Over the coming months, we’ll roll out this new Console experience to customers automatically. You can also opt in to gain early access.

    More channels, more control, smarter conversations

    In addition to these launches, we are announcing several updates that expand customer reach, support enterprise requirements, and make it simpler to build on Twilio.

    • Apple Messages for Business (Private beta) and Twilio Email (GA) give teams new ways to reach customers on the channels they already use.
    • Data Residency for SMS (EU) (Public beta) enables teams to manage personal data locally to support regional data requirements.
    • Conversation Relay enhancements add PCI compliance, HIPAA eligibility, Insights, and support for Deepgram Flux for smarter turn detection — helping AI agents better understand when a person has finished speaking.
    • Stripe Projects integration enables developers and AI agents to seamlessly provision Twilio within Stripe Projects in a single, programmable CLI workflow.

    Built with our customers

    Bringing these new products to life required a close partnership with many beta customers and partners. This helped us understand real-world signals and needs to help make the capabilities robust from the start.

    Among dozens of others, Centerfield, Constellation Dealerships, Car Finance 247, and Meera.ai leveraged Twilio to solve their own customer engagement challenges. These teams showed what is possible when businesses carry context forward, act on live conversation signals, and connect AI agents with human teams in the moments that matter.

    Car Finance 247, a leading UK online car finance broker, is using Twilio to help recover stalled loan applications. When customers miss a field, need to correct information, or still need to confirm terms and conditions, AI-powered outreach across voice, SMS, and RCS, Conversation Memory tracks the application state. Conversation Orchestrator manages the outreach journey, and Flex helps bring in a human agent as needed. As Reg Rix, Co-Founder and CEO, shared:

    “Because the platform remembers where each customer left off, we can pick up right where they stopped, helping them cross the finish line in a way that is modern, responsive, and genuinely helpful.”

    Centerfield, a technology company powering AI-driven commerce, helps brands connect with consumers across digital and phone-based journeys. With Twilio, the team is connecting real-time conversation data with customer context to guide agents and AI systems in the moment, standardise what works, and improve performance at scale. As Aniketh Parmar, Chief Technology Officer, said:

    “Performance comes down to how well every interaction moves a customer forward. We’re capturing each conversation in real time and applying what we already know about the customer to guide our agents and AI systems in the moment. With the Twilio Platform, including Conversation Orchestrator, Conversation Memory, and Conversation Intelligence, we can see what’s driving conversations so we can standardise what works, eliminate what doesn’t, and continuously improve outcomes at scale.”

    Constellation Dealerships is using Twilio’s agent infrastructure to accelerate AI-powered engagement across its dealer network, moving from evaluation to measurable outcomes in days. As Richard Pineault, Director of R&D, shared:

    “The value of this partnership is evident—our team progressed from evaluating Twilio’s agent infrastructure to realising measurable outcomes within days. This rapid speed-to-value exemplifies the agility and innovation required to propel the dealership industry into the future.”

    Meera.ai is building on Twilio to modernise outbound engagement, replacing repeated manual follow-ups with always-on conversations across voice, SMS, and messaging. Vivek Zaveri, Chief Executive Officer, said:

    “Meera.ai has partnered with Twilio since our inception to champion a conversation-first future for commerce. As the industry shifts toward real-time LLM-enabled interactions, Twilio’s Platform and the new Conversations products will help us reach customers in the moment.”

    Together, these customers and partners show that the Twilio Platform can help businesses recover stalled journeys, improve live interactions, accelerate time to value, and create more connected experiences across AI agents, human teams, and every customer channel.

    The next era of customer engagement starts here

    As AI agents own more of customer engagement, businesses need infrastructure that keeps conversations connected across channels, systems, and teams. That means preserving context, coordinating handoffs, and acting on what is happening in real time.

    That is what we are building with this next generation of the Twilio Platform: a new layer that connects channels, context, intelligence, and human and AI agents, helping businesses make every digital interaction more connected, more useful, and more amazing.

    For 17 years, Twilio has helped builders create better ways for businesses to connect with their customers. In this next era, that connection matters more than ever.

    Explore the new Conversations layer, try the products, and let’s build what comes next, together.

    ]]>         <![CDATA[Voice AI vs conversational AI: What’s the difference?]]> https://tsecurity.de/de/3664597/it-security-nachrichten/voice-ai-vs-conversational-ai-whats-the-difference/ https://tsecurity.de/de/3664597/it-security-nachrichten/voice-ai-vs-conversational-ai-whats-the-difference/ Mon, 13 Jul 2026 10:09:17 +0200 📰 IT Security Nachrichten tsecurity.de

    Voice AI. Conversational AI. You’ve seen both terms everywhere—sometimes in the same sentence, sometimes used as if they mean the same thing.

    They don’t. But they’re not opposites either.

    One is a category of technology. The other is a specific way to deliver it.

    Mix them up and you end up making the wrong platform decisions, building the wrong workflows, and losing 45 minutes in a meeting that didn’t need to happen.

    Here’s the difference between voice AI and conversational AI, minus the jargon.

    Conversational AI: The intelligence layer

    Conversational AI is the broader category. It refers to any AI system designed to understand human language, reason about what was said, and respond in a way that feels natural and contextually relevant. That exchange can happen through text, voice, or any other medium.

    What defines conversational AI is the intelligence underneath the interaction:

    • Natural language understanding that interprets intent rather than matching keywords
    • Dialogue management that tracks what’s been said and what still needs to be resolved
    • Response generation that produces output appropriate to the context.

    Conversational AI shows up in a lot of forms. A chatbot on a support page is conversational AI. An AI assistant that helps a sales rep draft follow-up emails is conversational AI. A virtual agent that handles inbound customer inquiries is conversational AI.

    The intelligence layer makes the interaction feel like a conversation rather than a database lookup.

    The channel, the modality, the interface: those are separate from the intelligence. Which brings us to voice AI.

    Voice AI: The delivery method

    Voice AI is conversational AI delivered through spoken language. It’s the application of conversational AI intelligence to voice-based interactions where the input is speech and the output is speech.

    A voice AI system:

    And it does it all fast enough that the conversation doesn’t feel like it’s buffering.

    Voice AI isn’t a fundamentally different kind of intelligence from conversational AI. It’s conversational AI with a voice interface wrapped around it. The reasoning, the context tracking, the dialogue management—those are the same capabilities.

    What voice AI adds is the ability to operate through spoken language in real time, with all the additional complexity that introduces: handling interruptions, managing turn-taking, producing natural-sounding speech, and doing all of it with sub-500ms latency.

    Ultimately, conversational AI is how the system thinks. Voice AI is how it talks.

    How they relate

    Voice AI depends on conversational AI to be useful. Without the intelligence layer (intent recognition, context tracking, and coherent response generation), a voice system is just a phone menu with better audio.

    The voice interface makes the interaction accessible through speech. The conversational AI makes the interaction worth having.

    The relationship goes one way, though.

    Every voice AI system uses conversational AI underneath it. But conversational AI doesn’t require voice. A text-based chatbot, messaging bot, or AI assistant embedded in a ticketing system are conversational AI without any voice component.

    It’s not really a question of whether you need conversational AI or voice AI. It’s better to ask: does your use case require voice?

    • If yes, you need voice AI—which means you also need conversational AI as the foundation.
    • If the interaction is text-based, you need conversational AI without the voice layer.

    Voice AI vs. conversational AI: Key differences

    Side by side, the differences get a lot clearer. Here’s the breakdown across the criteria that matter most for teams building or buying AI for customer service.

    When to use conversational AI without voice

    Text-based conversational AI makes sense when your customers primarily engage through chat, messaging, or digital channels. And when the nature of the interaction doesn’t require the immediacy of a phone call.

    • Support chat on a website
    • WhatsApp automation
    • AI-assisted email triage
    • Messaging bots for transactional notifications

    These are all conversational AI use cases where voice doesn’t add much and may introduce unnecessary friction. Not every customer wants to speak out loud, especially in public, at work, or when the question is simple enough to type in thirty seconds.

    Text-based conversational AI is also typically faster to deploy, easier to test, and simpler to update. You can iterate on response quality, test new flows, and review transcripts without dealing with audio quality, latency optimisation, or the additional infrastructure that voice requires.

    If your primary support and engagement channels are digital and your customers are comfortable typing, starting with text-based conversational AI often makes more sense than jumping straight to voice.

    When you need voice AI specifically

    Voice AI makes sense when the use case is inherently telephonic, time-sensitive, or requires the kind of nuance that text alone doesn’t capture.

    • Inbound phone support: Customers call because they want to talk to someone, or because they’ve always called, or because the issue feels urgent enough that they don’t want to wait for a chat response. An AI that can answer that call, understand the issue, and resolve it in the same interaction replaces one of the most expensive and frustrating moments in customer service.
    • Outbound calling: Appointment reminders, fraud alerts, lead follow-up, proactive outreach for at-risk customers. These interactions are harder to execute over text because they require real-time dialogue.
    • Context: Tone, urgency, frustration, hesitation—these are signals that a voice AI system can detect and respond to. A customer who speaks with audible frustration is communicating something beyond the literal words, and a well-designed voice AI system can adjust its approach accordingly.

    Finally, voice AI matters when your customers are less likely to engage through digital channels. These might be older demographics, industries where phone is still the primary contact method, or use cases where hands-free interaction is a practical requirement.

    Do you need both?

    For most businesses building serious customer engagement infrastructure: yes.

    The customers who prefer chat aren’t going away. Neither are the customers who pick up the phone. A complete AI engagement strategy handles both with a single connected experience rather than two separate systems that don’t know about each other.

    And that’s where Twilio Conversations can help.

    • Conversation Orchestrator connects voice, SMS, WhatsApp, and chat into one continuous conversation record.
    • Conversation Memory gives every agent (AI or human) persistent customer context across channels.
    • Conversation Relay handles the voice AI layer: low-latency STT and TTS, bring-your-own-LLM, HIPAA-eligible.
    • Agent Connect lets you plug your own AI agents into Twilio channels without rebuilding your communications infrastructure.

    Your customers are going to use both voice and text. The question is whether your stack connects them.

    Start for free or contact sales to talk through your use case.

    Frequently asked questions

    What’s the difference between voice AI and conversational AI?

    Conversational AI is the intelligence layer that understands human language and generates contextually relevant responses, regardless of channel. Voice AI is conversational AI delivered through spoken language. It adds speech-to-text and text-to-speech components so the interaction happens via voice.

    Is voice AI a type of conversational AI?

    Yes. Voice AI is a specific application of conversational AI that operates through spoken language. The reasoning, intent recognition, and dialogue management capabilities come from conversational AI. Voice AI adds the speech interface on top to convert spoken input to text, process it through the conversational AI layer, and convert the response back to speech.

    Can conversational AI work without voice?

    Yes. Text-based chatbots, messaging bots, AI assistants in ticketing systems, and email AI are all forms of conversational AI that don’t use voice.

    Does Twilio support both voice AI and conversational AI?

    Yes. Twilio Conversation Relay handles voice AI, combining low-latency STT and TTS with bring-your-own-LLM flexibility. The broader Twilio Conversations platform connects voice, SMS, WhatsApp, and chat into a single conversation layer, so the conversational AI intelligence and customer context are shared across every channel.

    To learn more about Twilio conversations, visit here.

    ]]>         <![CDATA[CVE-2026-15154 | Red Hat OpenShift AI Public Detection API redos]]> https://tsecurity.de/de/3663963/sicherheitsluecken/cve-2026-15154-red-hat-openshift-ai-public-detection-api-redos/ https://tsecurity.de/de/3663963/sicherheitsluecken/cve-2026-15154-red-hat-openshift-ai-public-detection-api-redos/ Mon, 13 Jul 2026 01:35:38 +0200 🕵️ Sicherheitslücken tsecurity.de problematic has been found in Red Hat OpenShift AI. The impacted element is an unknown function of the component Public Detection API. Performing a manipulation results in inefficient regular expression complexity. This vulnerability is reported as CVE-2026-15154. The attack is possible to be carried out remotely. No exploit exists.]]> <![CDATA[Redivis makes research data accessible, experiences collaborative with BigQuery]]> https://tsecurity.de/de/3662842/it-security-nachrichten/redivis-makes-research-data-accessible-experiences-collaborative-with-bigquery/ https://tsecurity.de/de/3662842/it-security-nachrichten/redivis-makes-research-data-accessible-experiences-collaborative-with-bigquery/ Sun, 12 Jul 2026 08:07:05 +0200 📰 IT Security Nachrichten tsecurity.de

    Understanding the data we collect is essential—it allows us to identify trends and uncover answers about our world. However, stories in our data frequently go untold. Large datasets are hard to share between research communities due to their size, security restraints, and complexity. Even if these datasets are accessible to users, the tools needed to query them often require deep technical knowledge. This is why Redivis partnered with Google Cloud to help make research data from higher education institutions easier to analyze and more accessible. 

    Redivis’s mission is to create a frictionless “data commons”—a place where researchers can discover, request access to, and query large datasets to support their studies. To make this goal possible, Redivis began to rethink the traditional data-distribution process.

    Challenges to making data more accessible

    When Redivis first started, their team interviewed dozens of researchers to understand their biggest problems. Most researchers expressed how difficult it is to find new datasets, and how many steps it takes to access and work with the data—often before knowing if the information the dataset contains is even useful for their study. Additionally, data administrators want their datasets to be utilized but are often concerned about data security.

    Storing large amounts of sensitive data requires the right set of security controls. To help keep their data secure, Redivis developed a transparent, tiered access system for datasets. Researchers can request separate access to a dataset’s documentation, variables, sample, and full data, which allows them to assess the usability of the dataset without filing access applications. Moreover, administrators can set rules for how researchers use and combine different datasets depending on their level of access. 

    Redivis built their platform on top of Google Cloud’s security infrastructure, which allows the company to encrypt data, manage security keys, and helps secure datasets with the operational and physical security layers available. Combined with detailed audit logs (supported by Google Cloud Logging) and robust application-level security controls, Redivis is able to provide data owners with the peace of mind that their data is only being accessed and used as they’ve allowed.

    Sharing data to build more compelling stories

    When we join multiple sources of data, we can uncover a more complete story, such as in the case of examining environmental conditions. By combining data about historic fires, air quality data, and population health outcomes, researchers are able to offer policy guidance to protect the most at-risk populations. However, if the datasets stayed separate, we would likely lose insight into the impact these events have on each other. With the help of cloud solutions like Cloud Storage and BigQuery, Redivis figured out ways to securely connect the data between public datasets hosted in Big Query with private datasets to unlock enriched insights for their researchers.  

    Using Cloud Storage, Redivis makes it easy for administrators to upload large amounts of data to the platform. These data records are then stored in BigQuery, Google Cloud’s serverless and scalable data warehouse. When researchers explore their data with Redivis, they can easily see what steps they need to take to request access to existing records. Once authorized, users can query the data using SQL, without needing to know database languages. This will provide the user with manageable data subsets that can be analyzed within the context of their current study. Finally, researchers can integrate a wide array of analytical tools into this data pipeline. Using BigQuery’s ability to one-click export data to Google’s Data Studio, Redivis is able to create interactive data visualizations and integrate with notebook environments through Python and R clients.

    With BigQuery managing infrastructure requirements, Redivis scaled to petabytes of data, 1,000 times larger than the terabytes they had previously, without additional infrastructure workloads straining their company. Most importantly, BigQuery’s compute architecture supports real-time analysis across billions of records from both public and restricted datasets, unlocking new ways to discover insights. “Researchers are regularly coming to me to say that queries that once took hours are executing in seconds,” says Ian Mathews, CEO of Redivis. “One can only imagine how transformative this is in understanding new datasets and exploring novel hypotheses.” 

    The future of data accessibility

    As more academic institutions and researchers join Redivis, they will continue to identify ways of minimizing friction at every step of the data-driven research process. 

    To learn more about the steps Redivis is taking to make data more accessible and empower researchers, check out this video. And to learn more about BigQuery, visit our website.

    Related Article

    Accelerating Mayo Clinic’s data platform with BigQuery and Variant Transforms

    See how Mayo Clinic uses Google Cloud to work with genomic variant data for research purposes. Cloud data warehouse BigQuery lets them sa...

    Read Article
    ]]>         <![CDATA[Lending DocAI fast tracks the home loan process]]> https://tsecurity.de/de/3662838/it-security-nachrichten/lending-docai-fast-tracks-the-home-loan-process/ https://tsecurity.de/de/3662838/it-security-nachrichten/lending-docai-fast-tracks-the-home-loan-process/ Sun, 12 Jul 2026 08:07:00 +0200 📰 IT Security Nachrichten tsecurity.de

    Artificial intelligence (AI) continues to transform industries across the globe, and business decision makers of all kinds are taking notice. One example is the mortgage industry; lending institutions like banks and mortgage brokers process hundreds of pages of borrower paperwork for every loan - a heavily manual process that adds thousands of dollars to the cost of issuing a loan. In this industry, borrowers and lenders have high expectations; they want a mortgage document processing solution catered to improving operational efficiency, while ensuring speed and data accuracy. They also want a document automation process that helps enhance their current security and compliance posture.

    At Google, our goal to understand and synthesize the content of the world wide web has given us unparalleled capabilities in extracting structured data from unstructured sources. Through Document AI, we've started bringing this technology to some of the largest enterprise content problems in the world. And with Lending DocAI, now in preview, we're delivering our first vertically specialized solution in this realm.

    Lending DocAI.gif

    Lending DocAI is a specialized solution in our Document AI portfolio for the mortgage industry. Unlike more generalized competitive offerings, Lending DocAI provides industry-leading data accuracy for documents relevant to lending. It processes borrowers’ income and asset documents to speed-up loan applications—a notoriously slow and complex process. Lending DocAI leverages a set of specialized models, focused on document types used in mortgage lending, and automates many of the routine document reviews so that mortgage providers can focus on the more value-added decisions. Check out this product demo. 

    In short, Lending DocAI helps:  

    • Increase operational efficiency in the loan process: Speed up the mortgage workflow processes (e.g. loan origination and mortgage servicing) to easily process loans and automate document data capture, while ensuring that accuracy and breadth of different documents (e.g. tax statements, income and asset documents) support enterprise readiness.

    • Improve home loan experience for borrowers and lenders: Transform the home loan experience by reducing the complexity of document process automation. Enable mortgage applications to be more easily processed across all stages of the mortgage lifecycle, and accelerate time to close in the loan process.

    • Support regulatory and compliance requirements: Reduce risk and enhance compliance posture by leveraging a technology stack (e.g. data access controls and transparency, data residency, customer managed encryption keys) that reduces the risk of implementing an AI strategy. It also streamlines data capture in key mortgage processes such as document verification and underwriting.

    Partnering to transform your home loan experience

    Our Deployed AI approach is about providing useful solutions to solve business challenges, which is why we’re working with a network of partners in different phases of the loan application process. We are excited to partner with Roostify to transform the home loan experience during origination. Roostify makes a point-of-sale digital lending platform that uses Google Cloud Lending DocAI to speed-up mortgage document processing for borrowers and lenders. Roostify has been working with many customers to develop our joint solution, and we have incorporated valuable feedback along the way.

    “The mortgage industry is still early in transitioning from traditional, manual processes to digitally-enabled and automated, and we believe that transformation will happen much more quickly with the power of AI. And if you are going to do AI, you’ve got to go Google.” - Rajesh Bhat, Founder and CEO, Roostify

    Our goal is to give you the right tools to help borrowers and lenders have a better experience and to close mortgage loans in shorter time frames, benefiting all parties involved. With Lending DocAI, you will reduce mortgage processing time and costs, streamline data capture, and support regulatory and compliance requirements.

    Let’s connect

    Be sure to tune in to the Mortgage Bankers Association annual convention to learn more from our Fireside Chat and session with Roostify!

    Related Article

    Empowering teams to unlock the value of AI

    The latest and greatest AI and machine learning news from Google Cloud

    Read Article
    ]]>         <![CDATA[How Mercari reduced request latency by 15% with Cloud Profiler]]> https://tsecurity.de/de/3662835/it-security-nachrichten/how-mercari-reduced-request-latency-by-15-with-cloud-profiler/ https://tsecurity.de/de/3662835/it-security-nachrichten/how-mercari-reduced-request-latency-by-15-with-cloud-profiler/ Sun, 12 Jul 2026 08:06:56 +0200 📰 IT Security Nachrichten tsecurity.de

    Editor’s note: For retailers, predicting consumers’ desires and demand is the holy grail. For retail IT, the goal is understanding the performance of your ecommerce applications. Here, Japanese online retailer Mercari shows how they used Cloud Profiler and Trace to understand a complex microservices-based application running on Google Cloud, to meet rigorous SLOs as demand shifts for their products. 

    The events of 2020 have accelerated ecommerce, increasing demand for and traffic on online marketplaces. Analyst eMarketer predicts that ecommerce sales in the United States will grow 18% in 2020, against an overall fall in total retail sales of 10.5% for the year. Likewise, our business—Japan-headquartered consumer-to-consumer marketplace Mercari Inc—is growing rapidly. In the United States alone, we have seen 74% year-on-year growth in monthly average users to 3.4 million. A big part of our success are our robust payment and deposit systems and AI-based fraud monitoring, which enable sellers to list items for purchase and buyers to complete transactions safely. 

    Mercari started as a monolithic application but as complexity grew we decided to transition to a microservices architecture. And through it all, tools like Cloud Profiler and Cloud Trace helped us track down performance problems in our code, significantly improving latency.

    A microservices menagerie

    Today, we run 80+ microservices on Google Cloud with a mix of languages including Go, Python, JavaScript and Java. To deliver this new architecture, we created a gateway-like microservice to route traffic from soon-to-be migrated monolithic service to the Google Cloud microservices, which  delivers a range of features. 

    After creating several microservices, we identified common requirements and created a template to accelerate their development. These common requirements included: 

    • Exporting metrics to Prometheus

    • A gRPC server and interceptors

    • Error Reporting, Cloud Trace and Cloud Profiler. Error Reporting counts, analyzes and aggregates crashes in running cloud services, while Cloud Trace provides a view of requests as they flow through microservices and Cloud Profiler shows how microservices consume CPU, memory and threads.  

    We then used Python to create a template for machine learning services, also expediting the creation of new microservices. This has enabled us to grow the number of microservices we use in order to address new requirements. However, as our microservices proliferated, we needed to efficiently monitor and understand their performance. 

    Maintaining SLO a challenge

    In particular, we needed to monitor the impact of new versions on the production environment and the efficiency of production operations, so we could maintain our service level objective (SLO) for success rates of 99.95% and 350 milliseconds for 95% latency. 

    Our engineering team also uses canary deployments to detect issues with new versions of major services. However, despite applying these measures, we found it challenging to maintain our SLO when our business grew faster than expected or during unanticipated spikes in demand. Some issues can be obvious or easy to detect. For example, if a service is experiencing high CPU utilization, we could simply place or fine tune our horizontal pod autoscaler (HPA) to resolve the problem. However, other issues may be less obvious. For example, a drop in performance may not directly be tied to a specific release—it may instead be due to unexpected requests, or may arise from changes to multiple functions in a single code release. 

    Using Cloud Profiler and Cloud Trace to minimize performance issues

    In particular, our business-critical UserStats service, which tracks the speed with which a user replies to a message and how fast and reliably a seller ships an item, recently started performing poorly. 

    New feature requirements had prompted us to track how often a seller cancels an order and provide statistics. However, while adding this new functionality, the change refactored other functions, meaning we were unable to identify the function experiencing reduced performance. Since most of our services are enabled with Cloud Profiler and Cloud Trace, we turned to these products to investigate and identify the root cause.  

    Before the change:

    Using Cloud Profiler and Cloud Trace.jpg
    Click to enlarge

    After the change:

    Using Cloud Profiler and Cloud Trace 2 (1).jpg
    Click to enlarge

    These two Cloud Profiler views show the CPU time of the call stack increased from 457 milliseconds to 904 milliseconds, with most of the delta attributable to the _UserStats_SellerCancelStats_Handler function. But because other functions also saw variations in their CPU consumption, and because calls occurred in parallel, we found it difficult to identify the cause of latency increases. The fact that this function call was necessary meant we could not remove the entire function. 

    We checked Cloud Trace and confirmed the function call had increased overall latency on some requests, similar to below:

    trace waterfall view.jpg
    Click to enlarge

    We analyzed the service with Cloud Profiler and identified hot spots that were contributing to the increase in CPU time consumption. We optimized these hot functions, deployed the new code, used Cloud Profiler to verify that the changes had the desired effect of reducing the CPU time. Doing so, we were able to improve latency by 10% to 15%!

    Simplifying the DevOps experience

    Before adopting Cloud Profiler, profiling production services was a tedious and manual undertaking involving recompiling with debug flags; deployment to production environments, and using disparate  tools to collect profiles and perform analysis. Containerization only increased this complexity, further reducing developer productivity. 

    Cloud Profiler enables us to continuously profile production environments with small and simple code changes, replacing the tedious work previously required to set up environments for performance analysis. Low overhead continuous profiling with Cloud Profiler helps us react swiftly to changes in service performance by root causing and resolving issues quickly.

    Further, tools such as Cloud Trace and Cloud Profiler require minimal effort to setup and provide a consistent DevOps experience for our service owners. This is particularly important as we grow in the United States and elsewhere. Without Google Cloud, monitoring, debugging and profiling across production environments that feature a mix of languages, technology stacks, frameworks and containers would be extremely challenging and time-consuming. The release of new features and experiences in tools such as Cloud Profiler make us glad we chose Google Cloud as our primary cloud platform. We will continue to work with new features and provide feedback to Google Cloud, so it can continue to provide a better service to users.  

    Visit the Google Cloud website to learn more about Cloud Profiler and Cloud Trace.

    Related Article

    Mercari: Faster and more efficient development with the help of Google Cloud

    Technical implementation can be challenging, and many businesses can benefit from hands-on support from their cloud provider. Learn how w...

    Read Article
    ]]>         <![CDATA[Your Samsung Gallery won't be able to sync with Microsoft OneDrive soon]]> https://tsecurity.de/de/3661914/it-nachrichten/your-samsung-gallery-wont-be-able-to-sync-with-microsoft-onedrive-soon/ https://tsecurity.de/de/3661914/it-nachrichten/your-samsung-gallery-wont-be-able-to-sync-with-microsoft-onedrive-soon/ Sat, 11 Jul 2026 15:31:16 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Monitor-Upgrade für Ihren PC: OLED, IPS oder Mini-LED – was bringt im Alltag wirklich etwas?]]> https://tsecurity.de/de/3661428/it-nachrichten/monitor-upgrade-fuer-ihren-pc-oled-ips-oder-mini-led-was-bringt-im-alltag-wirklich-etwas/ https://tsecurity.de/de/3661428/it-nachrichten/monitor-upgrade-fuer-ihren-pc-oled-ips-oder-mini-led-was-bringt-im-alltag-wirklich-etwas/ Sat, 11 Jul 2026 09:17:38 +0200 📰 IT Nachrichten tsecurity.de

    Ein neuer Monitor ist das wohl spürbarste Upgrade für jeden PC-Arbeitsplatz. Schließlich starren wir täglich stundenlang genau auf diese eine Komponente. Während vor einigen Jahren noch vor allem die Bildschirmdiagonale und die Auflösung entscheidend waren, stehen Käufer heute vor einer technologischen Grundsatzfrage.

    Die Eier legende Wollmilchsau gibt es nämlich leider immer noch nicht: Was beim nächtlichen Zocken fßr offene Mßnder sorgt, kann Sie beim morgendlichen Excel-Marathon im hell erleuchteten Homeoffice schnell im Stich lassen.

    Damit Sie beim Upgrade nicht in technische Fettnäpfchen treten, drÜseln wir die Stärken und Schwächen der drei wichtigsten Technologien auf und geben eine Kaufberatung fßr die unterschiedlichen Modelltypen.

    Die drei Panel-Technologien im Alltags-Check

    Um das Maximum aus Ihrem Budget herauszuholen, sollten Sie die Charakteristiken der Panel-Typen kennen. Jede Technik hat ein optimales Einsatzgebiet.

    1. Der IPS-Monitor: Unkomplizierter Allrounder fĂźr den Alltag

    IPS (In-Plane Switching) gilt seit Jahren als der vernßnftige AlleskÜnner unter den Display-Technologien. Die Technologie ist ausgereift, langlebig und bietet hervorragende Farbtreue sowie extrem stabile Blickwinkel. Egal, ob Sie schräg vor dem Monitor sitzen oder ein Kollege von der Seite daraufblickt: Die Farben verfälschen sich nicht.

    Das größte Manko dieser Technik ist jedoch der systembedingte Kontrast. Weil hier eine dauerhafte Hintergrundbeleuchtung durch die Flüssigkristalle scheint, schimmert Schwarz im dunklen Raum eher dunkelgrau (IPS-Glow).

    FĂźr wen eignen sich IPS-Displays?

    Dieser Displaytyp ist ideal fßrs Homeoffice, klassische Bßroarbeiten, Bildbearbeitung und Gelegenheitsspieler, die einen zuverlässigen Monitor ohne das Risiko von Einbrenneffekten suchen.

    Produktempfehlung: LG UltraGear 27GR75Q-B

    LG Electronics 27GR75Q-B

    LG

    LG UltraGear 27GR75Q-B bei Amazon ansehen

    Preis: ca. 299 Euro

    Technik-Specs:

    • Bilddiagonale & Format: 27 Zoll (68,5 cm), Seitenverhältnis 16:9
    • AuflĂśsung & Panel-Typ: WQHD (2.560 × 1.440 Pixel), IPS-Panel
    • Farbraum & Helligkeit: 99 % sRGB-Abdeckung, HDR10-UnterstĂźtzung, maximale Helligkeit 300 Nits
    • Bildwiederholrate & Reaktionszeit: 165 Hz nativ, 1 ms
    • Synchronisation: AMD FreeSync Premium, Nvidia G-Sync Compatible
    • Ergonomie-Funktionen: HĂśhenverstellbar, neigbar, schwenkbar, Pivot-Funktion (90-Grad-Drehung)
    • Zusatzfunktionen: Flicker-Safe-Hintergrundbeleuchtung, Blaulichtreduktion (Reader Mode), softwarebasierte MenĂźsteuerung (OnScreen Control)
    • AnschlĂźsse: 1 × DisplayPort 1.4, 2 × HDMI (Version herstellerseitig nicht spezifiziert), 1 × 3,5-mm-Klinkenanschluss (KopfhĂśrer)

    Der LG UltraGear 27GR75Q-B bedient die im Consumer-Bereich weitverbreitete Kombination aus 27-Zoll-Diagonale und WQHD-AuflÜsung. Das verbaute IPS-Panel bietet eine Pixeldichte, die fßr eine angenehm scharfe Textdarstellung im Bßroalltag sorgt, während die Bildwiederholrate von 165 Hz flßssige Bildbewegung beim Gaming verspricht.

    Mit einer herstellerseitig angegebenen sRGB-Farbraumabdeckung von 99 Prozent eignet sich das Modell auch fĂźr grundlegende Bildbearbeitungen im semiprofessionellen Bereich.

    2. Mini-LED-Monitore: HDR-Leuchtkraft fßr helle Räume

    Mini-LED ist die Evolution des klassischen LCD-Monitors. Statt einiger großer Leuchtdioden sitzen dabei jedoch tausende winzige LEDs hinter dem Panel, die in hunderten separaten Zonen geregelt werden können (Local Dimming).

    Der Effekt: Wo das Bild besonders dunkel sein soll, kĂśnnen die entsprechenden Dimmzonen stark heruntergeregelt oder sogar abgeschaltet werden. Das sorgt fĂźr fantastische Kontraste und eine beeindruckende Spitzenhelligkeit, die echtes, blendendes HDR ermĂśglicht.

    Der Nachteil: Um helle Objekte auf dunklem Grund (wie den Mauszeiger) kann ein minimaler Lichtkranz entstehen (Blooming).

    FĂźr wen eignen sich Mini-LED-Monitore?

    Besonders in hellen Räumen spielt Mini-LED seine Stärken aus. Die Technik eignet sich außerdem für ambitionierte Gamer und Film-Enthusiasten, die spektakuläre HDR-Effekte ohne Kompromisse bei der Helligkeit erleben möchten.

    Produktempfehlung: AOC Gaming Q27G3XMN

    AOC Gaming Q27G3XMN

    AOC

    AOC Gaming Q27G3XMN bei Amazon ansehen

    Preis: 259 Euro

    Technik-Specs:

    • Bilddiagonale & Format: 27 Zoll (68,6 cm), Seitenverhältnis 16:9, mattes Display
    • AuflĂśsung & Panel-Typ: QHD (2.560 × 1.440 Pixel), VA-Panel
    • Hintergrundbeleuchtung: Mini-LED-Technologie mit 336 lokalen Dimmzonen (Local Dimming)
    • Kontrast & Helligkeit: Statischer Kontrast 3.000:1, maximale Spitzenhelligkeit 1.000 Nits
    • HDR-Zertifizierung: VESA Certified DisplayHDR 1000
    • Bildwiederholrate & Reaktionszeit: 180 Hz nativ, 1 ms
    • Synchronisation: AMD FreeSync Premium Pro
    • Ergonomie-Funktionen: 130 mm hĂśhenverstellbar, Pivot-Funktion (90-Grad-Drehung), abnehmbarer Standfuß, VESA-Wandhalterung kompatibel (100 x 100 mm)
    • Zusatzfunktionen: Flicker-Free-Hintergrundbeleuchtung, Blaulichtreduktion (Low Blue Light), herstellereigene Konfigurationssoftware (AOC G-Menu)
    • AnschlĂźsse: 1 × DisplayPort 1.4, 2 × HDMI 2.0, 1 × 3,5-mm-Klinkenanschluss (KopfhĂśrer)
    • Lieferumfang & Service: Monitor, Stromkabel, HDMI-Kabel, DisplayPort-Kabel, Treiber-CD, 3 Jahre Herstellergarantie

    Der AOC Gaming Q27G3XMN platziert sich als vergleichsweise gĂźnstiger Einstieg in die Mini-LED-Technologie. Durch die VESA-Zertifizierung nach dem DisplayHDR-1000-Standard liefert das Panel eine deutlich hĂśhere Spitzenhelligkeit und Dynamik als klassische IPS-Monitore ohne lokales Dimming. 336 separate Dimmzonen ermĂśglichen eine selektive Abschaltung der Hintergrundbeleuchtung, womit der Kontrast bei der Darstellung von HDR-Inhalten im Vergleich zu herkĂśmmlichen Edge-LED-Modellen sichtbar steigt.

    3. OLED-Monitore: Das visuelle Nonplusultra mit perfektem Schwarz

    OLED-Monitore sind der Traum vieler Gamer und Heimkino-Enthusiasten. Weil hier jedes Pixel als winziges, selbstleuchtendes Element agiert, benĂśtigt OLED keine Hintergrundbeleuchtung. Wird ein Pixel abgeschaltet, ist es absolut schwarz. Das resultiert in unendlichem Kontrast und einer Bildtiefe, die keine andere Technik erreicht.

    Hinzu kommen Reaktionszeiten nahe dem theoretischen Nullpunkt. Allerdings erreichen OLED-Monitore bei großflächigen Bildinhalten meist nicht die Dauerhelligkeit hochwertiger Mini-LED-Displays. Bei statischen Inhalten (wie Excel-Tabellen oder Taskleisten) besteht auf Dauer zudem ein theoretisches Risiko für Einbrenneffekte (Burn-In). Solche Monitore setzen deshalb auf verschiedene Schutzmechanismen wie Pixel-Refresh, Pixel-Shift oder automatische Helligkeitsanpassungen.

    FĂźr wen eignet sich die OLED-Technik?

    Fßr Hardcore-Gamer, Cineasten und Nutzer, die primär in abgedunkelten Räumen arbeiten oder spielen und die absolut beste Bildqualität suchen.

    Produktempfehlung: Asus ROG Swift OLED PG27AQDM

    ASUS ROG Swift OLED PG27AQDM - 27 Zoll WQHD Gaming Monitor

    Asus

    Asus ROG Swift OLED PG27AQDM bei Amazon ansehen

    Preis: 600 Euro

    Technik-Specs:

    • Bilddiagonale & Format: 26,5 Zoll (67,3 cm), Seitenverhältnis 16:9, Anti-Glare-Oberfläche (reflexionsarm)
    • AuflĂśsung & Panel-Typ: WQHD (2.560 × 1.440 Pixel), 10-Bit-OLED
    • Farbraum & Farbtreue: 99 % DCI-P3-Farbraumabdeckung, sehr hohe Farbgenauigkeit (Delta E < 2)
    • Helligkeit: Maximale Spitzenhelligkeit von 1.000 Nits, optionale Funktion fĂźr gleichmäßige Helligkeitsbegrenzung
    • Bildwiederholrate & Reaktionszeit: 240 Hz nativ, 0,03 ms
    • Synchronisation & Input: Nvidia G-Sync Compatible, AMD FreeSync Premium, GameFast Input (EingabeverzĂśgerungs-Reduzierung)
    • Panel-Schutz (Wärmemanagement): Integrierter, angepasster KĂźhlkĂśrper (Heatsink), softwareseitige Spannungsoptimierung zur Verringerung des Burn-In-Risikos
    • Ergonomie & Bedienung: Standfuß mit flexiblen VerstellmĂśglichkeiten, Monitoreinstellungen Ăźber Windows-Software per Maus steuerbar
    • AnschlĂźsse: DisplayPort 1.4, HDMI (Version herstellerseitig nicht spezifiziert), integrierter USB-Hub

    Der Asus ROG Swift OLED PG27AQDM setzt auf die typischen Stärken der OLED-Technologie: konstruktionsbedingt perfektes Schwarz und extrem niedrige Reaktionszeiten von 0,03 Millisekunden.

    In Kombination mit der hohen Bildwiederholrate von 240 Hertz eignet sich das Modell primär fßr schnelle, kompetitive Spiele. Um der typischen OLED-Problematik des Panel-Einbrennens (Burn-In) entgegenzuwirken, verbaut der Hersteller einen passiven KßhlkÜrper und nutzt eine softwareseitige Spannungsoptimierung, die die thermische Belastung der organischen Pixel im Betrieb reduzieren soll.

    Die drei Technologien im Vergleich

    Hier sehen Sie die Stärken und Schwächen im direkten Schlagabtausch, um die richtige Kaufentscheidung fßr Ihren Arbeitsplatz zu treffen:

    KriteriumIPS-PanelMini-LEDOLED
    Schwarzwert & KontrastBefriedigend (Grauschleier)Sehr gut (leichtes Blooming)Perfekt (Unendlicher Kontrast)
    SpitzenhelligkeitGut (ca. 300–400 Nits)Brillant (1.000+ Nits)Sehr gut (ca. 400–1.000 Nits)
    ReaktionszeitSchnell (1–4 ms)Schnell (1–4 ms)Extrem schnell (0,03 ms)
    BlickwinkelstabilitätSehr hochHochExtrem hoch
    Risiko fĂźr statische InhalteKeinesKeinesGeringes Risiko (Burn-In-Schutz sinnvoll)
    Preis-Leistungs-VerhältnisGutGutGehobene Preisklasse

    Software-Ergänzungskit: Mehr Komfort im Monitor-Alltag

    Ein Hardware-Upgrade ist nur die halbe Miete. Mit diesen drei kostenlosen Software-Tools holen Sie noch mehr aus Ihrem neuen Bildschirm heraus:

    • Microsoft PowerToys (FancyZones): Gerade bei großen oder ultra weiten Monitoren ist das Standard-Fensterlayout von Windows Ăźberfordert. Mit dem Modul FancyZones unterteilen Sie Ihren Bildschirm in feste, frei definierbare Raster, in die Sie Fenster mit gedrĂźckter Shift-Taste blitzschnell einrasten lassen. Ein Must-Have fĂźr Multitasking.
    • Twinkle Tray: Wer die Helligkeit seines Monitors nicht mĂźhsam Ăźber die fummeligen Tasten direkt am Gehäuse verstellen mĂśchte, steuert mit diesem Tool die Monitorhelligkeit ganz bequem per Mausrad oder Tastenkombination direkt aus der Windows-Taskleiste heraus.
    • Auto Dark Mode: Um bei OLED-Displays dauerhaft helle Oberflächen zu reduzieren und am Abend die Augen zu entlasten, schaltet dieses Tool Windows sowie kompatible Apps und Websites nach Sonnenuntergang automatisch in den dunklen Design-Modus.

    Fazit: Welcher Monitor-Typ sind Sie?

    Das perfekte Monitor-Upgrade richtet sich immer nach Ihrem Nutzungsverhalten im Alltag: Wer einen treuen, langlebigen Partner sucht, der acht Stunden am Tag ohne Murren Office-Dokumente anzeigt und beim Budget nicht schmerzt, greift zum IPS-Klassiker.

    Wer sich hingegen von spektakulären HDR-Effekten in Filmen und Spielen begeistern lassen will oder tagsüber in hellen Räumen arbeitet, findet im Mini-LED-Monitor einen hell leuchtenden Allrounder. Wenn kompromisslose Bildqualität, perfektes Schwarz und die schnellsten Reaktionszeiten beim Gaming im Vordergrund stehen, führt kein Weg am OLED-Panel vorbei – sofern das nötige Kleingeld vorhanden ist.

    ]]>         <![CDATA[iOS 27 Mail Update: Smart Inbox Filters And New AI Tools Arrive]]> https://tsecurity.de/de/3661331/ios-mac-os/ios-27-mail-update-smart-inbox-filters-and-new-ai-tools-arrive/ https://tsecurity.de/de/3661331/ios-mac-os/ios-27-mail-update-smart-inbox-filters-and-new-ai-tools-arrive/ Sat, 11 Jul 2026 07:53:34 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[57% of enterprises have watched AI agents be confidently wrong. The fix is an agentic context layer, but who has one?]]> https://tsecurity.de/de/3660872/it-nachrichten/57-of-enterprises-have-watched-ai-agents-be-confidently-wrong-the-fix-is-an-agentic-context-layer-but-who-has-one/ https://tsecurity.de/de/3660872/it-nachrichten/57-of-enterprises-have-watched-ai-agents-be-confidently-wrong-the-fix-is-an-agentic-context-layer-but-who-has-one/ Fri, 10 Jul 2026 23:47:15 +0200 📰 IT Nachrichten tsecurity.de An enterprise AI agent answers with total confidence, but the number is wrong. Nobody catches it until someone traces it back to a stale metric definition or a document the retrieval system never pulled. The model did not fail. The context it was given did.

    In the past six months, 57% of enterprises traced a confident but wrong AI agent answer to missing or inconsistent business context, and 31% said it happened more than once, according to a VB Pulse June 2026 survey of 101 qualified enterprises with more than 100 employees.

    The reason is not hard to find. Retrieval over documents is the default way agents get business context for 38% of enterprises, nearly double the next closest approach. The way most enterprises choose a retrieval system compounds the problem. Ease of ingestion and operational simplicity lead the selection criteria, with retrieval accuracy running behind both. The accuracy problem only shows up after the system is already live.

    There is a known fix for this, a governed context layer every agent reads from instead of guessing. Vendors are racing to roll out context platforms while most enterprises are still figuring out what it is.

    75% don't have an agentic context layer yet

    The context layer is meant to be a shared model of what business data actually means, built once and referenced consistently instead of re-derived by every agent that touches it. 

    The VentureBeat research shows the enterprise response to that idea is broad but unfinished. Twenty-five percent of respondents run one in production. Thirty-four percent are building one right now. The remaining 41% have not started.

    Among companies already building or running a governed context layer, 78% report a confident-wrong failure — an AI agent that answered with total certainty and was still wrong. Among companies with no plans to build a layer, only 20% report the same thing. Companies that already got burned are far more likely to be building the fix. Companies that haven't been burned yet see no urgency.

    What governed context looks like when someone actually builds one

    Every major data and AI platform vendor is now building some version of this layer, and they are not converging on the same architecture. 

    • DataHub is treating catalog metadata and years of analyst query behavior as a knowledge source, then keeping it current as a living system rather than a static wiki. 

    • Microsoft's Fabric IQ is building a business ontology that any agent, not just Microsoft's own, can query over MCP. 

    • Couchbase is pushing agent memory and context retrieval down to the edge, arguing the operational database is a more natural home for it than a search or analytics layer bolted on after the fact. 

    • Pinecone's Nexus is compiling structural logic into the metadata layer ahead of runtime, betting that agents need pre-built structure more than they need faster search.

    • Snowflake runs a two-layer system, Horizon Context for customer-managed definitions and Cortex Sense for context the platform infers on its own. 

    • Oracle's Unified Memory Core takes the opposite approach, folding vector, graph and relational data into one transactional engine so there is no sync layer left to go stale. 

    • Google's Knowledge Catalog mines query logs and usage patterns to curate semantic context automatically.

    • AWS's Context service makes the same bet, a knowledge graph that gets smarter from how agents actually use it rather than from manual re-curation.

    Analysts converge on one diagnosis

    The vendor approaches differ. What analysts and practitioners have told VentureBeat about the underlying problem, across a run of interviews this year, does not.

    When DataHub's context layer push landed this spring, Constellation Research VP and principal analyst Michael Ni framed the stakes in blunt terms. "Whoever controls runtime context controls the AI decision layer for enterprise data," Ni said. He was equally direct about how far any single product actually gets a buyer. "Vector memory isn't business meaning, business meaning isn't governance and governance isn't execution," Ni said.

    In the same interview, BARC analyst Kevin Petrie pointed to a narrower but concrete gap. Most context platforms concentrate on structured tables, he said, which give agents trusted facts but miss the harder, messier context locked in documents and unstructured content, exactly the material a business actually runs on day to day.

    Stephanie Walter, practice leader for AI Stack at HyperFRAME Research, made a related point earlier this year when VentureBeat asked her about enterprise context fragmentation. 

    "The market is converging on the same conclusion," Walter said. "Agents don't just need more tokens or better models. They need governed, current, low-latency context." She made a similar case in an earlier review of Pinecone's Nexus launch, careful not to overstate how new any of this is. Nexus, she said, "shifts knowledge work from runtime chaos to pre-compiled structure. But it's an evolution of RAG architecture, not a complete reinvention." 

    Gartner's Arun Chandrasekaran, reviewing the same launch, offered the more forward-looking read. Agentic AI, he said, is moving from pure information retrieval toward a reasoning architecture, one where long context works as short-term memory and a vector database functions as deep storage underneath it.

    The fragmentation problem shows up hardest at the practitioner level, where separate tools for retrieval, memory and access control were never built to agree with each other. Steven Dickens, CEO and principal analyst at HyperFRAME Research, put it bluntly after Oracle's AI database push landed this spring. "Data teams are exhausted by fragmentation fatigue," Dickens said. "Managing a separate vector store, graph database and relational system just to power one agent is a DevOps nightmare." 

    Matt Kimball at Moor Insights and Strategy, in that same story, put the production reality more simply. Getting an agent working is not the hard part, he said. The struggle is running it in production, where the goal becomes removing the distance between data and execution rather than adding another layer on top of it.

    What this means for enterprises

    Here's what this adds up to for enterprises building on this layer.

    Retrieval alone will not close the context gap. RAG is the default source for context in most enterprises today, and it is also the layer most closely associated with the confident-wrong-answer failure. Adding more documents or a bigger index does not fix a definition that is inconsistent across systems.

    The semantic context layer is where the budget is actually moving, even where it hasn't shipped. Fifty-eight percent of enterprises are already engaged — building or in production — but only 25% have actually gotten a layer live. That gap shows where enterprises have decided to spend, not where they've arrived.

    No single vendor owns the architecture yet, and that is likely to stay true for a while. Enterprises evaluating this layer should expect to integrate rather than pick a single winner, at least for the next several quarters.

    The buying decision is happening this year, and it is concentrated among the companies already burned by it. Fifty-seven percent of enterprises plan to switch or add a retrieval or context platform within the next twelve months. That intent is not spread evenly. Enterprises that reported a repeat confident-wrong failure plan to switch or add a provider at roughly 81%, against 32% among enterprises that never hit the problem. The companies shopping for new context tooling right now are largely the ones whose agents already got it wrong.

    The agents are already running. The context underneath most of them is still being built, and the vendor selling the fix is being chosen this year.

    This data will be part of a broader conversation at VB Transform 2026 on July 14 and 15 in Menlo Park: the context gap enterprises are racing to close, and which of the emerging approaches — governed semantic layers, hybrid retrieval, provider-native bundles — actually holds up in production.

    ]]>         <![CDATA[Google Workspace Weekly Recap - July 10, 2026]]> https://tsecurity.de/de/3660827/web-tipps/google-workspace-weekly-recap-july-10-2026/ https://tsecurity.de/de/3660827/web-tipps/google-workspace-weekly-recap-july-10-2026/ Fri, 10 Jul 2026 23:10:13 +0200 Web Tipps tsecurity.de Join video conferences on Google Meet hardware via SIP through Pexip

    You can now join video conferences on Google Meet hardware via SIP through a Pexip interop gateway. This brings universal connectivity for users to join meetings hosted on any SIP-compatible platform directly from their Meet rooms. The functionality is available for room hardware based on both Android and ChromeOS. | Learn more.

    Occupancy counting now available for Google Meet on Neat room hardware

    Occupancy counting is now available for Android-based Neat room hardware to help measure how meeting rooms are used. This feature brings the same occupancy counting capabilities found on ChromeOS devices to Android-based hardware. | Learn more.

    Fill with Gemini in Sheets now available in 11 additional languages

    We're leveraging the capabilities of the AI function in Google Sheets, Fill with Gemini eliminates the need for complex formulas, helping you easily generate text, summarize information, categorize data, or analyze sentiment at scale with generated content appearing directly in the cells you choose. | Learn more.

    New calendar sharing permission level and changes to recurring event visibility

    We're introducing a new calendar sharing permission level: “Make changes (see private events as free/busy)”. This allows you to grant someone edit access to your calendar while keeping the details of your private events entirely hidden. This is especially useful for leaders who assign delegates to help them manage their calendars. | Learn more.

    Convert your Google Slides to videos in 7 additional languages

    Google Vids already lets you convert your Slides content into Vids with AI-generated scripts, voiceovers, background music, and animations for presentations and accounts in English. We’re now expanding support to French, German, Italian, Japanese, Korean, Portuguese, and Spanish. | Learn more.

    Streamline identity lifecycle management in Google Workspace with new inbound SCIM support

    We are excited to announce the general availability of Google Workspace inbound SCIM APIs to help IT administrators standardize identity lifecycle management. This new capability allows you to sync your Google Workspace directory in real time with any SCIM-compatible Identity Provider (IdP), HR system (HRIS), or custom application. | Learn more.

    The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

    ]]>         <![CDATA[IBM grows mainframe family with rack, frame models targeting AI, hybrid clouds]]> https://tsecurity.de/de/3660589/it-security-nachrichten/ibm-grows-mainframe-family-with-rack-frame-models-targeting-ai-hybrid-clouds/ https://tsecurity.de/de/3660589/it-security-nachrichten/ibm-grows-mainframe-family-with-rack-frame-models-targeting-ai-hybrid-clouds/ Fri, 10 Jul 2026 20:23:19 +0200 📰 IT Security Nachrichten tsecurity.de

    IBM is looking to expand the reach of its foundational mainframe portfolio by adding new single frame and rack mounted versions of its Z and LinuxONE systems.

    The IBM z17 portfolio adds a single frame and rack mount versions that bring mainframe capabilities into smaller, customizable footprints. The LinuxONE Rockhopper family gets a single frame and rack mount models, plus a new Express rack mount offering, that target new and smaller clients, according to Tina Tarquinio, chief product officer, IBM Z & LinuxONE.

    Specifically, the new hardware includes:

    • z17 single frame is a fully packaged box in an IBM rack with intelligent power distribution units, delivered as a complete enclosed unit ready to deploy at the edge or other strategically important customer sites.
    • z17 rack mount lets customers install IBM Z components directly into their own industry-standard rack, with built-in flexibility for co-location with other technologies.
    • LinuxONE Rockhopper 5 is a multi-drawer LinuxONE system for high-density workloads, with on-chip AI acceleration, confidential computing, and postquantum cryptography available in both single frame and rack mount configurations.
    • Rockhopper 5 rack mount and Express offerings deliver enterprise-grade Linux, confidential computing, and on-chip AI acceleration in a compact 18U configuration. Designed for organizations supporting a smaller set of workloads, the offering provides a cost-efficient entry point that can scale as business grows, while prioritizing security, resiliency, and performance.
    IBM LinuxONE 5 single frame system

    IBM

    The new IBM z17 and IBM LinuxONE 5 Rockhopper configurations support up to 82 cores and 18 TB of memory across two processor drawers, representing about a 20% increase in core count and 12% increase in memory capacity over current systems, IBM stated. Single processor capacity of an IBM z17 ME2 provides full speed IBM z/OS configurations including 10% greater throughput per core than IBM z16 A02 with some variation based on workload and configuration, according to Tarquinio.

    Both systems feature a 5.5 GHz IBM Telum II processor and a built-in AI accelerator that IBM says will let customers run more than 450 billion inferencing operations in a day with one millisecond response time. In addition, the 32-core Spyre AI accelerator is designed to handle all manner of AI workloads.

    The idea is to bring the core strengths of IBM Z to a broader range of deployment models while offering the security, resilience, and performance enterprises depend on, Tarquinio said. 

    “As always, we’re continuing to innovate to deliver more with less, including up to 20% more capacity than IBM z16 to help process transactions faster and support growing AI-driven workloads,” Tarquinio said.  “Even the newest and smallest member of the IBM z17 family delivers the performance, efficiency, and scalability organizations need as they balance growth ambitions with real-world resource constraints.”

    The Linux-based system, Rockhopper 5 is for organizations that have moved past the evaluation question and are ready to consolidate a substantial portion of their x86 estate, said Marcel Mitran, IBM Fellow and CTO of IBM LinuxONE. 

    Rockhopper 5 is designed to bring a smaller physical footprint and a software licensing model that reflects actual workload boundaries rather than physical server counts, Mitran said.

    The LinuxONE 5 Express is a preconfigured system designed to get organizations running on LinuxONE quickly, with a defined bill of materials and a predictable starting cost, on the same architecture that the largest enterprises in the world depend on, Mitran said.

    “It is built for organizations that want to consolidate a modest x86 estate, evaluate LinuxONE for the first time, or deploy a specific workload such as digital assets, AI-infused transaction processing, or confidential computing, without committing to the footprint of the larger model,” Mitran said.

    Some of the mainframes’ software features were also bulked up. For example, IBM said that Post Quantum Cryptography security is now standard on the z17 and LinuxONE Rockhopper 5 systems letting customers start to utilize cryptography to protect core resources for the future.

    The idea is to help customers protect long-lived, mission-critical data while reducing the cost and complexity of future cryptographic migration, IBM stated. 

    In that vein, IBM said it was bringing Crypto Discovery & Inventory, which lets security teams see what has been encrypted across the enterprise. In addition, IBM announced an Infrastructure Management for Z and LinuxONE package that would let customers administer, monitor, automate, and provision IBM Z and LinuxONE systems from a central location.

    IBM said it wants to reduce operational complexity for customers by making automating day-to-day operations to ultimately lower administrative costs and concerns. With the new flexible form factors, IBM continues to target hybrid and AI infrastructure buildouts with the Big Iron. In the AI world, the z17 is being utilized for AI inferencing, transactions, training, and key security applications such as fraud detection and insurance claims.

    “Enterprise infrastructure is entering a new phase. Organizations need platforms that can support AI-driven growth while navigating resource constraints, evolving business requirements, and increasingly complex hybrid environments,” Tarquinio said. “They are being asked to deploy new AI capabilities while learning new skills, controlling operational costs, and maximizing the value of existing applications and infrastructure.”

    A recent IBM Institute study on mainframe usage stated that embedding mainframe to support AI in executing transactions is not temporary: 75% of executives expect mainframe-based applications to remain central to digital transformation, and 60% say mainframe-based platforms are essential to enabling AI innovation.

    ”Mainframe-anchored systems of record are becoming systems of intelligent execution—not as general‑purpose AI platforms, but as environments where AI acts directly within transactions and in support of them,” the study reported.

    Gartner wrote in its “The State of the IBM Mainframe in 2026” report that IBM’s willingness to make significant investments ensure the mainframe modernizes to remain a vital and thriving component of enterprise IT.  

    “Most mainframe customers are now prioritizing the reduction of technical debt and adopting platform innovations to future-proof their mainframe environments for the coming decade,” Gartner wrote.

    The new z17 single frame and rack mount configurations, LinuxONE Rockhopper 5, and LinuxONE 5 Express will all be available August 12, 2026. IBM Infrastructure Management for IBM Z and IBM LinuxONE will be available August 14.

    ]]>         <![CDATA[OpenAI staffer maps out which of GPT-5.6 Sol's five reasoning levels fits which task complexity]]> https://tsecurity.de/de/3660557/ai-nachrichten/openai-staffer-maps-out-which-of-gpt-56-sols-five-reasoning-levels-fits-which-task-complexity/ https://tsecurity.de/de/3660557/ai-nachrichten/openai-staffer-maps-out-which-of-gpt-56-sols-five-reasoning-levels-fits-which-task-complexity/ Fri, 10 Jul 2026 20:04:26 +0200 🔧 AI Nachrichten tsecurity.de

    GPT-5.6 Sol ships with five reasoning levels from "Light" to "xhigh," plus "Max" and "Ultra" modes that deploy multiple sub-agents in parallel. OpenAI's Vaibhav Srivastav recommends starting low and only scaling up when needed.

    The article OpenAI staffer maps out which of GPT-5.6 Sol's five reasoning levels fits which task complexity appeared first on The Decoder.

    ]]>         <![CDATA[Dumb Co dared me to trade my iPhone for a hacked flip phone]]> https://tsecurity.de/de/3660322/ai-nachrichten/dumb-co-dared-me-to-trade-my-iphone-for-a-hacked-flip-phone/ https://tsecurity.de/de/3660322/ai-nachrichten/dumb-co-dared-me-to-trade-my-iphone-for-a-hacked-flip-phone/ Fri, 10 Jul 2026 18:07:14 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Microsoft to Retire OWA Light Client In Exchange Server]]> https://tsecurity.de/de/3659664/it-security-nachrichten/microsoft-to-retire-owa-light-client-in-exchange-server/ https://tsecurity.de/de/3659664/it-security-nachrichten/microsoft-to-retire-owa-light-client-in-exchange-server/ Fri, 10 Jul 2026 14:23:38 +0200 📰 IT Security Nachrichten tsecurity.de

    Read more of this story at Slashdot.

    ]]>         <![CDATA[SAP concedes to EU, freeing CIOs from expensive support shackles]]> https://tsecurity.de/de/3659505/it-nachrichten/sap-concedes-to-eu-freeing-cios-from-expensive-support-shackles/ https://tsecurity.de/de/3659505/it-nachrichten/sap-concedes-to-eu-freeing-cios-from-expensive-support-shackles/ Fri, 10 Jul 2026 13:17:42 +0200 📰 IT Nachrichten tsecurity.de

    The European Commission is ending an antitrust investigation into SAP after the company made numerous concessions worldwide regarding maintenance and support services for on-premises versions of its ERP solution. The Commission began its investigation in September 2025, concerned that SAP forces customers to buy its services for longer, and for more licenses, than they need.

    In accepting SAP’s commitments, the Commission makes them binding on the company. SAP could still face fines if it fails to make good on its concessions over the next ten years. SAP’s promises include:

    • Greater freedom of choice in support: Customers can divide their SAP landscape into sub-areas and choose different support and maintenance providers for each area.
    • Easier license terminations: Maintenance and support contracts can be terminated in certain cases — such as when products are phased out, SAP projects fail, the company files for bankruptcy, there are staff reductions, or parts of the business are sold.
    • More flexible licensing models: SAP is expanding access to so-called “single-metric” contracts as an alternative basis for licensing and maintenance fees.
    • Relaxation of contractual obligations: In the future, the purchase of new licenses will no longer automatically extend the minimum term of existing support contracts.
    • Easier Re-entry: Customers who resume SAP support after a hiatus will no longer have to pay reinstatement fees; back payments will also be reduced.

    In addition, SAP is establishing an internal clearinghouse that customers can contact if they suspect violations of the agreed-upon obligations.

    Even though SAP said it welcomed the EU Commission’s decision, the Walldorf-based company is unlikely to be truly happy with the concessions it had to make.

    User organizations, though, are happy: Conor Riordan, chair of UKISUG, the UK & Ireland SAP User Group, said, “We welcome the proposed changes to SAP’s support and maintenance policies for on-premise customers. Our members have long called for greater flexibility, transparency and predictability, and these changes appear to be a positive move. This should give organizations more room to adapt to changing business conditions and evolve their SAP estates at a pace that suits them.”

    More flexibility with SAP support

    Michael Bloch, executive director of licensing, contracts and support at DSAG, the German-speaking SAP User Group, went into greater detail in an interview with Computerwoche, here translated from the German:

    How do you assess the European Commission’s decision in general?

    Michael Bloch: In principle, we think the decision is a good one for now. Many SAP customers will benefit from it, especially those who continue to run their ERP systems on-premises. Our investment survey shows that numerous companies have still not made the move to the SAP Cloud. They now have significantly more freedom to decide how they want to organize support for their existing software.

    Who stands to benefit on the provider side? Does the decision open up new opportunities for third-party providers like Rimini Street? Can the potential demand even be met?

    Bloch: That will be interesting to watch. At the moment, third-party maintenance is a total niche business, at least in German-speaking countries. Acceptance is significantly higher in the US, but here in Germany, many companies remain rather skeptical of the model. The EU decision could now give this market a new boost. Customers who do not wish to follow SAP’s current strategy will be able to remain on their existing infrastructure in the future and obtain support from another provider. This certainly opens up opportunities for new business models.

    Does this decision undermine SAP’s cloud strategy?

    Bloch: For customers, the decision now truly becomes a matter of principle: Do I follow SAP’s strategic direction, or do I consciously choose a different path? Those who aren’t convinced that the cloud strategy is the right one for their own company can now more easily decide to stay on their existing ERP landscape and, for example, use a different support provider.

    However, one must be clear about the consequences. Those who remain on their current system landscape — even with an alternative maintenance provider — are forgoing the innovations that SAP is currently developing around the Autonomous Enterprise. There is no middle ground here. Companies would have to develop many of these functions themselves or recreate them at considerable expense.

    So is this inevitably an either/or decision?

    Bloch: No, that’s exactly the key point. Many companies have heavily customized their ERP systems over the years or decades to fit their industry-specific processes — some customers even refer to “refined” systems. These investments don’t simply have to be written off now.

    Instead, companies can continue to operate their proven core systems while simultaneously adding targeted cloud components, such as SAP Cloud ERP for financial processes. This allows them to preserve existing investments while also leveraging new innovations. The EU decision thus opens up additional options for action, but it also makes the strategic decision more challenging for CIOs. They must now define even more precisely what their target architecture should look like for the next five to ten years.

    2027 – A pivotal year for SAP support

    Does this mean that IT decision-makers will now have to forgo a peaceful summer break?

    Bloch: I don’t think this will fundamentally increase the pressure. Extended Maintenance doesn’t start until the end of 2027, so there’s still some time left. But companies now have an additional strategic question to answer. The actual decision year is likely to be 2027. By then, many companies will have to determine which system landscape they’ll use in the future and what their long-term SAP strategy will look like.

    Even companies that want to stick with their existing ERP landscape will only receive official support until 2030. While that does buy some time, it’s by no means a long planning horizon, especially when alternative ERP strategies or successor solutions need to be evaluated.

    That’s why I view it as a positive development that the decision has now been made. It provides clarity and gives companies the opportunity to incorporate these new conditions into their strategic considerations at an early stage.

    The new regulations also make it easier for companies to dispose of unused licenses and the associated maintenance fees. How significant could the potential savings be?

    Bloch: We don’t have specific figures on that. You have to be very careful here, because it depends heavily on the individual case. The key factor is whether a company actually terminates its SAP support entirely, switches to a third-party provider, or simply no longer needs certain products. After all, a system still has to be operated.

    Is there at least a rough estimate?

    Bloch: No, we don’t have reliable empirical data. If companies have products in use that they no longer use at all, they’ll be able to cancel support for them more easily in the future and, of course, save money as a result. However, we don’t know how large this so-called “shelfware” portion actually is.

    For companies that have already migrated to S/4HANA or SAP Cloud ERP, this issue should largely be resolved anyway. It’s particularly relevant for those who still have the transition ahead of them. They can now review which unused licenses and maintenance contracts they can phase out and whether this is possible within the framework of SAP’s concessions, since regulations must be observed here as well. Those who are still paying substantial support fees today for products that are no longer in use can achieve significant savings by doing so.

    Take advantage of the options

    Does the EU decision improve companies’ negotiating position with SAP?

    Bloch: There’s no one-size-fits-all answer to that. What matters is how a company makes use of its options. In my view, the best results are generally achieved by working with SAP to find a path forward.

    Why?

    Bloch: For example, if you completely cancel SAP support and later sign a new cloud contract, you should expect to forgo certain incentives from SAP. That’s why every decision should be made with all dependencies in mind.

    In addition, SAP isn’t the only one offering incentives to move to the cloud. The hyperscalers also have a strong interest in attracting companies to their platforms and, in some cases, offer very attractive incentive programs. This means that companies’ starting points vary greatly.

    Does this make decisions easier for CIOs?

    Bloch: Quite the opposite, actually. While the new situation expands the range of options, it makes strategic decision-making significantly more complex. CIOs must now ask themselves: Which existing systems continue to provide business value for our company? Added to this are questions such as: Where is it worthwhile to retain the existing landscape? And in which areas will we actually benefit from the innovations that SAP will provide in the cloud in the future? Finding exactly this balance will be the real challenge.

    So does this decision primarily mean that companies gain more time, for example, to weather difficult economic periods or to better prepare for a move to the cloud?

    Bloch: Yes, especially for companies that haven’t yet found a compelling business case for moving to the SAP Cloud. They can continue to operate their existing landscape for the time being while simultaneously assessing whether there is still potential for cost savings by eliminating unused licenses and maintenance contracts, in other words, “shelfware.” This can certainly help in individual cases and provides more room to maneuver.

    Complexity Is Increasing

    Has the EU decision resolved the biggest problem in SAP licensing policy, or are there still issues to address?

    Bloch: Extended Maintenance remains an important issue for companies that have not yet migrated to S/4HANA. The EU decision also has an impact here. Companies now have significantly more options for organizing their existing system landscape and support in different ways. They no longer have to treat their entire software portfolio uniformly, but can make differentiated decisions depending on the situation.

    However, this also increases complexity. Companies now have a whole toolbox of options and must carefully weigh which combination is right for their strategy.

    What’s the next crucial step?

    Bloch: The key now is the practical implementation of the promised measures. Together with SAP, we need to clarify how the new regulations will be structured in detail and how companies can actually make use of them. The obligations will also be monitored by an independent trustee. I therefore hope that, together with SAP, we can provide more clarity on the operational implementation in the near future.

    Does the EU decision now create additional pressure to act?

    Bloch: I don’t think that this will immediately increase the pressure. There’s still some time left until Extended Maintenance begins at the end of 2027. That said, companies now face an additional strategic task: they must assess which new opportunities they want to take advantage of and how these fit into their SAP strategy.

    When will things get serious?

    Bloch: In my view, 2027 will be the decisive year. By then, many companies will need to determine which system landscape they will use to transition to Extended Maintenance and what their long-term SAP strategy should look like. Even companies that decide against moving to the SAP Cloud will gain some time as a result of the EU decision — but official support for their existing systems will end by 2030 at the latest. Especially when alternative ERP solutions are being evaluated in parallel, that’s not a particularly long planning horizon.

    Your conclusion?

    Bloch: Overall, it’s positive that the decision has now been made. It would have been much more difficult for companies if uncertainty had persisted until early 2027. Now the framework is clear, and companies can incorporate it into their strategic decisions early on.

    ]]>         <![CDATA[The ultimate guide to Android contacts management]]> https://tsecurity.de/de/3659335/it-nachrichten/the-ultimate-guide-to-android-contacts-management/ https://tsecurity.de/de/3659335/it-nachrichten/the-ultimate-guide-to-android-contacts-management/ Fri, 10 Jul 2026 12:03:31 +0200 📰 IT Nachrichten tsecurity.de

    You’d think keeping tabs on your contacts would be about the simplest and most straightforward task imaginable in our modern connected world — wouldn’t you?

    I sure would. But as I’ve learned over the years, that perfectly understandable instinct couldn’t be more inaccurate.

    Effectively wrangling your contacts on Android and keeping ’em manageable, organized, and optimized for efficiency really is a fine art. And in a way, it’s no wonder: Most of us have reached a point where our phones’ contacts are a sprawling goulash of earthlings from all different eras of our lives — clients, colleagues, college buddies, and, of course, your cousin Carl from Poughkeepsie.

    Making matters even more complex is the fact that what constitutes “Android” is a wildly different experience from one device to the next. And most Android phone-makers don’t exactly make it easy for you to make the most of your messy contacts stew.

    The good news, though, is that it doesn’t have to be so difficult. Today, we’ll start from square one and get your contacts in tip-top shape, no matter what type of Android phone you’re using or how many unruly old bosses’ email addresses you’ve got stored away.

    By the time we’re done, your Android phone contacts will be as orderly as can be — and you’ll be equipped with all sorts of practical knowledge for harnessing their typically untapped potential.

    Part I: Android contacts streamlining

    First and foremost, we need to make sure we’re all on the same page — ’cause as we just mentioned a moment ago, the Android contacts situation is anything but standardized across the platform.

    Specifically, if you’re using a Samsung phone, we need to get you off of Samsung’s subpar and proprietary contacts service and into Google’s better, smarter, and more platform-agnostic alternative.

    Samsung’s main goal with its products, y’see, is to keep you within its own universe. The company wants you to continue using Samsung stuff and buying Samsung stuff, and it makes that more of a priority than giving you an optimal experience.

    The company’s Contacts app is the perfect example: The app offers no noteworthy advantages over Google’s standard Android Contacts service, and it’s available only on Samsung-made Android devices. It’s less fully featured and pleasant to use than Google’s version, too, and it makes it much more difficult to access your contact info from a computer or any other type of device.

    So why does Samsung insist on making that the default contacts service on its phones instead of sticking with Google’s readily available offering? Simple: because it locks you into Samsung’s self-serving ecosystem.

    Let’s break you free, shall we?

    • Open up the Contacts app on your phone (the one probably represented by a glaringly bright red icon).
    • Tap the three-dot menu icon in its upper-right corner, then tap “Settings” followed by “Sync contact accounts.”
    • Make sure your main Google account is present and has its toggle active on the screen that comes up next. If you don’t see it, tap the “Add account” option to add it into the mix.
    screenshot of samsung contacts app - sync accounts screen

    Both your Samsung account and your Google account need to be added and set to sync in the Samsung Contacts app.

    JR Raphael / Foundry

    Got it? Good. Now, go download the Google Contacts app from the Play Store. Open it up and approve the permissions it needs to operate. Then make a point to start using it instead of Samsung’s silliness (which, by the by, Samsung won’t let you uninstall or even disable) from here on out.

    If you’re using an older Samsung device and the steps described above don’t quite match what you’re seeing, poke around in the Contacts app until you find a similar set of options. They should be there somewhere; the specifics of the interface have just evolved somewhat over the years, so older versions of the app may not be exactly the same.

    If you have a non-Google-made phone from someone other than Samsung, meanwhile, check to see if your contacts app is the actual Google Contacts app or not. If it isn’t — and if your device-maker gave you some other random alternative in its place — poke around in that app and try to find a similar set of options for syncing everything over to your Google account. If that isn’t possible, find the option to export your contacts from that app and then look for the import option within the Google Contacts Android app to get to the same spot.

    Part II: Android contacts accounts and labels

    Now that we’re all looking at the same place and dealing with the same best-available Android contacts management option, let’s take a few minutes to get the lay of the land, shall we?

    When you first open the Google Contacts app on Android, you’ll see a merged view of all contacts from every Google account you have connected to the phone. But take note: If you tap the “All contacts” line toward the top of the screen, you can switch to seeing contacts associated with only one individual Google account at a time — assuming you have multiple Google accounts connected — instead of seeing them combined together all at once.

    That could be useful if, say, you have both a work account and a personal account connected to your device — or maybe you’re a freelancer and you have multiple work-related accounts connected for different purposes.

    screenshot of accounts list in google contacts app

    The Google Contacts app makes it easy to see contacts from individual accounts or all of your connected accounts together.

    JR Raphael / Foundry

    If you tap the triangular three-line icon to the right of the “All contacts” dropdown, meanwhile, you’ll find a few filtering options that could be helpful as alternatives to the large search bar at the top of the screen — if, for instance, you need to find a contact and only know the name of their company but also can’t quite think of that company’s name and need a prompt. Tap that icon, select “Company,” and you’ll see a list of every company name in your contacts that you can scroll through and select to apply as a filter.

    Finally, if you tap the outlined arrow-like shape to the left of the filter icon, you’ll see a list of any labels you’ve created for your contacts. Labels in Google Contacts work exactly like labels in Gmail: You can create as many as you like, and you can apply any number of labels onto any given contact. They’re less like folders, in other words, and more like stickers — or, y’know, labels — in that there’s no limit to how many any particular contact can have.

    So why would you want to bother with labels, you might be wondering? Well, I’ll tell ya: They’re a splendid way to break that mess of mammals in your life down into specific, meaningful groups instead of always viewing ’em in one gigantic lump.

    Maybe, for instance, you’d have a label called “Work” that includes everyone from your current company. And maybe you’d have a separate label called “Team” that’s even more narrow and shows only the people you directly work with. Maybe you’d have another label for clients, another for specific subsets of clients, and another for all the people in your life named Josh.

    Once you do that initial organization, you’ll have an easy way to limit your view to only the individuals you need at any given moment — and you’ll gain a couple of other easily overlooked advantages, too, as we’ll explore further in a moment.

    First, to apply a label onto a contact once you’ve created it:

    • Tap the contact to open it.
    • Tap the pencil-shaped editing icon in its upper-right corner.
    • Scroll down and look for the “Labels” option.
    • Tap it, then select whichever label or labels you want to add onto that contact and tap “OK” to save.

    If you want to apply a label onto multiple contacts at the same time:

    • Tap the label icon — that arrow-like shape we were just talking about a moment ago, on your main contacts list — then select the label you want to use.
    • Tap the icon that looks like an outline of a person with a plus sign next to it, in the upper-right corner of the screen, and then select whichever contacts you want to add into the label by tapping them all once.
    • When you’re finished selecting, tap the “Done” option in the upper-right corner of the screen, and all of the contacts you selected will be added in one fell swoop.
    screenshot of a label and the contacts associated with it in google contacts app

    Once you open a specific label within the Android Contacts app, you can see everyone who’s associated with it and add in new contacts en masse.

    JR Raphael / Foundry

    Capisce? Capisce. Now, let’s move on to some even more advanced Android contacts goodness.

    Part III: Advanced Android contacts enhancements

    When you first tap a person’s name within the Google Contacts app on Android, you’ll see a screen with their profile appear.

    screenshot of a contact profile page in google contacts app

    Anyone you store in your contacts on Android will have a custom profile that puts all your notes and info about them in a single place.

    JR Raphael / Foundry

    A smattering of interesting features worth noting here:

    • As of a relatively recent addition, the Google Contacts app allows you create a custom calling card that adds a background image into the top of that person’s profile and controls exactly what you see on your screen anytime they call you. If you aren’t seeing a background image in this area already, as illustrated above, look for the option to add a calling card — which should appear in that same general space.
    • You can also create your own custom calling card that controls how you show up by default on other people’s devices — provided they’re also using the Google Contacts app on Android, of course — if you’re ever so inspired.
    • And if you’ve had any interactions with a contact, you’ll be able to see a quick overview of that activity in the “Recent activity” area beneath that — along with any notes you’ve created for the person within their contact profile.
    screenshot of contact details page in google contacts app - includes recent interactions and weather

    Your contacts’ profiles can contain all sorts of useful extras, ranging from an overview of your recent interactions with the person to a live look at the weather in their area.

    JR Raphael / Foundry

    To edit a profile, as you’d probably guess, you’ll just tap the pencil-shaped editing icon in the upper-right corner of the screen.

    And one more advanced Android contacts option worth mentioning: Directly next to that pencil icon, you’ll see a hollow star in the upper-right corner of every contact’s profile. You can tap that to fill the star in and mark that person as a favorite.

    Doing so will have some significant effects:

    • That person will always appear at the top of your contacts list.
    • They’ll also typically show up in a special, more prominent area of your Phone app for extra-easy access (and if they don’t, try downloading the Google-made Phone app and using it in place of whatever alternative your phone’s maker preinstalled in its place).
    • And they’ll be granted special privileges to reach you even when your phone is in Do Not Disturb mode, with the specifics depending on your preferences in that area of your system settings.

    Part IV: Android contacts optimization

    One of the best features of the Google Contacts service is how easy it makes it to clean up and optimize your contacts collection.

    From the Contacts app on your phone, tap the “Organize” tab at the bottom of the screen — then:

    • Tap the “Merge & Fix” option.
    • Look to see what suggestions the app gives you, then tap ’em one by one and follow the steps within.
    screenshot of merge and fix screen in google contacts app

    The Google Contacts app offers intelligent suggestions for quickly cleaning up your contacts.

    JR Raphael / Foundry

    Google Contacts will identify any instances where it looks like you’ve got two separate contact entries for the same person and then offer to quickly combine them for you. It’ll also let you know when it’s found more up-to-date contact info for anyone in your list. And it’ll offer to add in entries for anyone you email often but haven’t yet added.

    Easy peasy, right?

    And last but not least, for the virtual icing on your Android contacts cake…

    Part V: Android contacts actions

    Once you’ve gotten your contacts created, organized, and cleaned up properly, the Google Contacts app on Android has several advanced actions that are all too easy to miss.

    • You can use the Contacts app as an efficient way to start a new group email or text message thread with any selection of people you want. Just make sure the people are all in the same label, then tap the label icon in the app’s upper-right corner and select the label. Next, tap the three-dot menu icon in the upper-right corner of the label screen and look for the “Send email” or “Send message” option.
    • The Contacts app can also serve as an all-in-one hub for initiating communication with anyone in your collection. Open someone’s profile, and you’ll see one-tap icons for calling them, texting them, emailing them, or starting a Google Meet video call with them — all without ever having to poke around in any other apps.
    • If you want even easier access to certain high-profile people, check out the Google Contacts widget options: Long-press on any open area of your home screen, select the option to add a widget, and then look for the Contacts section. There, you should see options for adding square-shaped widgets that show a person’s photo along with one-tap links for calling or texting them as well as simpler icon-like shortcuts for calling or texting a specific contact. In the latter case, you can add as many of those as you want onto your home screen and even drag ’em on top of each other once they’re there to create convenient folders.
    screenshot of google contacts widget on android home screen

    The Google Contacts app’s widgets are a wonderful way to keep one-tap shortcuts for calling or messaging important people close by.

    JR Raphael / Foundry

    • Speaking of calling convenience, if there’s a certain contact who calls you a little too often — an overly eager recruiter or maybe that blasted cousin of yours (come on, Carl!) — the Google Contacts app has an easy way to automatically route all of their calls directly to your voicemail. Just open the person’s profile within the app, then scroll down and look for the “Send to voicemail” option — or look a little lower for “Block numbers,” if you really never want to hear from them again.
    • In that same area of a contact profile is a speedy shortcut for setting a custom ringtone for any contact so it’s especially easy to identify them (or hide in the nearest underground bunker) whenever they call.
    • And don’t overlook the recently added “Reminders” section, where you can store dates like birthdays and anniversaries and create reminders around ’em, in addition to having ’em appear within the app itself.

    Last but not least, the real beauty of the Google Contacts setup on Android: It works equally well no matter what type of device you’re using.

    On any phone you move into in the future, you can simply install the Google Contacts app, if it isn’t already in place, and all your stuff will instantly be there, synced, and available to you — no restoring required. And if you ever want to poke around or update your contacts from a computer, all you’ve gotta do is pull up the Google Contacts website in any browser where you’re signed in.

    So the Android contacts situation isn’t exactly straightforward, as you’ve seen. But once you get it under control, it absolutely can be easy and effective — and, with a teensy bit of advance planning, an important piece of your mobile productivity puzzle.

    This article was originally published in November 2022 and updated in July 2026.

    ]]>         <![CDATA[Operate like a Formula 1 team: The new AI operating model]]> https://tsecurity.de/de/3659196/it-security-nachrichten/operate-like-a-formula-1-team-the-new-ai-operating-model/ https://tsecurity.de/de/3659196/it-security-nachrichten/operate-like-a-formula-1-team-the-new-ai-operating-model/ Fri, 10 Jul 2026 11:07:22 +0200 📰 IT Security Nachrichten tsecurity.de

    It is lap 47 of 57.

    Before the race began, the team had already processed gigabytes of race data, simulations, tire models, weather forecasts, competitor tendencies and scenario plans. But on the pit wall, there is tension.

    The race leader’s tires are degrading faster than predicted. A rival has just pitted for fresh tires and is closing the gap by three-tenths of a second per lap. The lead may not hold. In short, the race is not going to plan.

    A strategist now has only seconds to synthesize live telemetry, competitor data, weather projections, tire inventory, track position and race simulations into one call that could determine the outcome.

    They do not have those seconds because they are simply fast. They have them because the entire system behind the decision was designed that way: the data architecture, simulation models, communication protocols, decision rights, scenario playbooks and feedback loops all work together to compress complexity into a clear decision window.

    What if this is not just a racing story? What if it is also a blueprint for how the best enterprises will operate in the AI era?

    This builds on a broader shift I’ve described as the intent-driven future of work, where enterprise work begins less with navigating systems and more with expressing outcomes, context and intent.

    The AI advantage will not belong to companies with the most tools. It will belong to companies that redesign how work senses, decides, acts and learns.

    AI isn’t just a faster engine

    The popular story about Formula 1 is usually about speed or the quality of the driver. The fastest car with the most powerful engine with the driver with the quickest reflexes will win. But anyone who follows the sport closely knows that raw speed is only the starting point.

    Every car on the track is fast. Speed gets you into the race. It does not guarantee you a win.

    The teams that win consistently do so because of the quality of the system surrounding the car. They connect telemetry, simulations, strategy, engineering, pit operations, driver judgment and real-time learning into one high-performance operating model.

    Every part of that operating model matters. But the best individual part alone does not win the race.

    Enterprise AI strategy is at risk of making the same mistake that would keep an F1 team stuck in the middle of the pack: investing heavily in the engine while underinvesting in the entire race system.

    I see enterprising investing in more copilots, more agents, more dashboards, more tools and ultimately more automation. 

    The AI systems perform their tasks at unprecedented speed. But the business outcomes do not change. In many ways, AI is becoming a new operating system of work not because it replaces every application, but because it changes how intent, context, workflow and execution come together.

    That is the gap many organizations are now facing. They have access to powerful AI capabilities, but they have not yet redesigned the operating model around those capabilities. The result is faster individual task execution inside disconnected systems, fragmented workflows and unclear accountability. In fact, a recent McKinsey report found that 88% use AI but two-thirds haven’t scaled it.

    The next phase of AI value will not come from simply adding more AI tools. It will come from redesigning how the enterprise senses, decides, acts and learns.

    The enterprise has too many disconnected signals

    Most enterprises do not suffer from a lack of signals. In fact, they are everywhere across the business.

    Customer intent signals, campaign performance data, product usage patterns, sales activity, support interactions, contract information, financial indicators, employee sentiment, security events and operational metrics already exist throughout an organization.

    The problem is signal fragmentation.

    The average knowledge worker has become the integration layer of the enterprise. They move between CRM, marketing automation, analytics dashboards, spreadsheets, collaboration tools, support systems, workflow platforms and financial reports. Then they manually assemble context that no single system provides.

    They do this to answer questions that should take seconds, not hours.

    • Which customer needs attention?
    • Which opportunity is at risk?
    • Which process is slowing down execution?
    • Which signal should trigger action?
    • Which decision needs human judgment?

    In Formula 1 terms, this would be like a pit crew strategist having to call five different team members to gather tire degradation data, track conditions, competitor lap times, fuel load, weather forecasts and pit stop windows before making a race-defining call.

    The data exists. But the latency in accessing, interpreting and acting on it makes it less valuable at the moment of decision.

    That is the signal-to-action gap. And closing that gap is one of the most important opportunities in enterprise AI.

    The new operating model: Sense, decide, act, learn

    The AI-native enterprise needs to operate more like a Formula 1 team: continuously sensing, deciding, acting and learning.

    • Sense is the foundation. It means connecting the right signals across systems, workflows, customers, employees and operations into a layer that AI can reason across. This is not just reporting on the past. It is creating the ability to understand what is happening now and anticipate what is likely to happen next.
    • Decide is where AI intelligence and human judgment come together. AI can surface context, detect patterns, model options and recommend actions. Humans bring business judgment, ethical reasoning, organizational context and accountability. The quality of this partnership depends on the quality of the signals and context available to both.
    • Act is where intelligence turns into execution. The goal is not another recommendation sitting in a dashboard. The goal is a workflow that triggers the right action, with the right controls, at the right time.
    • Learn is where the operating model becomes a competitive advantage. Every action should generate feedback. Every outcome should improve the next recommendation. Every workflow should become smarter over time.

    In Formula 1, every lap creates learning. Tire wear, track temperature, driver feedback, competitor movement and weather changes continuously reshape strategy.

    The enterprise needs the same kind of learning loop.

    Semantic intelligence is the missing layer

    To close the signal-to-action gap, enterprises need more than data integration. They need semantic intelligence.

    Semantic intelligence is what helps AI understand enterprise meaning. It connects business language, customer context, workflow relationships, policies, roles, systems and outcomes so AI can reason across the business, not just retrieve information from systems.

    A customer health score is not just a number. Its meaning depends on product usage, renewal timing, support history, stakeholder engagement, commercial value, sentiment, implementation milestones and prior interventions.

    A delayed workflow is not just a status update. It may signal unclear ownership, missing approvals, poor handoffs, missing context, poor data quality or a decision that needs escalation.

    A sales opportunity at risk is not just a CRM field. It may reflect adoption gaps, customer sentiment, usage decline, executive sponsor changes, pricing friction, support issues or service delivery risk.

    Without semantic intelligence, AI can summarize what happened. With semantic intelligence, AI can understand what matters, why it matters, who needs to act and what action is most likely to improve the outcome.

    This is where enterprise AI value compounds. Foundation models will become broadly available. The model itself will not be the moat. The moat will be enterprise context, semantic intelligence, workflow intelligence, governance and learning loops.

    Redesign work before automating it

    There is a warning in the Formula 1 analogy that deserves attention: adding more power to a poorly designed system does not make it high performing.

    The same is true for enterprise AI. Adding AI to a broken workflow does not fix the workflow. It just compounds the dysfunction.

    If the data is fragmented, AI will produce incomplete recommendations confidently. If governance is disconnected from execution, AI can scale risk as quickly as it scales productivity.

    The question teams ask shouldn’t be, “Where can we insert AI into this existing process?”

    The better question is, “If we were designing this work from scratch, knowing what AI now makes possible, how should it operate?”

    This pushes leaders to clarify where work starts, what signals matter, which decisions should be automated, where human judgment is required, what controls must be embedded, how outcomes should be measured and how the system should learn.

    This is where CIOs, CTOs and technology leaders have an expanded role. AI transformation is no longer only about deploying technology. It is about redesigning how the enterprise works.

    Context becomes the differentiator

    In a world where every enterprise can access powerful models, context becomes the differentiator.

    The winning organizations will not be the ones with the most AI tools. They will be the ones with the strongest enterprise context and the clearest path from signal to action.

    That context includes customer history, product usage, workflow patterns, decision history, business rules, governance standards, risk boundaries, organizational knowledge and outcome feedback.

    It also includes knowing what happened after a decision was made. Did the action improve retention? Did it accelerate a deal? Did it reduce cycle time? Did it improve customer experience? Did it create risk? Did it scale?

    Without that feedback, AI remains a recommendation layer. With it, AI becomes part of a learning operating model.

    This is why the most important AI investments are not always the most visible ones. Data quality, identity, access, governance, workflow integration, observability, semantic models, feedback loops and change management may not sound as exciting as the latest AI agent. But they are what allow AI to create durable enterprise value.

    The CIO as architect of the race system

    The CIO’s role is evolving from technology operator to architect of the enterprise race system.

    That means connecting strategy, workflows, data, platforms, governance, security, talent and execution into an operating model that can move faster without losing control. The CIO’s job is no longer just to provide platforms. It is to design the conditions where intelligence can move safely and effectively through the enterprise with the right context, controls, accountability and feedback loops.

    Business teams need the ability to experiment and innovate. But they need to do so within clear standards for data access, identity, security, privacy, model usage, auditability, human oversight and business accountability.

    This is the balance every enterprise needs to strike: speed with control.

    The future is federated innovation with centralized guardrails. It is an enterprise operating model where more people can create value with AI, but within a trusted architecture that protects the company, the customer and the quality of decisions.

    The companies that pull ahead in the next decade will not be the ones that deployed AI first or assembled the largest portfolio of tools.

    They will be the ones who built the enterprise equivalent of a winning Formula 1 race system: a connected operating model.

    In Formula 1, the gap between the team that wins the championship and the team that finishes fourth is often measured in tenths of a second per lap. Compounded over a race distance, those tenths become decisive.

    The same dynamic is emerging in enterprise AI.

    This article is published as part of the Foundry Expert Contributor Network.
    Want to join?

    ]]>         <![CDATA[Relearning cloud lessons from runaway AI token costs]]> https://tsecurity.de/de/3659187/ai-nachrichten/relearning-cloud-lessons-from-runaway-ai-token-costs/ https://tsecurity.de/de/3659187/ai-nachrichten/relearning-cloud-lessons-from-runaway-ai-token-costs/ Fri, 10 Jul 2026 11:03:11 +0200 🔧 AI Nachrichten tsecurity.de

    Every few years, some new technology comes along that promises to revolutionize how we do business, and enterprises pile in headfirst without asking how much it’s going to cost. I’ve been watching this movie for 30 years. Cloud computing was the first act. Now it’s generative AI, and the bill is arriving faster than anyone expected.

    The latest data shows that many enterprises are seeing their AI token costs run 10 to 20 times higher than initial projections. That’s not a rounding error. That’s a strategic miscalculation that CFOs are starting to notice, and they’re not happy about it.

    Here’s the thing: This crisis was entirely predictable. We’ve been through this before with cloud computing, and we learned some hard lessons about what happens when you deploy technology without rigorous cost management. The good news is that enterprises are finally applying those lessons, reaching back to their cloud finops playbooks to wrangle this new breed of spending.

    The 50x problem

    Let me explain the scale of what’s happening. Goldman Sachs has estimated that AI agents consume roughly 50 times more computing power per task than traditional prompt-based chatbots. That’s a fundamental shift in how resources get consumed. When you multiply that across an enterprise that’s deploying dozens or hundreds of AI agents, the math gets ugly fast.

    The token problem compounds because AI costs are inherently variable. Unlike traditional software licensing or infrastructure contracts, you pay per token, and per-token usage can fluctuate wildly based on user behavior, query complexity, and the sheer volume of requests flowing through these systems. This is exactly the same problem we faced with cloud computing. Every time someone spins up a new instance or stores data in the wrong tier, the bill goes up.

    Enterprises expected to deploy AI and see costs stabilize. Instead, costs are climbing month after month, often exceeding projections by an order of magnitude. The business case that looked compelling in the conference room is looking considerably less attractive in the finance committee.

    Lessons from the cloud playbook

    Here’s where it gets interesting. Cloud providers and the managed service providers who work with them have spent the better part of two decades building disciplines around financial operations—finops, if you want to use the buzzword. These are the practices, tools, and organizational structures that make cloud spending visible, controllable, and ultimately justifiable to the business.

    Those same disciplines are now being applied to AI token costs, and enterprises with mature finops programs are faring better than those without. The playbook is essentially the same:

    • Make spending visible.
    • Attribute costs to the right teams.
    • Set guardrails and alerts.
    • Create feedback loops that encourage efficient behavior.

    Companies like Priceline have deployed dashboards that provide executives with real-time visibility into token consumption, with monthly reports delivered directly to the CFO and CTO. Smartsheet has implemented similar approaches, providing department-level dashboards that let managers see exactly how their teams are consuming tokens, with automated alerts when consumption approaches predefined thresholds.

    The accountability piece is critical. When developers and business users can see exactly how their AI usage translates to dollars, they tend to make better decisions about which models to use, how to structure prompts, and when to rely on human judgment instead of AI processing.

    The show-back revolution

    One of the most effective techniques emerging from this crisis is the “show back” approach to AI cost management. Rather than simply reporting costs to individual departments, companies are now attributing AI spending to the teams and individuals responsible for driving that consumption. This creates accountability without the organizational complexity of full chargeback models.

    OpenText has reported that implementing show-back and chargeback approaches can reduce token costs by 20% to 30% within a few months. That’s not trivial. If you’re spending $5 million a month on AI tokens, that’s a $1.5 million savings just by making people aware of what they’re spending.

    The mechanism is straightforward: When development leaders understand that their team has consumed $200,000 in tokens this month, they start asking questions. Why are we using the most expensive model for that task? What if a smaller model could handle 80% of these queries? Are prompts being repeated unnecessarily? These questions lead to optimization, and optimization leads to savings.

    Model smarts

    Another lesson from the cloud experience is that the most expensive option is rarely the best option. This sounds obvious, but organizations tend to default to the largest, most capable AI model for every task, regardless of whether that capability is actually required.

    The emerging best practice is to match model capability to task requirements. A simple classification task doesn’t need a frontier model. A straightforward text-generation job might be handled perfectly by a smaller, cheaper model running locally or via a less expensive API tier. The efficiency gains from this approach can be substantial.

    Some enterprises are going further, adopting older models or open source alternatives for appropriate use cases. Qualcomm, for instance, has invested in running models on its own hardware rather than relying exclusively on cloud-based model providers. This approach requires more technical sophistication but can dramatically reduce per-token costs for high-volume applications.

    The real challenge

    Here’s what concerns me most about the current situation. Many enterprises deployed AI without putting adequate cost management infrastructure in place up front. They got caught up in the excitement of the technology, the competitive pressure to move fast, and the belief that the benefits would justify whatever the costs turned out to be. That approach worked when AI projects were small-scale experiments. Now that AI is becoming core to business operations, the lack of financial controls is becoming a serious problem. We need to bring the same rigor to AI procurement and deployment that we’ve brought to every other significant technology investment.

    The organizations that succeed will treat AI token costs as a managed operational expense rather than an unpredictable variable. That means deploying the same tools and disciplines that have worked for cloud cost management: visibility, accountability, optimization, and continuous improvement.

    Cloud providers and the managed service partners who work with them have been doing this for years. They built the tools, developed the best practices, and trained the workforce that can now apply those skills to the AI cost challenge. If your organization is struggling with AI spending, finding partners with deep finops experience might be the fastest path to control.

    The good news is that this crisis is solvable. But it requires acknowledging the problem, investing in the right capabilities, and accepting that technology deployment without financial discipline is a path to trouble.

    Get smart about your AI spending. The CFO will thank you.

    ]]>